PRIVACY POLICY

Last updated: October 7, 2026

This Privacy Policy explains how Timeout Pilates (“Timeout Pilates”, “we”, “us”, or “our”) collects, uses, stores, and protects personal information when you use our website, mobile application, booking services, or other services provided by Timeout Pilates.

We are committed to protecting your privacy and handling your personal data transparently and securely, in accordance with applicable data protection laws, including the General Data Protection Regulation (GDPR), where applicable.

1. Who We Are

Timeout Pilates provides Pilates and related fitness and wellness services, including studio sessions, bookings, memberships, and digital services.

Website: timeoutpilates.com

Contact email: timeoutpilates@gmail.com

For questions regarding this Privacy Policy or the processing of your personal data, you may contact us using the email address above.

2. Information We May Collect

Depending on how you use our website, mobile application, and services, we may collect the following categories of information:

Personal information

This may include:

• First and last name

• Email address

• Telephone number

• Account information

• Booking and appointment information

• Membership or subscription information

• Communications you send to us

• Information voluntarily provided when completing forms

Transaction information

When purchasing memberships, sessions, or other services, information relating to the transaction may be processed.

Payment card information may be processed directly by third-party payment providers. Timeout Pilates does not necessarily receive or store your complete payment card details.

Technical and device information

Depending on the technologies used by our website and mobile application, certain technical information may be collected automatically, including:

• Device type

• Operating system

• App version

• IP address

• Browser information

• Device or app identifiers

• Diagnostic and crash information

• Interaction and usage information

Fitness or wellness information

If you voluntarily provide information related to your physical condition, fitness objectives, exercise preferences, assessments, limitations, or other information required to safely provide our services, we may process such information solely for the relevant service.

Where such information constitutes health data or another special category of personal data under applicable law, it will be processed only where an appropriate legal basis exists and with additional safeguards where required.

We do not intentionally collect information that is unnecessary for providing our services.

3. How We Use Your Information

We may use personal information to:

• Create and manage user accounts

• Provide access to our mobile application and website

• Manage Pilates sessions, bookings, memberships, and subscriptions

• Process transactions

• Communicate with users regarding bookings or services

• Send service-related notifications

• Provide customer support

• Personalize and improve our services

• Maintain the security and reliability of our systems

• Diagnose technical problems and application crashes

• Analyze how our website and application are used

• Prevent fraud, misuse, or unauthorized access

• Comply with legal and regulatory obligations

Marketing communications will only be sent where permitted by applicable law. Where consent is required, users may withdraw their consent at any time.

4. Legal Basis for Processing

Where the GDPR applies, we process personal data based on one or more of the following legal grounds:

• Performance of a contract or steps taken before entering into a contract

• Compliance with legal obligations

• Our legitimate interests, where those interests do not override your fundamental rights and freedoms

• Your consent, where consent is required

• Explicit consent or another legally permitted basis where special categories of personal data are processed

Where processing is based on consent, you may withdraw your consent at any time without affecting processing that occurred before withdrawal.

5. Sharing of Personal Information

We do not sell personal or sensitive user data.

We may share information with trusted third-party service providers when necessary to operate our services, including providers involved in:

• Website and application hosting

• Booking and scheduling

• Payment processing

• Email and communication services

• Analytics

• Cloud infrastructure

• Technical support

• Security and fraud prevention

These providers may process information only as necessary to provide their services and subject to applicable contractual and legal requirements.

We may also disclose information where required by law, regulation, court order, governmental authority, or where necessary to establish, exercise, or defend legal claims.

If our business is reorganized, acquired, merged, or transferred, personal information may be transferred as part of that transaction subject to applicable legal requirements.

6. Third-Party Services and SDKs

Our website or mobile application may use services, software development kits (SDKs), APIs, or technologies supplied by third parties.

These technologies may process technical information, application usage information, identifiers, diagnostics, or other information necessary to provide their functionality.

We review the services we use and seek to limit data collection to what is necessary for legitimate application and business functionality.

Where third-party services process personal data on our behalf, appropriate contractual and data protection safeguards are used where required.

7. Cookies and Analytics

Our website may use cookies and similar technologies to provide essential functionality, understand website usage, remember preferences, and improve our services.

Where required by applicable law, non-essential cookies and tracking technologies will only be activated after obtaining the user's consent.

Users can manage applicable cookie preferences through the cookie settings available on our website and/or through their browser settings.

8. Data Security

We take reasonable technical and organizational measures designed to protect personal information against unauthorized access, disclosure, alteration, loss, misuse, or destruction.

Where personal data is transmitted electronically, appropriate security measures such as encrypted connections (HTTPS) are used where applicable.

However, no electronic transmission or storage system can guarantee absolute security.

9. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including providing our services and complying with legal, accounting, tax, security, and regulatory obligations.

Different categories of information may therefore have different retention periods.

When information is no longer required, it will be deleted, anonymized, or otherwise securely disposed of, subject to applicable legal requirements.

10. Account and Data Deletion

Users who create an account may request deletion of their account and associated personal data.

Account deletion can be requested:

• Through the account deletion functionality available within the mobile application, where provided; and/or

• By contacting us at timeoutpilates@gmail.com

Following a valid deletion request, we will delete or anonymize personal data associated with the account unless certain information must be retained to comply with legal, regulatory, accounting, fraud-prevention, dispute-resolution, or security obligations.

Temporary account suspension or deactivation is not treated as account deletion.

11. Your Privacy Rights

Depending on your location and applicable law, you may have the right to:

• Access your personal data

• Correct inaccurate or incomplete personal data

• Request deletion of your personal data

• Request restriction of processing

• Object to certain processing

• Receive certain personal data in a portable format

• Withdraw consent where processing is based on consent

• Lodge a complaint with a competent data protection authority

For users in the European Economic Area, these rights are subject to the conditions and limitations established by the GDPR and applicable national legislation.

To exercise your rights, contact us at [PRIVACY / CONTACT EMAIL].

We may need to verify your identity before processing certain requests.

12. International Data Transfers

Some service providers may process information outside Romania or the European Economic Area.

Where personal data is transferred internationally, we take appropriate measures required by applicable data protection law, which may include adequacy decisions, Standard Contractual Clauses, or other legally recognized safeguards.

13. Children's Privacy

Our digital services are not intended for children to independently create accounts or provide personal information unless specifically stated otherwise and appropriate parental or guardian authorization is obtained.

If services are provided to minors, relevant information may be provided and managed by a parent or legal guardian in accordance with applicable law.

If we become aware that personal information from a child has been collected contrary to applicable legal requirements, we will take appropriate steps to delete it.

14. Permissions and Device Access

Certain application features may require access to device functionality or information.

Where Android or another operating system requires permission, the application will request the relevant permission before accessing protected information.

We aim to request only permissions necessary for the functionality selected by the user.

Where required by applicable law or platform policy, additional information and consent will be provided before personal or sensitive information is accessed or collected.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our services, technology, legal requirements, or data-processing practices.

When material changes are made, we may provide additional notice where required.

The date displayed at the beginning of this Privacy Policy indicates when it was last updated.

16. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact:

Timeout Pilates
Email: timeoutpilates@gmail.com
Address: Intrarea Nisipari 21, Bucharest
Website: timeoutpilates.com

You also have the right, where applicable, to submit a complaint to the competent data protection supervisory authority.