Modestou Panteli 3, 8020 Paphos, Cyprus
VAT: CY10428236T
maria@kyma28.com
01
Introduction
Elevate Tht Ltd ("we", "us", "our"), trading as KYMA28, is committed to protecting your personal data. This Privacy Policy explains what information we collect, how we use it, and the rights available to you under the General Data Protection Regulation (GDPR) and Cyprus data protection law.
This policy applies to personal data collected through our mobile application KYMA28 and any direct communications with our studio.
02
Who We Are
The data controller responsible for your personal data is:
03
What Data We Collect
When you create an account on KYMA28 or interact with our studio, we may collect the following categories of personal data:
Account & Identity Data
- Full name
- Email address
- Phone number
- Password (encrypted)
Health & Medical Data
- Pre-existing injuries, medical conditions, or physical limitations you disclose before or during your practice
Booking Data
- Class pack purchases and attendance history
- Cancellations and waitlist activity
Payment Data
Payment is processed by Stripe. We do not store your full card details. Stripe receives and processes your payment information under their own privacy policy, available at stripe.com/privacy.
Marketing & Communication Data
- Email address and communication preferences, if you have opted in to receive marketing from us
Technical & Usage Data
- App usage data, device type, operating system, and session information collected automatically when you use KYMA28
Visual Data
- Photos or videos taken during classes at the studio, where applicable (see Section 9)
04
How We Use Your Data
We use your personal data for the following purposes:
| Purpose | Legal Basis |
|---|---|
| Creating and managing your KYMA28 account | Contract |
| Processing class bookings and class pack purchases | Contract |
| Processing payments via Stripe | Contract |
| Storing health information to ensure your safety during classes | Vital interests / Explicit consent |
| Sending transactional notifications (booking confirmations, reminders) | Contract |
| Sending marketing emails and communications | Consent |
| Improving our app and services through usage analytics | Legitimate interests |
| Complying with legal and regulatory obligations | Legal obligation |
05
Health Information
We collect information about your physical health, injuries, and medical conditions solely to ensure your safety and to tailor your Pilates practice appropriately. This is classified as special category data under GDPR and is handled with the highest level of care.
We will never share your health information with third parties except where required by law or in a medical emergency. You may withdraw your consent to us holding this information at any time by contacting maria@kyma28.com, though this may affect our ability to safely provide our services to you.
06
Marketing Communications
If you have opted in, we use Klaviyo to send you marketing emails about classes, offers, and updates from KYMA28. We also use Meta (Facebook and Instagram) advertising tools, including the Meta Pixel, and Google Ads and Google Analytics to reach and understand our audience.
You can withdraw your consent to marketing communications at any time by:
- Clicking "unsubscribe" in any email we send you
- Contacting us directly at maria@kyma28.com
Withdrawing consent does not affect the lawfulness of any processing carried out before your withdrawal.
07
Cookies & Tracking Technologies
We use cookies and similar tracking technologies through Google Analytics and the Meta Pixel on our digital platforms. These tools help us understand how people find and interact with our content.
- Essential cookies — necessary for the app and website to function correctly
- Analytics cookies — help us understand usage patterns (Google Analytics)
- Marketing cookies — used to deliver relevant advertising (Meta Pixel, Google Ads)
Non-essential cookies are only placed with your prior consent. You may withdraw or manage your cookie preferences at any time via the cookie settings on our website.
08
Third Parties We Share Data With
We share your data only where necessary, with the following trusted third-party processors:
| Third Party | Purpose | Location |
|---|---|---|
| Stripe | Payment processing | USA / EU (SCCs apply) |
| Klaviyo | Email marketing | USA (SCCs apply) |
| Meta | Advertising and analytics | USA (SCCs apply) |
| Analytics and advertising | USA (SCCs apply) | |
| KYMA28 Platform | Booking and membership management | — |
All third-party processors are required to handle your data securely and in accordance with GDPR. Where data is transferred outside the European Economic Area (EEA), appropriate safeguards — including Standard Contractual Clauses (SCCs) — are in place.
We do not sell your personal data to any third party.
09
Photography & Video
From time to time, photos or videos may be taken during classes at the KYMA28 studio for promotional purposes. We will always ask for your permission before publishing any image or video in which you appear on social media or any other public platform.
If you do not wish to be photographed or filmed, please inform your instructor before your session and we will fully respect your preference. You may also withdraw consent for previously taken material by contacting us at maria@kyma28.com.
10
How Long We Keep Your Data
We retain your personal data for as long as you maintain an account with KYMA28 or have an active relationship with our studio.
If you request deletion of your account and data, we will action this within 30 days of receiving your request, subject to any legal obligations that require us to retain certain records — for example, financial transaction records which must be kept for a minimum of 7 years under Cyprus tax law.
11
Your Rights Under GDPR
As a data subject under GDPR, you have the following rights:
To exercise any of these rights, contact us at maria@kyma28.com. We will respond within 30 days. We may need to verify your identity before actioning your request.
12
Right to Complain
If you believe we have not handled your personal data correctly, you have the right to lodge a complaint with the Cyprus data protection supervisory authority:
We would, however, appreciate the opportunity to address your concerns before you approach the authority. Please contact us first at maria@kyma28.com.
13
Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. When we do, we will update the date at the top of this page.
Where changes are significant, we will notify you via the KYMA28 app or by email. We encourage you to review this policy periodically.
14
Contact Us
For any questions, concerns, or requests relating to this Privacy Policy or the way we handle your personal data, please reach out to us: