Privacy Policy

1. Who we are

Soren Pilates & Wellness Studio (“Soren”, “we”, “us”) is operated by Soren Lda (Portuguese tax number 519484010), Rua da Junqueira 372, 1300-217 Lisbon, Portugal, which is the data controller for the personal data described in this policy. We process personal data in accordance with the General Data Protection Regulation (GDPR) and applicable Portuguese law. This policy explains what we collect when you visit our website, contact us, book a class or Recovery Room session, or visit Aura Wellness Bar, and how we look after that information. You can reach us at info@sorenstudio.eu.

2. What personal data we collect

Information you give us: your name, email address, phone number and anything you write to us through our contact form, by email or WhatsApp.

Booking, purchase and account information: the classes and sessions you book, attendance history, memberships, class packs and Recovery packages, purchase and billing records, and payment status. We do not collect card numbers or bank details ourselves — payments are processed directly by our booking platform and its payment providers.

Health and wellbeing information: if you choose to tell us about injuries, pregnancy or medical conditions, we use this only so that your instructor can adapt your session and keep you safe. We ask for your explicit consent before recording it.

Technical information: your IP address, browser and device type, the pages you visit and similar data collected through cookies when you use our website.

3. How we use your data

We use your personal data to create and manage your account, bookings and memberships; to respond to your enquiries; to send booking confirmations, reminders and other service messages; to adapt classes to any health needs you share with us; to keep our records accurate and our studio safe; to improve our website and services; and — only where you have agreed — to send you studio news and offers. You can unsubscribe from marketing emails at any time using the link in each message. We do not sell your personal data.

4. Legal bases for processing

We process your personal data on the following legal bases under the GDPR: the performance of a contract with you (bookings, memberships and payments); your consent (marketing emails, non-essential cookies and health information); our legitimate interests in running and improving the studio and preventing misuse; and compliance with our legal obligations, such as accounting, tax and consumer protection law.

5. Booking and payments

All classes, Recovery Room sessions, memberships and payments are handled through our third-party booking platform (YOGO) and its payment processors. When you create an account or make a booking, the information you provide is also processed by that platform under its own privacy policy and terms.

6. Cookies, analytics and maps

Some storage is strictly necessary for our website to work and stay secure: a record of your cookie choice, kept in your browser, and a spam-protection check on our contact form (Cloudflare Turnstile, provided through our website host). These do not require your consent.

With your consent, we use Google Analytics 4, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), to understand how visitors use our website — for example, which pages are viewed and how visitors arrive at the site — so that we can improve it. Google Analytics sets the cookies _ga and _ga_<ID>, which are kept for up to 2 years, and analytics data is kept in Google Analytics for 14 months. Google Analytics 4 does not log or store IP addresses. Google Signals and advertising features are switched off, and we do not use this data for advertising. Google may process data in the United States; such transfers are covered by the EU–US Data Privacy Framework. Google Analytics is only loaded after you choose “Accept all” or switch on Analytics in Cookie settings; the legal basis is your consent.

The maps on our Home and Contact pages are static images based on OpenStreetMap data and do not send any data to third parties. Clicking a map or “Get Directions” opens Google Maps (or Apple Maps on iPhone and iPad) in a new tab, where that provider’s own privacy policy applies.

You can change or withdraw your consent at any time via “Cookie settings” at the bottom of every page; when you withdraw it, Google Analytics is switched off and its cookies are deleted. You can also block or delete cookies in your browser settings.

7. Sharing your data

We share personal data only with service providers who support our operations — our booking and payments platform, our website host, our analytics provider (Google Analytics, only with your consent), our email and messaging tools, and our accountants — and only to the extent needed to provide our services. These providers act on our instructions and are bound by confidentiality and data protection obligations. We may also disclose data where required by law or to protect our rights. We do not share your data with third parties for their own marketing purposes.

8. International transfers

Some of our service providers are based outside the European Economic Area. Where your data is transferred outside the EEA, we make sure appropriate safeguards are in place, such as an adequacy decision of the European Commission or Standard Contractual Clauses.

9. How long we keep your data

We keep booking and membership records for as long as your account is active and for a reasonable period afterwards to meet our legal, accounting and tax obligations. Enquiry messages are kept only as long as needed to respond and follow up. Health information is deleted when it is no longer needed or when you ask us to remove it, and marketing data is kept until you unsubscribe.

10. Data security

We use appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access, including access controls and encrypted connections. No method of transmission over the internet is completely secure, but we review our measures regularly to keep your information safe.

11. Your rights

Under the GDPR, you have the right to access, correct, delete or restrict the use of your personal data, to object to certain processing, to receive your data in a portable format, and to withdraw your consent at any time without affecting processing carried out before the withdrawal. To exercise any of these rights, contact us at info@sorenstudio.eu — we will reply within one month. You also have the right to lodge a complaint with the Comissão Nacional de Proteção de Dados (CNPD), Portugal’s data protection authority (www.cnpd.pt).

12. Children’s privacy

Our services are intended for adults. Pre & Postnatal classes relate to the parent, not the child. We do not knowingly collect personal data from children.

13. Changes to this policy

We may update this policy from time to time to reflect changes to our services or to the law. The “Last updated” date at the top of this page shows when it was last revised, and we will let you know about significant changes by email or on our website.

14. Contact us

If you have any questions about this policy or how we handle your data, please contact us at info@sorenstudio.eu.