IRY Wellness — Privacy Policy

1. Who We Are

IRY Wellness is a private Pilates studio run by Iry, offering personalised Reformer and Mat Pilates training. For the purposes of the GDPR, IRY Wellness is the data controller responsible for your personal data.

2. Personal Data We Collect

We may collect the following categories of personal data:

• —Contact details: name, email address, phone number
• —Booking & membership data: session history, membership or package type, payment status
• —Payment data: processed by our payment provider — we do not store full card details ourselves
• —Health & physical information: details relevant to your training (e.g. injuries, pregnancy, medical conditions, posture or mobility concerns), shared before/during a Session
• —Communication data: messages exchanged via WhatsApp, Instagram or email
• —Technical data: standard website usage data and cookies if you visit our website (see Section 7)

3. Why We Collect Your Data & Our Legal Basis

We process your personal data for the following purposes:

• —To manage your booking, membership and payments (performance of a contract)
• —To provide safe, individually adapted training, including using health information you share with us (explicit consent — see Section 4)
• —To communicate with you about your sessions, schedule changes or account (performance of a contract / legitimate interest)
• —To send you offers, news or promotions, only where you have opted in (consent)
• —To meet our legal and administrative obligations, e.g. bookkeeping (legal obligation)
• —To improve our services and studio experience (legitimate interest)

4. Health Information

Because Pilates training is individually adapted to your body, we may ask you to share health-related information (such as injuries, pregnancy or medical conditions) as part of your sign-up or ongoing training. This is special category data under the GDPR. We only collect and use this information with your explicit consent, solely to design and adapt your training safely, and we do not use it for any other purpose. You may withdraw this consent at any time, though this may limit our ability to train you safely.

5. Who We Share Your Data With

We do not sell your personal data. We only share personal data with:

• —Our booking and website platform, which hosts our scheduling system and website
• —Our payment processor, to handle transactions
• —Authorities, where required by law

We do not otherwise share your personal data with third parties for their own marketing purposes.

6. How Long We Keep Your Data

We keep your personal data only for as long as necessary to provide our services, maintain our administration and comply with legal obligations (Dutch tax law requires certain financial records to be kept for 7 years). Health information is retained only for as long as you remain an active client, plus a reasonable period afterward, unless you request earlier deletion.

7. Cookies & Advertising Analytics

When you first visit our website, you'll be asked to Accept or Decline cookies. Nothing beyond what's strictly necessary to run the site loads before you choose, and you can change your choice at any time via the "Cookie Settings" link in the website footer.

If you accept, we use:

• —Google Analytics 4, to understand how visitors use our site
• —Meta (Facebook/Instagram) Pixel and TikTok Pixel, to measure and improve the performance of our advertising

We also share a limited signal about certain actions on our website (such as viewing pricing, starting a booking, or completing a purchase) directly with Meta and TikTok's advertising systems from our own servers, alongside the cookies above — this helps those platforms measure ad performance even if a browser blocks the cookie-based pixel. If you've accepted cookies, this includes information that helps match the action to you, such as a securely hashed (irreversibly scrambled) version of your email address, or identifiers already stored in your browser by the cookies above. If you've declined cookies, we still send a limited signal — for example, that a purchase of a certain value occurred — but with no information that could identify you: no IP address, no device or browser information, no hashed contact details. This is aggregate signal only, used by the ad platforms to estimate overall campaign performance, not to build a profile of you individually.

8. Photos & Social Media

We may take photos or videos at the Studio for use on our website or social media (e.g. Instagram, @iry.trainer, @iry.wellness). If you do not wish to be included, please let us know before your session, or at any time afterward, and we will remove the content where possible.

9. Data Security

We take appropriate technical and organisational measures to protect your personal data against loss, misuse or unauthorised access, including using reputable, secure platforms for booking, payment and communication.

10. Your Rights

Under the GDPR, you have the right to:

• —Access the personal data we hold about you
• —Correct inaccurate data
• —Request deletion of your data
• —Restrict or object to certain processing
• —Withdraw consent at any time (without affecting processing carried out before withdrawal)
• —Request data portability

To exercise any of these rights, contact us via WhatsApp or email. If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

11. Minors

Our services are intended for adults. If a minor’s data is provided to us, this is done with the consent and involvement of a parent or legal guardian.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The most current version is always available on our website, and significant changes will be communicated where appropriate.

13. Contact

Questions about this Privacy Policy or your personal data can be sent via WhatsApp (+31 6 1840 8879) or Instagram (@iry.trainer) direct message, or by email at info@irywellness.com.