How we follow the GDPR

Last updated 21 October 2026

The General Data Protection Regulation is EU law that gives you real control over information about you, and puts the burden on organisations to earn and keep your trust. We are based in Malta and serve people across the EU, so it applies to us in full. This page explains what that means in practice — not as a legal recital, but as a description of how we actually work.

The seven principles, and what we do about each

Article 5 sets out seven principles that govern all processing. We are required not only to follow them but to be able to demonstrate that we do.

1. Lawfulness, fairness and transparency

Every piece of data we hold has a named lawful basis, listed row by row in our privacy notice. Nothing is collected for a reason we have not told you.

Health information is the one category the law singles out. Because it is a special category of data under Article 9, an ordinary lawful basis is not enough on its own — it needs a second condition as well. We rely on your explicit consent (Article 9(2)(a)), which is why that part of the join form is optional, separately ticked and separately signed rather than folded into everything else you agree to.

2. Purpose limitation

We use data for the purpose we collected it for. Your attendance record plans class timetables; it does not become a marketing list. If we ever wanted to use something for a genuinely new purpose, we would tell you first — and where that purpose relies on consent, ask you again rather than assume.

3. Data minimisation

We collect what the job needs and stop there. Our cookie consent log is the clearest example: it records the choice, the date and a random id, and deliberately stores no IP address and no browser fingerprint, because proving consent does not require identifying the person who gave it.

4. Accuracy

Staff can correct any member record on request, and you can ask us to fix something at any time. Where we correct data, we correct it everywhere it appears.

5. Storage limitation

Nothing is kept indefinitely "just in case". Every category has a stated retention period in the privacy notice, and data is deleted when it expires. Where a law requires us to keep something longer — accounting records, mainly — we say so rather than quietly holding on to it.

6. Integrity and confidentiality

Names, emails, phone numbers, addresses, dates of birth, occupations, employers, emergency contact details and health answers are encrypted in the database itself, so the stored data is unreadable without the key. Access to the staff dashboard is invite-only, sessions live in cookies JavaScript cannot read, every state-changing action is protected against cross-site request forgery, and login endpoints are rate-limited against brute force.

Health information gets more than that. It is stored apart from the rest of your record, as a single encrypted block so that not even the question names are visible in the database. Only the owner and staff the owner has specifically permitted can open it, and every time one of them does, that access is logged.

7. Accountability

We keep the records that let us prove the above: an append-only log of cookie-consent decisions, a matching append-only log of the permissions each member has given and withdrawn — including the exact wording they agreed to and its version — a log of every staff access to a member's health record, and a tracked queue of every data request with the date it arrived, who handled it, what was done and when it closed.

Your eight rights

These belong to you by law. Exercising them is free, we will never charge you or treat you differently for it, and we answer within one month. If a request is unusually complex we may extend that by up to two further months — and if we do, we will tell you why before the first month is up.

How we treat consent

We rely on consent for three things: cookies, permission to contact you, and holding your health information. Each is asked separately and each stands or falls on its own — changing your cookie choice does nothing to your health consent, and withdrawing your health consent does not affect your membership. For consent to count at all it has to be a real choice, so:

• It is opt-in. Nothing is pre-ticked, and silence never counts as agreement.
• It is specific. Each purpose is asked about separately, never bundled into a single "I agree".
• It is informed. We say who, what, why and for how long before you decide.
• It is freely given. Declining does not reduce your access to the site or the studio.
• It is as easy to withdraw as to give. One link in the footer, no explanation required, effective immediately.
• It is recorded. We keep evidence of what was agreed and when, because the law puts the burden of proof on us — including the exact wording you agreed to and its version, so we can show what you were actually told.

Health information: a higher standard again

Article 9 asks for explicit consent, which is a step beyond the ordinary kind. In practice that means the health section of the join form is opt-in twice over — you choose whether to answer at all, then tick a declaration and type your name in place of a signature — and the wording you agreed to is stored alongside the record of your agreement.

You can withdraw it at any time, at the front desk, by emailing team@chicphysiquestudio.com, or by sending us a request. When you do, we delete the answers from the system immediately rather than archiving or hiding them; encrypted copies in our backups age out within 12 months, as explained in the privacy notice. What survives is the record that a consent existed and was withdrawn, which the law requires us to keep and which contains no health information at all. Declining, or later withdrawing, changes nothing about your membership, your pricing or your access to the studio.

Automated decisions and profiling

We make none. No automated system decides anything that affects you, and we do not build behavioural profiles. The statistics we keep — how busy the studio gets by hour and weekday — exist to plan staffing and class times, and are read as aggregates.

Sending data outside the EU

Your data is hosted in the EU. The one routine exception is Google Sign-In: if you choose to sign in to the member portal with a Google account — or a member of staff does so on the dashboard — Google processes that sign-in under its standard contractual clauses, the transfer mechanism the European Commission approves for exactly this. It is optional, and only the sign-in itself is involved: your account identifier, name and email address. Your membership, attendance, payment and health records never leave the EEA.

If something goes wrong

If a breach occurs that is likely to risk your rights and freedoms, we will report it to the Office of the Information and Data Protection Commissioner (IDPC) within 72 hours of becoming aware of it, and tell you directly without undue delay if the risk to you is high. We would rather tell you about a problem than have you find out some other way.

Keeping this current

We review our processing, this page and the privacy notice at least once every 12 months, and immediately whenever we change what we collect or who we share it with. The last review date is at the top of each page.

Questions, or a complaint

Ask us anything at team@chicphysiquestudio.com, or submit a formal request. If you are not satisfied with how we have handled it, you can complain to Office of the Information and Data Protection Commissioner (IDPC) at any time — you do not have to come to us first, though we would appreciate the chance to put things right.