Privacy notice

Last updated 21 October 2026. We review this notice at least once a year.

The short version. We collect what we need to run your membership and nothing more. We do not sell your data, we do not share it for anyone else's marketing, and we do not profile you or make automated decisions about you. You can ask for a copy of everything we hold, or ask us to delete it, at any time — use this form and we will reply within one month.

Who we are

Chic Physique Studio, operating as ChicPhysique Studio is the data controller for the personal data described here — meaning we decide what is collected and why, and we are answerable for it.

Chic Physique Studio
Hilltop Gardens
Triq L-Inkwina
Naxxar
Malta
Email: team@chicphysiquestudio.com
Phone: 00356 21383837

Because we are established in Malta and serve people in the EU, the EU General Data Protection Regulation (Regulation 2016/679) applies to everything below.

What we collect, why, and for how long

This is the complete list. Each row names the actual fields rather than a vague category, gives the lawful basis we rely on, and states when the data is deleted.

Category	What exactly	Why	Lawful basis	How long we keep it
Identity and contact details	First and last name, email address, mobile, work and home phone numbers, postal address, date of birth, and — if you choose to give them — your gender, occupation, employer and how you heard about us	To create and run your membership, contact you about it, and confirm who you are at the studio.	Performance of your membership contract (Art. 6(1)(b)).	For as long as you are a member, then 24 months after your last activity so you can rejoin without re-registering. Deleted after that.
Membership record	Membership type, start and end dates, join date, active status, whether your sign-up was approved or declined and — if declined — the reason a staff member recorded	To know what you have paid for and whether it is current, and to have a record of how your sign-up was decided.	Performance of your membership contract, or steps taken at your request before entering it (Art. 6(1)(b)).	Same as your identity details — 24 months after your last activity. A declined sign-up is kept so we can answer you if you ask why or apply again; any health information you gave is deleted the moment the sign-up is declined.
Attendance record	Date and time of each studio sign-in, and whether your membership was active at the time	To control access, to know how busy the studio gets, and to plan class timetables and staffing.	Performance of your membership contract, and our legitimate interest in running the studio safely and efficiently (Art. 6(1)(b) and (f)).	24 months, then deleted. Aggregate totals that identify nobody may be kept longer.
Payment record	Amount, date, payment method and status, the membership it relates to, and your name and email address as they stood when the payment was taken.	To take payment, keep proper books, and meet our tax and accounting duties.	Legal obligation for the accounting record (Art. 6(1)(c)); performance of your contract for the payment itself (Art. 6(1)(b)).	Retained for the period Maltese bookkeeping and tax law requires, then deleted. This is why a deletion request cannot always remove your payment history: if you ask us to erase your account, the payment records stay, and they keep the name and email address recorded against each payment, because a bookkeeping record has to say who paid. Everything else about you is removed.
Contact preferences	Whether you agreed to be contacted, and whether you accepted the cookie policy	To respect what you agreed to, and to prove we asked.	Your consent (Art. 6(1)(a)), which you can withdraw at any time.	These two settings live on your membership record and are deleted with it. Changing your mind updates them straight away; the dated evidence that you were asked and what you answered is kept separately, under "Consent records" below.
Data requests	Your name, email, what you asked for, and what we did about it	To handle your request and to be able to show we handled it properly.	Legal obligation — we must be able to demonstrate compliance (Art. 6(1)(c), Art. 5(2)).	5 years after your request is closed, then deleted. We keep it that long as the evidence that we answered you and did so within the one-month deadline the law sets. While a request is still open we keep it regardless of age, because an unanswered request is something we still owe you. This record is held separately from your membership record and is not deleted with it.
Personal training enquiries	Your name, email address, when you are available to train, and your goals or any notes you add	So a trainer can get back to you about personal training and suggest sessions that fit your times.	Steps taken at your request before entering a contract (Art. 6(1)(b)).	12 months from when you send it, then deleted. If you go on to train with us, you join in the usual way and your membership record takes over. You can ask us to delete an enquiry sooner at any time.
Cookie consent record	A random id generated by your browser, which categories you allowed, the policy version, and the date	To honour your cookie choice and to be able to prove you made it.	Legal obligation — we have to be able to demonstrate that you made a cookie choice (Art. 6(1)(c), giving effect to Art. 7(1)).	3 years from the decision. The record contains no name, email or IP address.
Emergency contact	The name, relationship, address and phone numbers of the person you nominate, plus your doctor's name and phone number	So we know who to call if something happens to you at the studio.	Protecting your vital interests and those of the person you nominate (Art. 6(1)(d)), and running your membership (Art. 6(1)(b)). Giving these details is optional.	While you are a member. Deleted with your membership record, or sooner if you or the person you nominated asks us to remove them.
Health information	How you describe your health, your current weight, whether you are receiving medical treatment, operations in the last 5 years, any history of an eating disorder, whether you have had any of a listed set of conditions (such as hypertension, diabetes or a heart attack), and whether you have been advised not to diet — including anything you write in the free-text boxes	So our trainers know what makes exercise unsafe for you before they put a programme together.	Your consent (Art. 6(1)(a)). Answering is optional — you can join without it and refusing costs you nothing. Special category: Your explicit consent to us processing data about your health (Art. 9(2)(a)). You can withdraw it at any time, at the front desk or by emailing us, and we delete this section immediately when you do.	Until you withdraw consent, until your sign-up is declined, or until your membership record is deleted — whichever comes first. Any of those deletes it from the system straight away; encrypted copies in our backups age out within 12 months. It is stored separately from the rest of your record, only staff who need it can open it, and every time one of them does, that is logged.
Consent records	Which permission you gave, the exact wording you agreed to, its version, the name you typed in place of a signature, and the date	To honour what you agreed to and to be able to show you agreed to it — and, when you change your mind, that you withdrew it and when.	Legal obligation — we have to be able to demonstrate that you consented, and that you withdrew it if you did (Art. 6(1)(c), giving effect to Art. 7(1) and Art. 7(3)).	While you are a member, and for 5 years after you withdraw consent. If you never withdraw it, we delete it 5 years after your last membership ends. Either way it also goes sooner if your membership record is deleted. We keep the whole record — both the permission and the withdrawal — or none of it, so what is left can never suggest you agreed to something you had already ended. These records contain no health information: only that a permission existed and when it ended, which is why they outlive the health section itself.
Health record access log	Which staff member opened which member's health record, what they did, and when. No health information is recorded in the log itself	So we can answer the question "who has seen this?" — about our own staff as much as for you.	Legal obligation and our legitimate interest in securing special-category data (Art. 6(1)(c) and (f), Art. 32).	12 months. This log identifies members of staff, not just members.
Email delivery records	Which kind of email we sent you (for example a password reset or a membership confirmation), when, whether it was sent, failed or held back, and a shortened form of the address it went to. Not the subject, the content, or any link in it	So the studio owner can check that an email went out — and why one did not — when someone says they never received it.	Our legitimate interest in running the service reliably (Art. 6(1)(f)).	90 days, then deleted.
Your online account	A password (stored only as a one-way hash, never the password itself), optionally a Google account identifier, when you last signed in, and the count of recent failed attempts	So you can sign in to see your membership, your visits and the details we hold about you, and correct them yourself.	Performance of your membership contract (Art. 6(1)(b)) and our legitimate interest in keeping the account secure (Art. 6(1)(f)).	While you have an account. Deleting your membership deletes the account and every session with it.
Signing in on another device	If you sign in to the portal on another device by scanning a code with your phone: that device's IP address and browser identifier (user agent), when the request was made, and whether you approved it	So you can see which device you are letting in before you approve it, and so the email we send afterwards can tell you which device signed in — letting you spot one you did not expect.	Performance of your membership contract (Art. 6(1)(b)) and our legitimate interest in keeping your account secure (Art. 6(1)(f)).	A request lapses after two minutes if it is not approved. The record is deleted 7 days after that.
Check-in badge	A random code shown as a QR badge in the portal, when it was issued, when it was last used to check in, and when it was replaced or cancelled	So you can check in at the studio by showing your badge instead of typing your details.	Performance of your membership contract (Art. 6(1)(b)).	While you have a membership record. A replaced or cancelled badge stops working immediately but stays on your record, and is deleted with it.
Changes to your sign-in email address	Your previous and new email address, which member of staff asked for the change, and when it was requested, confirmed or cancelled	Your email address is how you sign in and how you recover your account, so a change only takes effect once you confirm it from the new address, your old address is told about it, and we keep a record of what it changed from.	Performance of your membership contract (Art. 6(1)(b)) and our legitimate interest in protecting your account from being taken over (Art. 6(1)(f)).	While you have a membership record, and deleted with it.
Staff accounts	Name, email, role, whether the person is permitted to view member health information, and either a password hash or a Google account identifier	To let staff sign in to the admin dashboard and to record who did what.	Performance of the employment relationship and our legitimate interest in securing the system (Art. 6(1)(b) and (f)).	While the person works with us, then 12 months.
Security records	Our server keeps a log of every request made to our websites: the IP address, the time, the address requested, the browser identifier (user agent) and the referring page. That log stays on our server. Separately, for any connection the server flags as an attack — such as repeated failed logins, port scans, or a web request matching a known exploit pattern — the same details and the type of attack are reported to our security provider. Ordinary visits are not reported.	To detect and automatically block attacks on the server that holds your data, and to investigate one after the event.	Our legitimate interest in keeping the system and your data secure (Art. 6(1)(f), Recital 49), which is also part of our duty to secure it (Art. 32).	The request log on our server: 14 days, then deleted. Flagged connections reported to our security provider: up to 90 days, then deleted. A blocked address stays on the block list only while the block is in force.

How we collect it

Directly from you — when you fill in the join form, sign up at the front desk, or contact us. The health part of the join form is optional and clearly marked; you can join without answering any of it.
From your use of the studio — each time you sign in at reception, that visit is recorded against your membership.
Automatically, when you visit our websites — like most web servers, ours logs the IP address and request of every visit, and keeps that log for 14 days. If a connection looks like an attack, its details are also reported to our security provider so the address can be blocked. Both are set out under "Security records" above. Ordinary visits are not reported.
From our previous website — members who joined through the old WordPress site had their existing membership and payment records migrated across, so nothing was lost when we moved.

We do not buy personal data, and we do not collect it from social networks, data brokers or any other third-party source.

We never sell your personal data, and we have not sold or shared any for another party's marketing purposes in the last 12 months — or ever. The only others involved are the developer who runs the system for us and the infrastructure suppliers he uses to do it. Each acts as a processor on our behalf. All but one do so on our written instructions and may not use your data for their own ends; the exception is our intrusion-protection provider, which operates under its own published terms, as the table notes.

Who	What they do for us	Where the data sits
Julian Nwobodo Cefai	Builds, hosts and maintains this website, the staff dashboard and the database on our behalf. Holds administrative access and the keys that decrypt stored personal data, which is what makes the system maintainable at all.	Malta. Acts only on our documented instructions under a written data processing agreement, and may not use the data for any purpose of his own.
Amazon Web Services (AWS)	Provides the servers, database and file storage the system runs on.	EU region. Engaged as a sub-processor and contractually bound not to use the data for its own purposes.
Amazon Simple Email Service (SES)	Delivers the emails the system sends — sign-up and membership confirmations, portal account set-up and password resets, alerts when a new device signs in or your email address is changed, and data-request acknowledgements. No marketing email is sent through it.	EU region, under the same terms as the rest of our AWS use.
Google (Sign-In)	Verifies your identity if you choose to sign in with a Google account — to the member portal, or, for staff, to the dashboard. It is optional: a password works just as well, and nobody has to use Google.	Google processes the sign-in globally under its standard contractual clauses. We receive only the account identifier, name and email address.
Defensia	Watches our server for intrusion attempts and blocks the IP addresses they come from. Its software runs on the server with administrative access in order to do that, but sends Defensia only the details of connections flagged as attacks (see "Security records" above) — never the database or your membership details.	EU. Defensia operates from Barcelona, Spain, and hosts its service in the EU. Engaged as a sub-processor under Defensia's own published terms and privacy policy; it does not offer a separate data processing agreement. Its optional feature for sharing attacker addresses with other Defensia customers is switched off.

We may also disclose data where the law requires it — for example to a court, a regulator, or the police acting on a lawful request. We will not do so voluntarily.

Health information

The join form asks a handful of questions about your health — whether you are receiving treatment, whether you have had an operation recently, whether you have had any of a listed set of conditions, and so on. The law treats this as a special category of data and sets a higher bar for holding it, which is why it gets its own section here.

Answering is entirely optional. You can join, train and use everything the studio offers without answering a single one of these questions. We ask because a trainer who knows about your hypertension or your shoulder surgery can build you a safer programme — not because your membership depends on it.

We hold this information only on the strength of your explicit consent, and only for as long as that consent stands. You can withdraw it whenever you like, at the front desk or by emailing team@chicphysiquestudio.com. When you do, we delete the answers from the system immediately — we do not archive them or mark them hidden. Encrypted copies remain in our backups until those age out, within 12 months (see Backups below). What we keep is a record that you gave consent and later withdrew it, which contains no health information and exists because the law requires us to be able to show both.

While we hold it: it is stored separately from the rest of your membership record and encrypted, only the owner and staff specifically permitted by them can open it, and every single time one of them does, that access is logged with their name and the date. Under-18s cannot submit these answers through the website at all — that conversation happens in person, with a parent or guardian.

How we protect it

Encrypted in the database. Names, email addresses, phone numbers, postal addresses, dates of birth, occupations, employers, gender, emergency contact details and health answers are all encrypted at rest, so the raw database contains ciphertext rather than readable personal data.
Health information is handled separately. It is kept in its own store rather than alongside the rest of your record, it is written as a single encrypted block so that even the question names are not visible in the database, access is restricted to staff the owner has specifically permitted, and every read is logged.
Encrypted in transit. Every connection to this site and to the staff dashboard uses HTTPS.
Access is limited to staff who need it. The dashboard is invite-only — there is no public sign-up for staff accounts — and sessions are held in cookies that JavaScript cannot read.
Defended against common web attacks. Cross-site request forgery protection on every state-changing action, a strict content security policy, rate limiting on login and public forms, and sanitisation of anything published to the site.
Intrusion protection on the server. Attack patterns are detected and recorded, and an address that repeatedly fails to log in to the server or scans it for open ports is blocked from it automatically.
We collect as little as possible. Our cookie consent log, for instance, deliberately stores no IP address and no user agent — only a random id and the choice you made.

Backups

So that a fault or an attack cannot lose your membership, we take an encrypted backup of the system every night and keep it on equipment we control in Malta. We keep a backup from each of the last 14 days, each of the last 8 weeks, and each of the last 12 months, and older ones are deleted automatically. Our hosting provider also keeps its own copies of the server for 7 days.

A backup is a snapshot, so we cannot remove one person from it without destroying everyone else's copy. That means when we delete your data — because you asked, withdrew consent, or your retention period ended — it disappears from the live system straight away, but encrypted copies remain in older backups until those age out, within 12 months at the latest. During that time the backups are encrypted, are not used for anything, and are opened only to recover from a failure. If we ever have to restore one, we delete your data again before the system goes back into use.

Your rights

You have eight rights over your personal data, including the right to a copy of it, the right to have it corrected, and the right to have it deleted. They are set out in full, with what each one means in practice, on our GDPR page.

To exercise any of them, submit a request or email team@chicphysiquestudio.com. It is free, and we respond within one month. We will never treat you differently for exercising a right — your membership, pricing and access are entirely unaffected.

Cookies

Every cookie we set is listed individually in our cookie policy, along with the controls to change or withdraw your consent. In short: we set only the cookies needed to make the site work, and nothing optional runs unless you have said yes.

Children

Our services are aimed at adults, and the online sign-up form enforces this: it refuses anyone under 18 and asks them to come to the studio with a parent or guardian instead. Junior members are registered in person, and where any consent is needed it is given by their parent or guardian and recorded as such.

We do not knowingly collect data about a child through the website. If you believe we hold data about a child that we should not, contact us and we will delete it.

Changes to this notice

We review this notice at least every 12 months and whenever what we do with data changes. The date at the top always reflects the current version. If a change materially affects how we use your data — a new purpose, or a new recipient — we will tell you and, where the change relies on consent, ask you again rather than assuming your previous answer still applies.

Complaints

If you think we have mishandled your data, please tell us first at team@chicphysiquestudio.com — we would rather fix it. You also have the right to complain directly to Malta's supervisory authority, and you do not need our permission to do so:

Office of the Information and Data Protection Commissioner (IDPC)
Floor 2, Airways House
High Street
Sliema SLM 1549
Malta
https://idpc.org.mt
idpc.info@idpc.org.mt