Privacy Policy
1. Controller
BALLET barre München, proprietor Marta Lucarelli, Pfeuferstr. 2, 81373 München, Germany, info@ballet-barre.com, phone 0152 08 49 29 29.
2. What we process and why
Account and sign-in: your name, email address and the language you have chosen. We need this to manage your bookings and to know who is attending a class.
Bookings: which class you booked, when, and whether you attended.
Credit and payments: your credit movements, your customer reference, payments received and amounts due.
Invoices: the particulars required by law.
Declarations: the version and the time of the declarations you have confirmed.
Emails: we send you confirmations relating to bookings, credit, payments and invoices.
Reach and booking statistics for the public pages – counting page views without an identifier; with your consent, additionally attributing views to a random identifier (Section 7).
We do not collect health information. The Participation and Health Declaration in Annex 1 to the Terms and Conditions of Participation is a confirmation and contains no information about your health. If you tell the instructor about a limitation before a class, that information is not stored.
3. Legal bases
Processing for your account, bookings, credit, payments and the related emails is carried out to perform our contract with you (Art. 6(1)(b) GDPR).
Invoices are retained to comply with our legal obligations (Art. 6(1)(c) GDPR).
Sign-in records are kept to protect your account against unauthorised access (Art. 6(1)(f) GDPR).
We send marketing emails only with your consent (Art. 6(1)(a) GDPR).
Counting page views: Art. 6 (1) (f) GDPR. Extended statistics: Section 25 (1) TDDDG and Art. 6 (1) (a) GDPR.
4. Signing in with a code
You sign in using a code we send to your verified email address. We store the time of sign-in and failed attempts.
5. Partner platforms
If you book through a partner platform such as ClassPass, Wellpass or Urban Sports Club, your contract is with that platform. Your name and the platform you stated appear on the class participant list so that your attendance can be recorded at check-in. We do not transmit any information about you to the platform. Your relationship with the platform is governed by its terms and its privacy policy.
6. Recipients
We use carefully selected service providers who work for us and on our instructions (Art. 28 GDPR):
Website, database and email dispatch: our website, database and email dispatch run on a dedicated server that we rent from a hosting provider whose servers are located in Germany. The provider processes the data solely on our instructions. No external email services are used.
Beyond this we disclose your data only where we are legally obliged to do so, for example to the tax authorities.
7. Cookies, local storage and statistics
7.1 Cookies. We set two cookies that are technically necessary for signing in: “bb_member” for your sign-in as a participant, valid for 365 days, and “bb_admin” for the studio team's sign-in, valid for 30 days (Section 25 (2) no. 2 TDDDG).
7.2 Local storage. The light or dark display mode – and, in the studio team's area, the language chosen there – is kept in your browser's local storage and is not transmitted to us. The same storage holds your choice in the privacy dialog (“bb_consent”, together with the version of the dialog and the time of your choice), so that we do not have to ask you on every visit (Section 25 (2) no. 2 TDDDG), and – only after your consent under 7.4 – the identifier “bb_sid”. After twelve months we ask you again. We embed no third-party content and pass no data to advertising networks.
7.3 Counting page views without consent. We count which public pages of our website are viewed, where a visit comes from (only the domain of the referring page or a campaign tag) and whether a mobile or a desktop device is used. Nothing is stored on or read from your device for this. We store the time, the page path without parameters, the source, the device type and the step concerned (for example “course plan viewed”, “course booked”). Your IP address is not stored; it is used only in encrypted form to prevent abuse (limiting the number of requests) and deleted within 24 hours at the latest. This count also takes place if you choose “Only necessary” in the privacy dialog. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest is to know which offers and pages are used, in order to improve the website and the course plan.
Right to object: You may object to this count at any time on grounds relating to your particular situation (Art. 21 (1) GDPR). An e-mail to info@ballet-barre.com is sufficient.
Because the count contains no identifier, we cannot attribute stored count data to any person; an objection therefore concerns the processing of your IP address when you load a page, not count data already stored.
7.4 Extended statistics with your consent. If you choose “Accept all” in the privacy dialog, we place a randomly generated identifier (“bb_sid”) in your browser's local storage. It contains no information about you and is not linked to your member account. It lets us attribute page views to the same browser and so see how a visit unfolds, how often the course plan leads to a booking, and which fields of our forms are reached and filled in. We never record what you enter into a form – only the name of the field and the time spent on it. The identifier is replaced by a new one after 13 months at the latest. The legal basis for storing and reading the identifier is Section 25 (1) TDDDG; for processing the data it is Art. 6 (1) (a) GDPR. As proof of your consent we store on our server the time, the version of the dialog and the identifier.
Withdrawal: You may withdraw your consent at any time with effect for the future via the “Privacy settings” link at the bottom of every page. The identifier is then deleted from your browser immediately; from then on only the count under 7.3 applies. The lawfulness of processing carried out before withdrawal is not affected.
7.5 Where and for how long. All statistical data are processed exclusively on our own server in Germany (Section 6). No third parties are involved. We delete the individual records after 14 months; we keep the proof of your consent for three years; aggregated evaluations without identifier are kept indefinitely.
7.6 What is not counted. The member area and the studio team's area are not counted. The statistics are not linked to member data.
8. How long we keep your data
We keep account data for as long as your account exists. If you delete your account, we delete this data.
Invoices and the related particulars must be retained under tax and commercial law. They are excluded from the deletion of your account and are deleted only once the statutory retention periods have expired. Your invoices stay available in your account for at least three years; in addition we send you every invoice by email when it is issued. We recommend that you download your invoices before deleting your account.
Statistical data: 14 months; proof of consent to statistics: three years; evaluations without identifier: indefinitely.
9. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21 GDPR).
You may withdraw any consent you have given at any time with effect for the future. This does not affect the lawfulness of processing carried out before the withdrawal.
You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is the Bayerisches Landesamt für Datenschutzaufsicht, Promenade 18, 91522 Ansbach, Germany.
For all of these matters, please contact info@ballet-barre.com.
10. Automated decisions
No automated decision-making, including profiling, takes place.
11. Changes
We update this policy when our processing changes. The version published on the website applies.
12. Job applications
If you apply through the application form on this website, we process the information you submit in order to review your application and decide on it.
What we process. Your first name, last name, e-mail address, phone number (voluntary) and the details you provide about your ballet background and teaching experience, any links you provide, the time your application was received and the time at which you confirmed that you had read this notice.
Purpose and legal basis. The processing serves the decision on entering into an employment relationship. The legal basis is Section 26(1) sentence 1 of the German Federal Data Protection Act in conjunction with Article 6(1) subparagraph 1(b) GDPR. After the process is concluded we retain your application for the period stated below in order to defend against possible claims under the German General Equal Treatment Act; the legal basis for this is Article 6(1) subparagraph 1(f) GDPR.
Voluntary submission and the confirmation before sending. Providing the information is voluntary. Without it, however, we cannot process your application. The confirmation you tick before sending is an acknowledgement that you have read this notice, not a consent; the processing of your application is not based on your consent.
Please do not send special categories of personal data. Please do not send us information about health, religion, ethnic origin, trade union membership, political opinion or sexual orientation unless we expressly ask for it.
Recipients. Your application is stored in our administration area and additionally sent as a message to our e-mail account. Access is limited to the persons involved in the selection. For website operation and e-mail delivery we use service providers acting as processors for us under Article 28 GDPR. No transfer to other third parties takes place.
Retention period. Six months after your application is received; it is then deleted automatically. If an employment relationship comes about, the documents are transferred to the personnel file and retained under the periods applicable to it.
Protection of the form against misuse. To ward off automated bulk submissions, the form contains an additional field that is invisible to you and a minimum completion time; we also limit the number of submissions per e-mail address. Your IP address is not stored for this purpose. The legal basis is Article 6(1) subparagraph 1(f) GDPR; our legitimate interest lies in the functioning and security of the form.
Your rights. The rights described in section 9 (“Your rights”) apply: access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to lodge a complaint with a supervisory authority.
13. Profile picture
In the member area you may voluntarily add a picture. We process it solely in order to identify you at check-in before class. You are at no disadvantage if you choose not to.
Access is limited to the studio management and the trainer of the class in question. No transfer to third parties takes place, in particular not to the platforms through which classes can be booked.
The legal basis is your consent under Article 6(1)(a) GDPR. You give it by uploading the picture, and you may withdraw it at any time with effect for the future by deleting it in your account. The lawfulness of the processing carried out until then remains unaffected.
We use no facial recognition and no automated analysis. On upload we strip the additional information contained in the image file, such as the place and time it was taken. The picture is stored on the same server as the rest of your account data.
We delete it as soon as you remove it, and at the latest when your account is deleted. There is no retention obligation for it. For any use for advertising purposes, on our website or on social networks we would ask for your consent separately.
This English version is a translation. The German version is the authoritative one (Section 15 (3)).