PRIVACY POLICY

The Data Controller is:

HY Sweat Studio S.R.L.Via Scandriglia 1500199 Rome (RM), ItalyEmail: hello@hysweatstudio.infoWebsite: www.hysweatstudio.it

For any questions regarding the processing of personal data or to exercise your rights under applicable data protection legislation, you may contact the Data Controller at the email address above.

Depending on the services used, HY Sweat Studio may collect and process:

• first and last name
• email address
• telephone number
• information required to create and manage an account
• class booking and attendance information
• information relating to packages, memberships and services purchased
• transaction and payment information, to the extent necessary to manage payments
• customer service communications
• marketing communication preferences
• technical information relating to the use of the website, including IP address, browser and device information, where collected
• photographs and videos in the circumstances described below

HY Sweat Studio does not request health information, information concerning medical conditions, pregnancy, injuries or other special categories of personal data under Article 9 GDPR through its website or ordinary booking process.

Personal data provided during registration is used to create and manage the user's account and provide access to HY Sweat Studio services.

The legal basis for this processing is the performance of a contract or taking steps at the user's request prior to entering into a contract.

Providing the information required for registration is voluntary. However, without such information it may not be possible to create an account or access certain services.

Personal data may be processed to allow users to book, modify or cancel classes and services, manage waiting lists, verify packages and memberships, receive operational booking communications and enable HY Sweat Studio to manage its activities.

The legal basis is the performance of a contract or taking pre-contractual steps at the request of the user.

HY Sweat Studio uses Bsport for booking management and related services. Bsport may therefore process personal data on behalf of HY Sweat Studio in accordance with applicable agreements and data protection legislation.

Personal data is processed to enable users to purchase classes, packages, memberships, events and other services and to allow HY Sweat Studio to comply with related administrative, accounting and tax obligations.

The legal basis is the performance of a contract and, where applicable, compliance with legal obligations.

Online payments may be processed through Stripe.

Payment information required to complete a transaction is processed through the payment provider's systems. HY Sweat Studio does not directly store complete payment card details entered through Stripe.

Stripe may process certain information as a data processor and, for certain payment-related activities and regulatory obligations, as an independent data controller.

HY Sweat Studio may use users' contact information to send communications necessary to manage purchased or booked services, including booking confirmations, class changes or cancellations, waiting-list notifications, package or membership information and payment-related communications.

These communications are not considered marketing where they are necessary to provide the requested service.

The legal basis is the performance of the contract or HY Sweat Studio's legitimate interest in ensuring the proper management of its services.

Subject to the user's consent where required, HY Sweat Studio may use contact information to send newsletters, news, information about new classes or services, promotions, events, offers and other commercial communications.

Where required by applicable legislation, the legal basis for this processing is consent.

Consent is voluntary and refusing marketing consent does not affect the ability to purchase or book HY Sweat Studio services.

Users may withdraw their consent at any time by using the unsubscribe link included in marketing communications, where available, or by contacting hello@hysweatstudio.info.

Where permitted by applicable law, HY Sweat Studio may also use an email address provided in connection with a purchase to promote similar services, subject to the applicable requirements governing so-called "soft spam" and always providing an easy and free means of opting out.

When users contact HY Sweat Studio through email, the website or other communication channels made available by the Studio, the information provided may be processed to manage and respond to the request.

Depending on the nature of the request, the legal basis may be taking pre-contractual steps, performance of a contract or HY Sweat Studio's legitimate interest in providing customer support.

HY Sweat Studio may take photographs or videos during events, collaborations or specific initiatives.

Where an individual is identifiable and the material is intended for promotional, communication or marketing purposes, HY Sweat Studio will obtain the relevant consent where required.

Subject to such consent, photographs and videos may be used on HY Sweat Studio's website, social media channels, newsletters, digital materials and promotional materials.

Providing consent is voluntary.

Refusing consent to the use of one's image does not affect the ability to use HY Sweat Studio's ordinary services.

Consent may be withdrawn by contacting hello@hysweatstudio.info, without prejudice to processing lawfully carried out before withdrawal and subject to any limitations arising from material already lawfully published.

The website www.hysweatstudio.it is currently built and managed using Squarespace.

Squarespace may process technical information required for the operation, security and provision of the website and related services.

Depending on the features actually enabled, such information may include device and browser information, IP address and information regarding interactions with the website.

Squarespace processes personal data in accordance with its contractual terms and applicable data protection arrangements.

The website may use cookies and similar technologies necessary for its operation.

Any analytics, advertising, profiling or other non-essential cookies will be managed in accordance with applicable legislation and, where required, activated only after obtaining the user's consent.

Detailed information regarding the cookies and technologies actually used, their purposes and duration will be provided through the website's Cookie Policy and cookie preference management system.

Users may change or withdraw their cookie preferences in accordance with the methods made available on the website.

HY Sweat Studio may disclose or make personal data available, where necessary and in accordance with applicable law, to:

• IT and hosting service providers
• Squarespace for website services
• Bsport for account, booking and related services
• Stripe and other payment service providers
• email, CRM and communication service providers
• accounting, tax, administrative and legal advisers
• HY Sweat Studio personnel and authorised collaborators
• public authorities or other entities where disclosure is required by law

Where required, service providers are appointed as data processors pursuant to Article 28 GDPR.

Certain providers may process specific personal data as independent data controllers in accordance with applicable legislation and their respective privacy policies.

HY Sweat Studio does not sell its customers' personal data to third parties.

Some technology providers used by HY Sweat Studio may process or transfer personal data outside the European Economic Area.

Where this occurs, HY Sweat Studio adopts or verifies, where within its responsibility, the existence of appropriate safeguards under the GDPR, which may include adequacy decisions, Standard Contractual Clauses, the Data Privacy Framework where applicable, or other safeguards recognised under applicable law.

HY Sweat Studio retains personal data only for as long as necessary for the purposes for which it was collected, subject to any statutory retention obligations.

Account and customer relationship information is retained for the period necessary to manage the relationship and thereafter where required to comply with legal obligations or protect HY Sweat Studio's rights.

Purchase, payment, accounting and tax information is retained for the periods required by applicable legislation.

Personal data processed for consent-based marketing purposes is retained until consent is withdrawn or until it is no longer necessary for the purposes for which it was collected.

Customer support information is retained for the time necessary to manage the relevant request and, where appropriate, protect the parties' rights.

Photographs and videos are retained for the period necessary for the purposes for which consent was obtained, subject to withdrawal and any lawful use already made of such material.

Deleting an account does not necessarily result in the immediate deletion of all personal data. HY Sweat Studio may retain information where required by law or where necessary for the establishment, exercise or defence of legal claims.

HY Sweat Studio implements appropriate technical and organisational measures designed to protect personal data against loss, destruction, unauthorised access, disclosure or unlawful alteration.

Access to personal data is restricted to individuals who require it to perform their activities and who are authorised or otherwise legally entitled to process such information.

HY Sweat Studio does not use personal data collected through its services to make decisions based solely on automated processing that produce legal effects or similarly significantly affect individuals.

Should such activities be introduced in the future, this Privacy Policy will be updated and the safeguards required by applicable legislation will be implemented.

Subject to the conditions set out in the GDPR, individuals have the right to:

• request confirmation as to whether their personal data is being processed
• access their personal data
• request correction of inaccurate or incomplete information
• request erasure where permitted by law
• request restriction of processing
• object to processing where provided for by the GDPR
• receive their personal data in a structured, commonly used and machine-readable format and, where applicable, have it transmitted to another controller
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal

Requests may be submitted to:

hello@hysweatstudio.info

Individuals also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or another competent supervisory authority.

Where a user provides HY Sweat Studio with personal data relating to another individual, for example when making a booking on another person's behalf, the user represents that they are entitled to provide such information.

HY Sweat Studio may periodically amend or update this Privacy Policy to reflect changes in applicable law, its organisation, services or technologies.

The updated version will be published on the website together with the date of the latest update.

Where changes are material, HY Sweat Studio may also inform users through other appropriate communication channels.