Privacy Policy | Rewell Emotion Fitness

This Privacy Policy explains how Rewell Emotion Fitness Studios Ltd ("Rewell", "we", "us") collects and uses your personal data when you visit rewellfitness.com, create an account, buy a membership or pack, book classes or sessions, or contact us. We follow the EU General Data Protection Regulation (GDPR) and the Cyprus law on the protection of personal data (Law 125(I)/2018).

1. Who is responsible for your data

The data controller is: Rewell Emotion Fitness Studios Ltd · Vatoudion 25, 8560 Peyia, Paphos, Cyprus · Registration no. HE 467417 · VAT no. 60108577L · Email: motioncy@gmail.com · Tel. +357 26 343677

2. What data we collect

Account and membership: first and last name, email, telephone, date of birth, fitness level, password (stored encrypted: nobody can read it), your memberships and packs, validity dates, sessions left, bookings and attendance.
Health information, only if you give it: injuries or conditions you write in the form, so your trainer can adapt your training safely. This is a special category of data and we only use it with your explicit consent.
Payments: product, amount, date and result of each payment. Card payments are processed by JCC Payment Systems: we never see or store your full card number. If you choose automatic renewal, JCC keeps your card securely and gives us only a reference code and the last digits of the card.
Your consents and acceptances: when you accepted our Terms, the 24-hour cancellation rule or other conditions, and whether you agreed to receive news and offers.
Messages: what you send us through the contact form, email, telephone or WhatsApp.
Technical data: IP address and security records, to protect the website against abuse, and one cookie that keeps you logged in (see our Cookie Policy).

3. Why we use your data and on what legal basis

To create and manage your account, memberships, packs and bookings, take payments and send you service messages (payment confirmation, renewal reminders, session reminders, password reset). Basis: the contract with you (Art. 6(1)(b) GDPR).
To adapt your training to your health information. Basis: your explicit consent (Art. 9(2)(a) GDPR), which you can withdraw at any time.
To keep accounting and tax records. Basis: our legal obligations (Art. 6(1)(c) GDPR).
To protect the website and the studio, prevent fraud and spam, keep proof of what you accepted and deal with complaints or legal claims. Basis: our legitimate interests (Art. 6(1)(f) GDPR).
To send you news and offers by email. Basis: your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time.

4. Who we share it with

We never sell your data. We only share what is necessary with:

Hostinger: hosting of the website, database and email.
JCC Payment Systems Ltd (Cyprus): card payments and automatic renewals.
Meta Platforms (WhatsApp): only for reminders of private and semi-personal sessions, your first name, telephone number and session time.
Our trainers: the name, fitness level and health notes of the people booked in the classes they teach (read only).
Our accountant and public authorities, when the law requires it.
Google: only if you click "Show map" on the Contact page.

All of them process your data under agreements that protect it.

5. Transfers outside the EU

Some providers, such as Meta (WhatsApp) and Google, may process data outside the European Economic Area. They use safeguards approved by the European Commission, such as the EU-US Data Privacy Framework or Standard Contractual Clauses.

6. How long we keep it

Account and membership data: while your account is active and up to 2 years after your last membership or pack ended. Then it is deleted or anonymised.
Payment and invoicing records: 6 years, as required by Cyprus tax law.
Health information: until you withdraw your consent or your membership ends, and at most 1 year after your last visit.
Sign-ups that were never paid: deleted automatically after 14 days.
Messages from the contact form: up to 12 months.
Security records of login attempts: 24 hours.

7. Your rights

You can ask us at any time, free of charge, to:

see the data we hold about you and get a copy;
correct data that is wrong or incomplete;
delete your data, when we no longer need it or have no legal reason to keep it;
restrict or object to how we use it;
give you your data in a common electronic format (portability);
withdraw any consent you gave. This does not affect what we did before.

Write to motioncy@gmail.com. We answer within one month and may ask you to confirm your identity.

8. Complaints

If you are not happy with how we handle your data, please tell us first so we can fix it. You also have the right to complain to the Commissioner for Personal Data Protection: Iasonos 1, 1082 Nicosia, Cyprus · Tel. +357 22 818456 · commissioner@dataprotection.gov.cy · www.dataprotection.gov.cy.

9. Security

The website uses an encrypted connection (HTTPS). Passwords are stored encrypted. Only the staff who need it can see your data, and trainers only see their own classes. We keep regular backups.

10. Young people

Our services are for people aged 16 and over. If you are 16 or 17, your parent or guardian must agree to your membership.

11. Changes

We may update this policy. The date at the top shows the latest version, and we tell members about important changes by email.

Privacy Policy.