Privacy Policy

1. Data Controller

The data controller responsible for processing your personal data is:

• Business name: MCC Pilates S.L.U.
• Address: C/ Joan Crespí, 47, 07014 Palma de Mallorca, Illes Balears, Spain
• Email: info@nimarapilates.com
• Website: nimarapilates.com

2. Data We Collect

We collect personal data through the following channels:

2.1 Contact Form (Formspree and Momence)

When you submit our contact form, we collect your first name, last name, email address, phone number, how you found us, and message content. This data is processed by Formspree, Inc. and forwarded to us by email. Your name, email address, phone number and how you found us are also recorded as an enquiry in Momence, our booking system, so that we can follow it up.

2.2 Class Bookings (Momence)

When you book a class, you interact with Momence, a third-party booking platform. Momence collects your name, email address, phone number, payment information, and booking history. Momence acts as an independent data controller for data processed through its platform. Please refer to Momence’s privacy policy for details.

2.3 Website Analytics (Vercel Analytics)

We use Vercel Analytics and Vercel Speed Insights to understand how visitors use our website. These tools collect anonymised, aggregated data such as page views, referral sources, and performance metrics. No personally identifiable information is collected. No cookies are set for analytics purposes.

2.4 WhatsApp (Meta)

Our website includes a WhatsApp button for direct messaging. When you contact us via WhatsApp, your messages and phone number are processed by Meta Platforms Ireland Ltd. Please refer to WhatsApp’s privacy policy for details.

3. Legal Basis for Processing

We process your personal data on the following legal bases under Article 6 of the GDPR:

• Consent (Art. 6(1)(a)): When you voluntarily submit the contact form or initiate a WhatsApp conversation with us.
• Performance of a contract (Art. 6(1)(b)): When processing is necessary to fulfil a class booking or manage your membership.
• Legitimate interest (Art. 6(1)(f)): For website analytics to improve our services and user experience, where such interests are not overridden by your rights.

4. Data Retention

• Contact form submissions: Retained for up to 12 months from the date of enquiry, then deleted unless a business relationship is established.
• Booking and payment data: Retained in accordance with Spanish tax and accounting obligations (minimum 5 years as required by Ley General Tributaria).
• Analytics data: Aggregated and anonymised; no personal data is stored.

5. Third-Party Processors

We share your data with the following third-party services, each of which maintains its own privacy policy:

Where data is transferred outside the European Economic Area, appropriate safeguards are in place (e.g., EU Standard Contractual Clauses or adequacy decisions).

6. Cookies

Our website uses only essential cookies required for the proper functioning of the site. We do not use advertising or tracking cookies.

Vercel Analytics is privacy-focused and does not use cookies to collect data. No cookie consent banner is required for essential-only cookies under the ePrivacy Directive and Spain’s LSSI (Ley 34/2002, de servicios de la sociedad de la información y de comercio electrónico).

7. Your Rights Under the GDPR

As a data subject, you have the following rights:

• Right of access — obtain confirmation of whether your data is being processed and request a copy.
• Right to rectification — request correction of inaccurate or incomplete data.
• Right to erasure — request deletion of your personal data where there is no compelling reason for continued processing.
• Right to restriction of processing — request that we limit how we use your data.
• Right to data portability — receive your data in a structured, commonly used, machine-readable format.
• Right to object — object to processing based on legitimate interests or direct marketing.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at info@nimarapilates.com. We will respond within 30 days.

8. Right to Lodge a Complaint

If you believe your data protection rights have been infringed, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD):

• Website: www.aepd.es
• Address: C/ Jorge Juan 6, 28001 Madrid, Spain
• Phone: +34 901 100 099

9. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date. We encourage you to review this policy periodically.

10. Contact

For any questions regarding this Privacy Policy or your personal data, please contact us at info@nimarapilates.com.