This policy explains what personal data Amazons House holds about you, why, who else handles it and what your rights are. It applies to our website, the member app and the studio.
1. Who is responsible for your data
The data controller is [REGISTERED BUSINESS NAME], registration number [REGISTRATION NUMBER], [STUDIO ADDRESS], Cyprus, trading as Amazons House.
For anything about your data, write to [email protected] or ask at the front desk.
2. What we hold
- Account details: your name, email address, phone number, date of birth and an encrypted (hashed) password. We cannot see your password.
- Profile photo, if you or the front desk add one. It helps staff recognise you at check-in.
- Membership records: your plan, start and end dates, freezes and their reason, discounts, and the history of changes.
- Payment records: what you paid, when, how (cash, card, transfer…) and for which period, and refunds. For card payments in the app we keep the payment processor's reference numbers only. We never receive or store your card number, expiry date or security code.
- Attendance: class bookings and check-ins.
- Training and health-related information that you or your coach record: measurements, progress entries, goals, nutrition plans and notes, any documents you upload with them, and anything you tell us about injuries, pregnancy or medical conditions (for example as the reason for a freeze).
- Credits, levels, rewards, referrals and shop orders.
- Your consent choices (marketing, photos and video) and when you made them.
- Messages we send you in the app and by email.
- Notes staff make about your membership.
- Technical data needed to run the service securely: your sign-in sessions, IP address and device or browser type.
3. Why we use it, and on what legal basis
- To provide your membership: account, bookings, check-ins, payments, credits and orders. Basis: our contract with you.
- To keep accounts and tax records. Basis: legal obligation.
- To keep the service secure, prevent abuse and fraud, and understand how busy the studio is. Basis: our legitimate interests.
- To record and use health-related information for coaching (measurements, nutrition, injuries, freeze reasons). Basis: your explicit consent, which you can withdraw at any time. You never have to give us health information to be a member, though without it some coaching cannot be tailored to you.
- To send you news and offers. Basis: your consent. Service messages about your own membership (payments, renewals, booking changes) are sent because they are part of the service.
- To use photos or video in which you can be identified, on social media or elsewhere. Basis: your consent, given separately for each use.
We do not make decisions about you by automated means that have legal or similarly significant effects, and we do not sell your data.
4. Who else handles your data
We share data only with the people and companies who need it to run Amazons House:
- Our staff and coaches, each only as far as their role requires. Coaches see training and nutrition information for the members they work with; payment information is limited to staff who handle payments.
- Viva (Viva Payments), which processes card payments. When you pay by card we send Viva your name, email and phone number with the amount; you give your card details to Viva directly.
- Resend, which delivers our emails.
- Cloudflare, which protects and delivers our website.
- Amazon Web Services, where the app and its database are hosted.
- Our accountant and professional advisers, and public authorities where the law requires it.
These providers act on our instructions under data-processing agreements. Some may process data outside the European Economic Area; where they do, it is protected by safeguards the European Commission has approved, such as standard contractual clauses.
5. How long we keep it
- Your account and membership data: for as long as you are a member, and afterwards for as long as needed to answer questions or claims.
- Payment and accounting records: for the period tax and accounting law requires, currently at least six years, even after your account is deleted.
- Health-related information, measurements, documents and photos: until you ask us to delete them or your account is deleted.
- Marketing consent: until you withdraw it.
When your account is deleted we erase your profile and everything linked to it. The payment records we must keep stay in our books; on a formal erasure request we remove your name from them where the law allows.
6. Your rights
You have the right to:
- see the data we hold about you and receive a copy;
- have wrong or incomplete data corrected (much of it you can edit yourself in the app);
- have your data deleted, where we have no legal reason to keep it;
- restrict or object to certain uses, including any use based on our legitimate interests;
- receive the data you gave us in a portable format;
- withdraw any consent at any time, in the app under Privacy & Consent or by telling us. Withdrawing does not affect what was done before.
To use any of these rights, write to [email protected]. We answer within one month. There is no charge.
If you are unhappy with how we handle your data, please tell us. You also have the right to complain to the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus (dataprotection.gov.cy).
7. Cookies and similar technologies
We use only what the service needs: a cookie that keeps you signed in, and a setting stored in your browser that remembers whether you chose the light or dark theme. We do not use advertising or analytics trackers. Cloudflare may set a strictly necessary security cookie to protect the site.
8. Security
Access to the app is protected by individual logins and role-based permissions for staff. Data travels encrypted, passwords are stored only in hashed form, card details never reach our systems, and photos and documents are available only to you and authorised staff. No system is perfectly secure; if a breach ever puts you at risk we will tell you and the authority as the law requires.
9. Children
The member app is for adults. A member under 18 may join only with a parent or guardian's consent, and the parent or guardian may exercise the child's rights. See our Children / Minors Policy.
10. Changes to this policy
We update this policy when our services or the law change. The current version, with the date it was last updated, is always in the app and on our website. We will tell you about important changes.