Privacy notice
Last updated 23 July 2026. We review this notice at least once a year.
The short version. We collect what we need to run your membership and nothing more. We do not sell your data, we do not share it for anyone else's marketing, and we do not profile you or make automated decisions about you. You can ask for a copy of everything we hold, or ask us to delete it, at any time — use this form and we will reply within one month.
Who we are
Chic Physique Studio, operating as ChicPhysique is the data controller for the personal data described here — meaning we decide what is collected and why, and we are answerable for it.
Chic Physique StudioHilltop Gardens
Triq L-Inkwina
Naxxar
Malta
Email: team@chicphysiquestudio.com
Phone: 00356 21383837
Because we are established in Malta and serve people in the EU, the EU General Data Protection Regulation (Regulation 2016/679) applies to everything below.
What we collect, why, and for how long
This is the complete list. Each row names the actual fields rather than a vague category, gives the lawful basis we rely on, and states when the data is deleted.
| Category | What exactly | Why | Lawful basis | How long we keep it |
|---|---|---|---|---|
| Identity and contact details | First and last name, email address, phone number, postal address, date of birth | To create and run your membership, contact you about it, and confirm who you are at the studio. | Performance of your membership contract (Art. 6(1)(b)). | For as long as you are a member, then 24 months after your last activity so you can rejoin without re-registering. Deleted after that. |
| Membership record | Membership type, start and end dates, join date, active status | To know what you have paid for and whether it is current. | Performance of your membership contract (Art. 6(1)(b)). | Same as your identity details — 24 months after your last activity. |
| Attendance record | Date and time of each studio sign-in, and whether your membership was active at the time | To control access, to know how busy the studio gets, and to plan class timetables and staffing. | Performance of your membership contract, and our legitimate interest in running the studio safely and efficiently (Art. 6(1)(b) and (f)). | 24 months, then deleted. Aggregate totals that identify nobody may be kept longer. |
| Payment record | Amount, date, payment method and status, and the membership it relates to | To take payment, keep proper books, and meet our tax and accounting duties. | Legal obligation for the accounting record (Art. 6(1)(c)); performance of your contract for the payment itself (Art. 6(1)(b)). | Retained for the period Maltese bookkeeping and tax law requires, then deleted. This is why a deletion request cannot always remove your payment history. |
| Contact preferences | Whether you agreed to be contacted, and whether you accepted the cookie policy | To respect what you agreed to, and to prove we asked. | Your consent (Art. 6(1)(a)), which you can withdraw at any time. | While you are a member, and for 3 years after you withdraw consent so we can show what was agreed and when. |
| Data requests | Your name, email, what you asked for, and what we did about it | To handle your request and to be able to show we handled it properly. | Legal obligation — we must be able to demonstrate compliance (Art. 6(1)(c), Art. 5(2)). | 3 years after the request is closed, then deleted. |
| Cookie consent record | A random id generated by your browser, which categories you allowed, the policy version, and the date | To honour your cookie choice and to be able to prove you made it. | Legal obligation — consent must be demonstrable (Art. 7(1)). | 3 years from the decision. The record contains no name, email or IP address. |
| Staff accounts | Name, email, role, and either a password hash or a Google account identifier | To let staff sign in to the admin dashboard and to record who did what. | Performance of the employment relationship and our legitimate interest in securing the system (Art. 6(1)(b) and (f)). | While the person works with us, then 12 months. |
How we collect it
- Directly from you — when you fill in the join form, sign up at the front desk, or contact us.
- From your use of the studio — each time you sign in at reception, that visit is recorded against your membership.
- From our previous website — members who joined through the old WordPress site had their existing membership and payment records migrated across, so nothing was lost when we moved.
We do not buy personal data, and we do not collect it from social networks, data brokers or any other third-party source.
Who else sees your data
We never sell your personal data, and we have not sold or shared any for another party's marketing purposes in the last 12 months — or ever. The only others involved are the developer who runs the system for us and the infrastructure suppliers he uses to do it. Each acts on our written instructions as a processor and may not use your data for its own ends.
| Who | What they do for us | Where the data sits |
|---|---|---|
| Julian Nwobodo Cefai | Builds, hosts and maintains this website, the staff dashboard and the database on our behalf. Holds administrative access and the keys that decrypt stored personal data, which is what makes the system maintainable at all. | Malta. Acts only on our documented instructions under a written data processing agreement, and may not use the data for any purpose of his own. |
| Amazon Web Services (AWS) | Provides the servers, database and file storage the system runs on. | EU region. Engaged as a sub-processor and contractually bound not to use the data for its own purposes. |
| Amazon Simple Email Service (SES) | Delivers transactional email — welcome messages, password resets, and data-request acknowledgements. | EU region, under the same terms as the rest of our AWS use. |
| Google (Sign-In) | Verifies staff identity when a staff member chooses to sign in to the dashboard with a Google account. Members are never asked to use it. | Google processes the sign-in globally under its standard contractual clauses. We receive only the account identifier, name and email address. |
We may also disclose data where the law requires it — for example to a court, a regulator, or the police acting on a lawful request. We will not do so voluntarily.
How we protect it
- Encrypted in the database. Names, email addresses, phone numbers, postal addresses and dates of birth are encrypted at rest, so the raw database contains ciphertext rather than readable personal data.
- Encrypted in transit. Every connection to this site and to the staff dashboard uses HTTPS.
- Access is limited to staff who need it. The dashboard is invite-only — there is no public sign-up for staff accounts — and sessions are held in cookies that JavaScript cannot read.
- Defended against common web attacks. Cross-site request forgery protection on every state-changing action, a strict content security policy, rate limiting on login and public forms, and sanitisation of anything published to the site.
- We collect as little as possible. Our cookie consent log, for instance, deliberately stores no IP address and no user agent — only a random id and the choice you made.
Your rights
You have eight rights over your personal data, including the right to a copy of it, the right to have it corrected, and the right to have it deleted. They are set out in full, with what each one means in practice, on our GDPR page.
To exercise any of them, submit a request or email team@chicphysiquestudio.com. It is free, and we respond within one month. We will never treat you differently for exercising a right — your membership, pricing and access are entirely unaffected.
Cookies
Every cookie we set is listed individually in our cookie policy, along with the controls to change or withdraw your consent. In short: we set only the cookies needed to make the site work, and nothing optional runs unless you have said yes.
Children
Our services are aimed at adults. We do not knowingly collect data about anyone under 16 without the consent of a parent or guardian. If you believe we hold data about a child, contact us and we will delete it.
Changes to this notice
We review this notice at least every 12 months and whenever what we do with data changes. The date at the top always reflects the current version. If a change materially affects how we use your data — a new purpose, or a new recipient — we will tell you and, where the change relies on consent, ask you again rather than assuming your previous answer still applies.
Complaints
If you think we have mishandled your data, please tell us first at team@chicphysiquestudio.com — we would rather fix it. You also have the right to complain directly to Malta's supervisory authority, and you do not need our permission to do so:
Office of the Information and Data Protection Commissioner (IDPC)Floor 2, Airways House
High Street
Sliema SLM 1549
Malta
https://idpc.org.mt
idpc.info@idpc.org.mt