Privacy Notice — Grace & Core

This privacy notice describes the processing of personal data carried out by Grace & Core (the "Studio") as an independent controller in respect of its clients' personal data.

You can reach the Studio at: address: Budapest, Andrássy út 42, 1061, email: hello@graceandcore.hu, phone: +36 1 785 2210.

The Studio processes booking, pass, event ticket, attendance and other client data for its own purposes, as an independent controller. The booking and studio-management system is provided by the Plenimo platform, which — in respect of this data — acts solely as a processor, following the Studio's documented written instructions (see section 4).

This notice describes the processing for which the Studio is the controller: data about your classes, passes, event tickets, purchases, attendance and your communications with the Studio.

Processing carried out by the operator of the Plenimo platform as its own controller (e.g. the technical operation of the Platform website, studio-owner accounts, cookies) is governed by the Plenimo platform's own privacy policy, available on the Plenimo website.

Your sign-in (name, proven email address, password) belongs to one Plenimo login, however many studios you use; Plenimo is the controller of that login. The Studio does not see which other studios you use, and the other studios do not see the data held here. If you leave the Studio (Account → Leave this studio), the data held here is erased; your login and your other studios stay as they are.

Bookings and attendance. Data processed: name, email address, the classes you book, attendance records, and booking-related notes. Purpose: fulfilling class bookings, managing places and recording attendance. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).

Passes, memberships and payment. Data processed: the type of pass or membership purchased, remaining credits, and purchase and payment data. Card payments are processed by Stripe Inc.; the Studio is the merchant of record for the payment. The Studio never sees or stores full card details. Purpose: fulfilling the pass/membership purchase and payment. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).

Event tickets. Data processed: name, email address, the events the Studio holds (for example workshops, outdoor classes or retreats) for which you buy a ticket or reserve a free place, how and how much you paid (by card online, or at the Studio in cash, by card terminal or by bank transfer; nothing for a complimentary ticket), the ticket's cancellation and any refund, and your check-in at the event. Card payments made online and their refunds are processed by Stripe Inc., as for passes; while your payment is in progress, the system holds your place for up to 60 minutes. Purpose: selling tickets and reserving places, taking payment, refunding as the Studio's terms provide, keeping the attendee list and recording check-in, and telling you about your ticket (confirmation, a change of time or place, cancellation, a reminder the day before, with a calendar invitation, and through your calendar link if you use one). The Studio's administrators see an event's attendee list and may write to everyone attending it from their own email program, with the addresses in blind copy (BCC). Legal basis: performance of a contract (GDPR Art. 6(1)(b)). Invoices for tickets are covered by the Invoicing paragraph and retention by section 5; when you delete your account, your tickets for events that have not yet started are cancelled, and the tickets are kept as sale records linked only to the anonymised account.

Invoicing. For purchases, the Studio issues invoices as required by law through its own invoicing provider (szamlazz.hu — KBOSS.hu Kft., or Billingo — Billingo Technologies Zrt.). Data processed: the buyer data needed for the invoice (name, and address where required), the line item and the amount. Purpose: issuing and retaining invoices. Legal basis: compliance with a legal obligation (GDPR Art. 6(1)(c)) under Section 169 of Act C of 2000 on Accounting.

Waitlist. Data processed: name, email address, the waitlisted class. Purpose: managing sign-ups for full classes and notifying you when a place opens up. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).

Transactional (system) email. Data processed: email address, name, and data relevant to the notification (e.g. booking confirmation, reminder, cancellation notice). Purpose: delivering non-marketing messages essential to the operation of the service. Legal basis: performance of a contract (GDPR Art. 6(1)(b)).

Push notifications. If you use the Plenimo app and allow notifications on your phone, you can also receive the Studio’s notices (for example a booking confirmation, a reminder, a change to your class) as push notifications. Data processed: the push token Apple or Google issues for the app on your phone, the phone’s platform (iOS or Android), the app’s version and language, and when the phone was registered and last used; each notification’s title and text go, with the token, to Apple or Google for delivery. The text never contains notes, health information or messages. Purpose: delivering the notices you have switched on. Legal basis: performance of a contract (GDPR Art. 6(1)(b)). In the notification settings of your account you choose, for each kind of notice and separately from email, what comes as a push notification, and you can switch push notifications off altogether in your phone’s settings.

Marketing (newsletter, promotions). Where you have expressly consented, the Studio may send you marketing messages. Legal basis: your consent (GDPR Art. 6(1)(a)) and Section 6 of Act XLVIII of 2008 on the Basic Conditions and Certain Limitations of Business Advertising Activity. Marketing consent is off by default (opt-in) and may be withdrawn at any time, without giving reasons and free of charge, in your account (Account → Notifications) or via the Studio. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Instructor ratings. If you submit a rating for a class or instructor, by submitting it you consent to the processing of the rating content. Legal basis: your consent (GDPR Art. 6(1)(a)), given by submitting the rating.

Health notes. If you give your explicit consent, the Studio may record a short note about a health circumstance relevant to your safety in class (for example an injury, a post-surgery condition, or a movement limitation), under a set category and in at most 500 characters. Purpose: protecting your physical safety in class — the instructor teaching it (including a substitute) knows what to avoid. Legal basis: your explicit consent (GDPR Art. 9(2)(a) and Art. 6(1)(a)). These notes can be seen by the Studio's admins and instructors — the text is hidden by default and every viewing is logged. Exceptionally, the platform operator's support staff may access the notes during a documented and logged support session. You may give consent in your account, or on a signed paper form which the Studio records in the system. Retention: at most 24 months from recording, or until your account is deleted; if the Studio switches the feature off, existing health notes are deleted. You may withdraw your consent at any time, without giving reasons, in your account (Account → Health notes); on withdrawal the health notes the Studio holds about you are deleted immediately. Giving consent is entirely voluntary: refusing or withdrawing it does not affect class booking, pass purchases or attendance in any way. You may request a copy of the notes — of both kinds — at any time, and they are included in your data export.

Progress notes. The Studio's instructors may keep short, non-health notes about your classes (goals, cueing points, progress, preferences). Purpose: continuity and quality of instruction. Legal basis: the Studio's legitimate interest (GDPR Art. 6(1)(f)) in building your instruction on your earlier classes; the Studio has balanced this interest against your interests. You may object to this processing at any time under GDPR Art. 21. These notes are accessible to the Studio's admins and instructors, and to you on request and in your data export.

Where the data comes from. Most of the data about you comes from you (registration, booking, purchase). Some is recorded about you by the Studio's staff: the details of a client account created for you at the desk, an event ticket sold or given to you at the desk, the fact of your attendance at classes and your check-in at events, progress notes and — with your consent — health notes, and the fact that you gave consent on paper. This paragraph is also the information required by GDPR Art. 14, and you may request a copy of all of it.

Attendance statistics and forecasts. The Studio compiles aggregate statistics and utilisation forecasts from booking and attendance data to plan its operations (e.g. shaping its class offering). These serve internal, operational purposes only and do not involve solely automated decision-making (profiling) producing legal effects concerning you. Legal basis: the Studio's legitimate interest (GDPR Art. 6(1)(f)) in efficiently organising its service; the Studio has balanced this interest against your interests.

To operate the booking and studio-management system the Studio uses the Plenimo platform. In respect of your data, Plenimo acts as a processor, following the Studio's documented written instructions.

To provide the service, Plenimo engages further (sub-)processors — for example for hosting, database, email delivery, push notification delivery (Apple, Google) and payment processing. The current, up-to-date list, together with the safeguards for international transfers (EU–US Data Privacy Framework or Standard Contractual Clauses), is published at Plenimo's /subprocessors page.

Card payments are processed by Stripe Inc. Invoices are issued and archived by the Studio's invoicing provider (szamlazz.hu — KBOSS.hu Kft., or Billingo — Billingo Technologies Zrt.).

The Studio treats your data confidentially and does not sell it to third parties for commercial purposes.

Account and client data (bookings, passes, event tickets, attendance): for the lifetime of the account, or for up to 30 days from your request to delete the account, except where a law requires longer retention.

Progress notes: for as long as the account exists; they are deleted with the account. Health notes: at most 24 months from recording, or until consent is withdrawn or the Studio switches the feature off. The log of health-note viewings: 24 months. System notifications: 12 months. Push token: until you sign out of the app on that phone, until Apple or Google report it is no longer valid, or until the account is deleted. Waitlist entries: until the class in question has taken place, or until the account is deleted.

Issued invoices: for 8 years from issuance, in the archive of the Studio's invoicing provider, under Section 169 of Act C of 2000 on Accounting. Because this processing rests on a legal obligation, such data is exempt — until the retention period expires — from the right to erasure under GDPR Art. 17(3)(b).

When the account is deleted, personal data identifying the buyer is removed from the invoice copy stored by the Platform; the statutory accounting record is retained by the Studio's invoicing provider for the 8-year period above.

Record of marketing consent: until the consent is withdrawn, and for a reasonable period thereafter to evidence the withdrawal.

Under applicable data-protection law you may exercise the following rights in respect of your personal data: the right of access; the right to rectification; the right to erasure ("right to be forgotten"); the right to restriction of processing; the right to data portability; and the right to object. Where processing is based on consent, you may withdraw your consent at any time.

The easiest way to exercise your rights is in your account: on the Account page you can directly download your data (Download my data) and delete your account and data (Delete my account). You may also send your request directly to the Studio using the contact details above (address: Budapest, Andrássy út 42, 1061, email: hello@graceandcore.hu, phone: +36 1 785 2210).

We will comply with your request without undue delay and in any event within 30 days of receipt; this period may be extended as permitted by law given the complexity of the request, in which case we will inform you. Exercising these rights is free of charge, unless a request is manifestly unfounded or excessive, in particular because of its repetitive character.

The Studio's public website and the booking interface use only strictly necessary cookies and local storage; they use no analytics, social-media or marketing tracking code, and consequently display no cookie-consent banner.

A detailed description of cookies and local storage is provided in the Platform's privacy policy: https://plenimo.com/privacy.

If you consider that the processing of your personal data infringes the law, you may lodge a complaint with the supervisory authority:

Hungarian National Authority for Data Protection and Freedom of Information (Nemzeti Adatvédelmi és Információszabadság Hatóság, NAIH), 1055 Budapest, Falk Miksa u. 9-11., email: ugyfelszolgalat@naih.hu, website: naih.hu.

You also have the right to an effective judicial remedy. Court proceedings fall within the competence of the tribunal (törvényszék) and may, at your choice, be brought before the tribunal of your place of residence or stay.

To use the service and create an account you must be at least 16 years old (in accordance with GDPR Art. 8 and its Hungarian implementation). If we become aware that we hold consent-based data of a person under 16 without appropriate parental authorisation, we will delete the data concerned without undue delay.

The Studio reserves the right to amend this notice. The version in force at any time is available on the Studio's website, bearing the "Last updated" date shown above.