Skip to main content

Privacy Policy

Last Updated: March 12, 2026

1. Introduction & Controller Identity

This Privacy Policy explains how SDC Holding AMS2 Pilates Studio (“we”, “us”, “our”) collects, uses, and protects personal data when you visit this website and when you contact us to request Pilates session availability, ask questions, or arrange coaching at our studio in Diemen, Netherlands.

For the purposes of the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the data controller is:

  • Legal entity: SDC Holding AMS2 B.V.
  • Trading name: SDC Holding AMS2 Pilates Studio
  • Registered address: Weesperstraat 96 G, 1112 AP Diemen, Netherlands
  • Email: [email protected]
  • Phone: +31 20 808 3118

We do not appoint a Data Protection Officer (DPO) because we do not carry out large-scale systematic monitoring and we do not process special-category data as a core activity. If you have privacy questions, contact us using the details above.

Effective date: March 12, 2026.

2. Personal Data We Collect

We collect personal data that you provide directly, as well as limited technical data generated when you use the website. The specific categories may include:

  • Identity and contact details: name, email address, phone number.
  • Form content: messages, preferred session format, preferred days/times, and any details you include in your inquiry.
  • Technical data: IP address, browser type and version, device type, operating system, language settings, and approximate location derived from IP (city/region level).
  • Usage data: pages viewed, time spent, navigation paths, and referrer/landing page information.
  • Cookies and identifiers: first-party cookies needed for site functions and (if you consent) third-party cookies for analytics and marketing. See Section 4 and our Cookie Policy.
  • Conversion events: signals that an inquiry was sent or a key page was visited, used to measure the effectiveness of our website and advertising when you have provided consent for marketing cookies.

We do not intentionally collect special-category data (such as health data), financial account details, or government identification numbers through the website. Please avoid including sensitive medical details in the message field. If you choose to share such information, we will treat it with care and limit its use strictly to handling your request, but we encourage you to keep your message practical and focused on scheduling and general suitability questions.

3. Why We Process Your Data & Our Legal Bases (GDPR Art. 6)

We process personal data only when we have a valid legal basis under GDPR. Depending on the context, the purposes and legal bases are:

  • Handling contact and booking requests (contact form, email, phone): We use your details to respond, propose suitable times, and provide information about our Pilates services in Diemen, Netherlands. Legal basis: Art. 6(1)(b) (steps at your request prior to entering into a contract) and Art. 6(1)(a) (consent) where you explicitly consent to being contacted.
  • Analytics and site improvement: Understanding how visitors use pages so we can improve clarity, performance, and content structure. Legal basis: Art. 6(1)(a) (consent).
  • Marketing, remarketing, and advertising measurement: Measuring ad performance and showing relevant ads, including remarketing audiences. Legal basis: Art. 6(1)(a) (consent).
  • Security and fraud prevention: Protecting the website, preventing abuse, and maintaining service integrity. Legal basis: Art. 6(1)(f) (legitimate interests).
  • Legal compliance and record-keeping: Meeting applicable legal obligations where relevant. Legal basis: Art. 6(1)(c) (legal obligation).

Automated decision-making (GDPR Art. 22): We do not engage in automated decision-making or profiling that produces legal or similarly significant effects.

4. Cookies & Tracking

Cookies are small text files stored on your device. We may also use pixel tags and similar technologies (for example, within analytics or advertising tools) when you consent to non-essential cookies. We organize cookies and tracking into the following categories:

4.1 Essential cookies (always active)

Essential cookies are required for the site to function and cannot be switched off in our systems. They support core functions such as keeping preferences and maintaining basic session continuity.

  • Examples: _site_session, cookie_consent
  • Retention: session to 12 months, depending on the cookie.

4.2 Analytics cookies (optional, consent required)

Analytics cookies help us understand how visitors interact with the website. When enabled, we may use Google Analytics 4 (GA4) with IP anonymization settings where available. Analytics data is used to improve pages, not to identify you directly.

  • Examples: _ga, _ga_XXXXXXXXXX
  • Typical retention: 14 months for analytics data, and up to 2 years for GA4 identifiers depending on configuration.

4.3 Marketing cookies (optional, consent required)

Marketing cookies are used to measure advertising effectiveness and support remarketing. If enabled, these cookies may allow partners to understand that a browser visited our website and performed actions such as visiting key pages or submitting a booking inquiry.

  • Examples: _gcl_au, _fbp, _fbc
  • Typical retention: 90 days for common marketing identifiers.

Beyond cookies, some advertising measurement can also occur through pixel tags and server-side mechanisms (for example, where advertising platforms support server-side conversion events). Where used, this is only activated after you have provided consent for marketing cookies, and identifiers may be minimized or hashed where applicable.

5. Consent (EEA/UK)

Users in the EEA and UK receive a consent notice under GDPR/UK GDPR. Analytics and marketing cookies activate only after explicit, informed, freely given consent (GDPR Art. 6(1)(a)). Your choice is recorded in the cookie_consent cookie for 12 months.

You can withdraw consent at any time by selecting “Manage cookie preferences” in the footer or by clearing cookies in your browser settings. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal.

6. Sharing With Advertising & Service Partners

We use a small number of service providers to operate the site and (if you consent) to measure and improve marketing. Depending on your cookie preferences, we may share limited data with:

We do not sell personal data. These providers act as processors or independent controllers depending on the specific tool and context. We do not permit these providers to use site data for their own independent commercial purposes beyond providing and improving their services as described in their policies and our configurations.

7. International Transfers

Some of our partners (for example, Google and Meta) may process data outside the European Economic Area (EEA), including in the United States. Where this happens, transfers rely on:

  • EU–US Data Privacy Framework (primary mechanism, where applicable since July 2023)
  • UK Extension to the Data Privacy Framework (where applicable)
  • Swiss–US Data Privacy Framework (where applicable)
  • Standard Contractual Clauses (EU 2021/914) as a fallback
  • UK International Data Transfer Addendum / IDTA as a fallback

We also apply practical safeguards where reasonable, such as limiting the amount of personal data shared for measurement and using aggregation or hashing when supported.

8. Retention

We keep personal data only as long as needed for the purposes described in this policy, unless a longer retention period is required by law. Typical retention periods are:

  • Contact submissions: up to 2 years from the last interaction, to handle follow-ups and continuity of scheduling context.
  • Analytics: typically 14 months (tool configuration dependent).
  • Marketing cookies: per cookie lifetime (often 90 days) and platform settings.
  • Email correspondence: duration of the relationship plus 1 year as a practical reference, unless deletion is requested and no legal basis remains.
  • Server/security logs: typically up to 90 days, unless needed for investigating incidents.
  • Cookie consent record: up to 3 years for audit purposes.
  • Legal and tax records: as required by applicable law (commonly 6–10 years for invoices where relevant).

9. Your Rights (GDPR & UK GDPR)

If you are in the EEA/UK, you have rights under GDPR/UK GDPR, including:

  • Right of access (Art. 15)
  • Right to rectification (Art. 16)
  • Right to erasure (Art. 17)
  • Right to restriction of processing (Art. 18)
  • Right to data portability (Art. 20)
  • Right to object (Art. 21)
  • Right to withdraw consent at any time (Art. 7(3))
  • Right to lodge a complaint with a supervisory authority (Art. 77)

To exercise your rights, email [email protected]. We respond within 30 days. For complex requests, we may extend the period by up to 60 days as permitted by law, and we will inform you if an extension is needed.

If you wish to contact a supervisory authority, the Netherlands authority is: Autoriteit Persoonsgegevens: https://autoriteitpersoonsgegevens.nl/. EU-wide information is available via the EDPB: https://edpb.europa.eu/.

10. Children

This site is not directed at individuals under 16. We do not knowingly collect personal data from minors. If we learn that we have collected personal data from a child under 16 without verifiable parental consent, we will delete it promptly.

11. Do Not Track

This website does not respond to “Do Not Track” (DNT) browser signals. Third-party providers may have their own DNT handling policies.

12. Data Deletion Requests

You may request deletion of personal data by emailing [email protected] with the subject line “Data Deletion Request”. For security, we may ask you to verify your identity before completing the request. We aim to complete deletion within 30 days, unless retention is required by law or needed to establish, exercise, or defend legal claims.

13. Business Transfers

In the event of a merger, acquisition, reorganization, asset sale, financing, or insolvency, personal data may be transferred to a successor entity. If such a transfer materially changes how data is used, we will provide notice on the website.

14. California (CCPA / CPRA)

If you are a California resident, you may have rights under the California Consumer Privacy Act (as amended by the CPRA). Over the past 12 months, we may have collected the following categories of personal information: identifiers (such as name, email, IP address, cookie IDs), internet or network activity (such as page views and interactions), and inferences (such as preferences derived from browsing behavior for advertising).

We do not sell personal information as defined by CCPA. We may share information for cross-context behavioral advertising when marketing cookies are enabled. California residents may opt out of such sharing through our cookie preferences panel (use “Manage cookie preferences” in the footer).

Rights may include: the right to know, delete, correct, and opt out of sale/sharing, and the right to non-discrimination. To submit a request, email [email protected] with the subject “California Privacy Request”. We will verify your request as required by law. Authorized agents may submit requests with proof of authorization.

15. Virginia (VCDPA)

If you are a Virginia resident, you may have rights under the Virginia Consumer Data Protection Act (VCDPA), including access, correction, deletion, portability, and the right to opt out of targeted advertising. We do not sell personal data and we do not engage in profiling that produces legal or similarly significant effects.

To submit a request, email [email protected] with the subject “Virginia Privacy Request”. If we decline your request, you may appeal by emailing with the subject “Appeal of Refusal — Privacy Request”. We will respond to appeals within 60 days. Unresolved concerns may be addressed to the Virginia Attorney General.

16. Nevada

Nevada residents may submit a verified opt-out request by emailing [email protected] with the subject “Nevada Do Not Sell Request”. We do not currently sell personal information under Nevada Revised Statutes Chapter 603A.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect operational changes, legal requirements, or improvements in our practices. Material changes will be announced via a notice on the homepage at least 14 days before taking effect. The “Last Updated” date at the top of this page reflects the most recent revision.

18. Contact

If you have questions about this Privacy Policy or how we handle personal data, contact: