Privacy Policy

Last updated: 06 July 2026

This Privacy Policy explains how V Flow Pilates ("we", "us", "our") collects, uses, shares and protects your personal data when you visit our website, book a class, contact us, or attend our studio. We are committed to protecting your privacy and handling your personal data in line with the General Data Protection Regulation (EU) 2016/679 (GDPR), the Irish Data Protection Act 2018, and the ePrivacy Regulations (S.I. 336 of 2011).

1. Who we are (Data Controller)

V Flow Pilates is the data controller responsible for your personal data.

Address: Ballywalter, Co. Tipperary, Ireland — Eircode E41 DE04
Data protection (GDPR) contact: Vera Fitzgerald
Email: vflowpilates@gmail.com
Phone: 087 652 7789

If you have any questions about this policy or how we handle your data, please contact Vera Fitzgerald using the details above.

2. The personal data we collect

Depending on how you interact with us, we may collect:

  • Identity & contact data: your name, email address, phone number, and any details you choose to provide.

  • Booking & attendance data: the classes you book, attend, cancel or reschedule, and your class history, passes, packages and memberships. Bookings are made through Acuity Scheduling, an external booking platform embedded on our website (see Section 6).

  • Health information: details you provide about injuries, medical conditions, pregnancy, mobility or other health matters, so we can teach you safely and adapt classes to your needs. This is "special category" data and is treated with extra care (see Section 4).

  • Payment information: payments for classes are made through our booking platform (Acuity Scheduling) and its secure payment provider. We do not take or store any payment card details on our website. We keep records of payments (such as amounts and dates) for our accounts.

  • Contact form data: our website contact form collects only your name, email address and your question or message.

  • Other correspondence: messages you send us by email, phone, text or Instagram, and our replies.

  • Website & technical data: IP address, browser and device type, pages visited and similar information collected via cookies (see our Cookies Policy).

  • Marketing preferences: whether you have consented to receive marketing from us.

3. How we collect your data

We collect personal data when you:

  • Book or pay for a class, pass, package or membership through our embedded Acuity Scheduling booking system.

  • Complete an intake or health/consent form.

  • Use our website contact form (name, email and question).

  • Contact us by email, phone, text or social media.

  • Attend the studio.

  • Sign up to receive marketing communications; and browse our website (automatically, via cookies — see our Cookies Policy).

4. Why we use your data and our legal bases

Under the GDPR we must have a lawful basis for using your personal data. We rely on the following:

  • Take and manage your bookings and deliver your classes, passes and memberships — to provide the service you've requested. Legal basis: performance of a contract (Art. 6(1)(b)).

  • Process payments through our booking platform — to complete your purchase. Legal basis: performance of a contract (Art. 6(1)(b)).

  • Keep financial, payment and tax records — to comply with Irish tax and accounting law. Legal basis: legal obligation (Art. 6(1)(c)).

  • Hold and use your health/injury information — to teach you safely and adapt classes to your needs. Legal basis: your explicit consent (Art. 9(2)(a)).

  • Respond to enquiries sent via our contact form or other channels — to deal with your request. Legal basis: performance of a contract or our legitimate interests (Art. 6(1)(b)/(f)).

  • Send marketing emails or newsletters (only if you opt in) — to keep you updated about classes and offers. Legal basis: consent (Art. 6(1)(a)).

  • Run website analytics and non-essential cookies — to understand and improve our website. Legal basis: consent (Art. 6(1)(a)).

  • Maintain records, prevent fraud, ensure security, manage and improve our business, and establish or defend legal claims — to protect and run our business. Legal basis: our legitimate interests (Art. 6(1)(f)).

  • Where we rely on consent, you can withdraw it at any time (this won't affect processing carried out before withdrawal). Where we rely on legitimate interests, you can object (see Section 9).

5. Who we share your data with

We do not sell your personal data. We share it only where necessary with trusted service providers ("processors") who act on our instructions, and where we are legally required to do so. These include:

  • Squarespace — our website host.

  • Acuity Scheduling — our external online booking platform, embedded on our website (owned by Squarespace). Acuity processes your booking and payment information through its own secure payment provider, and may send you booking-related emails (such as confirmations and reminders).

  • Google — we use Gmail to manage email correspondence.

  • Meta — if you contact us via Instagram or interact with embedded social content.

  • Professional advisors — such as our accountant, and legal or insurance advisors where necessary.

  • Authorities — where we are required to disclose information by law.

Each provider is permitted to use your data only as needed to provide their service to us.

6. International transfers

Some of our service providers (for example, Squarespace, Acuity Scheduling and Google) are based in or transfer data to the United States. Where personal data is transferred outside the European Economic Area, we rely on appropriate safeguards such as the EU–US Data Privacy Framework and/or the European Commission's Standard Contractual Clauses, to ensure your data receives an equivalent level of protection.

7. How long we keep your data

We keep personal data only as long as necessary for the purposes set out above:

  • Booking and client records (including health information): while you are a client and for up to 7 years after your last interaction with us, after which it is securely deleted or anonymised. (Adjust this period if it doesn't match your practice.)

  • Financial and payment records: retained for at least six years to meet Irish tax and accounting obligations. Payment records are also held within Acuity Scheduling and its payment provider.

  • Marketing data: until you withdraw consent or unsubscribe.

  • Contact form enquiries that don't lead to a booking: kept for a limited period and then deleted.

  • Cookies and website data: for the periods described in our Cookies Policy.

8. Your rights

Under the GDPR you have the right to:

  • Access the personal data.

  • Rectify inaccurate or incomplete data.

  • Erase your data ("right to be forgotten") in certain circumstances.

  • Restrict processing in certain circumstances.

  • Object to processing based on legitimate interests, and to direct marketing at any time.

  • Data portability — receive your data in a portable format.

  • Withdraw consent at any time, where we rely on consent.

  • Lodge a complaint with the Data Protection Commission (see Section 10).

To exercise any of these rights, contact our data protection contact, Vera Fitzgerald, at vflowpilates@gmail.com. We will respond within one month. There is normally no charge, and we may need to verify your identity first.

9. Complaints

If you are unhappy with how we have handled your personal data, please contact us first so we can try to resolve it. You also have the right to complain to the Irish supervisory authority:

Data Protection Commission
6 Pembroke Row, Dublin 2, D02 X963, Ireland
Website: www.dataprotection.ie

10. Cookies

Our website uses cookies and similar technologies. Please see our separate Cookies Policy for full details and to manage your preferences.

11. Age of users

All our classes and services are for adults aged 18 and over. We do not knowingly collect or process the personal data of anyone under 18 through our website or services. If we become aware that we have done so, we will delete that information.

12. Data security

We take appropriate technical and organisational measures to keep your personal data secure, including restricting access to health and personal information, using reputable providers with their own security measures, and protecting our accounts and devices. While no method of transmission or storage is completely secure, we work to protect your data and to respond appropriately to any data breach, including notifying the Data Protection Commission where required.

13. Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be available on our website, with the "Last updated" date shown at the top.

14. Contact us

For any questions about this policy or your personal data please email us at vflowpilates@gmail.com.