Legal
Privacy policy
Who is responsible for your information
APEX pilates, the reformer pilates studio inside APEX Fitness Centre at APEX Fitness Centre, Grigori Afxentiou 9, Livadia, Larnaca 7060, Cyprus, decides how the information described here is used. In data protection law that makes the studio the "controller". The studio is operated by M.M.A. APEX FITNESS CENTER LTD (company registration HE 497271, VAT 60395665S), registered at the same address. Write to info@apexfitnesscentrecy.com or telephone +357 99 649 052 about anything on this page, including any of the rights set out below. This notice describes what this website and its booking system actually hold. It is written to match the software rather than to cover every possibility, so where it says something is deleted, something is deleted.
What we hold, and why we are allowed to
To give you an account and take your bookings. Your name, email address, telephone number, the language you read the site in, and an encrypted form of your password. Your bookings, the classes you attended or missed, the session packs you hold and when they expire. We need these to provide what you have asked for, so the legal basis is the performance of our contract with you. To take payment. The amount, the date, the currency, which method was used, an invoice number, and the reference the payment provider gives us. Card payments are handled entirely by our payment provider: card numbers are typed into fields it controls and never reach this website or the studio. Keeping the records is both part of our contract and a legal obligation under tax law. To send you the messages the service needs. Booking confirmations, cancellations, class reminders, a note the night before about the next day, payment receipts, and notices when a class or the timetable changes. These are part of holding an account and cannot be switched off, though you choose which of email, SMS and phone notifications carry them. The legal basis is our contract with you. To send you offers and news, only if you asked for it. A separate, optional choice made at sign-up or in your account, on the basis of your consent. You can withdraw it at any time in My account, and withdrawing it does not affect the service messages above. What you tell us about your health. See the section below. This is special-category information and we rely on your explicit consent. Your own optional details. A profile photograph, date of birth, height and weight, if you choose to add them. You can leave them all blank and use the studio normally. Date of birth is held because reformer work is screened by age, not to send you birthday wishes. The studio's own working notes. Brief notes kept by instructors and reception so they can teach you safely, on the basis of our legitimate interest in doing so, and which you can ask to see. Messages you send us. If you use the contact form we keep your name, email address, telephone number if you gave one, and what you wrote, so somebody can reply. Technical information needed to keep the site working. Which of your devices have allowed notifications, and a short description of the browser each one is, so a device that stops accepting messages can be retired.
What you tell us about your health
When you register, and at any time afterwards in your account, you can tell us about anything we should be careful of: an injury, a condition, a pregnancy, a movement that hurts. Reception can also write it down for you if you mention it at the counter. This is information about your health, which the law treats as needing more protection than the rest. We hold it only because you have explicitly agreed that we should, and you can withdraw that agreement or clear the answer at any time. Leaving it blank is a real answer and does not stop you booking anything. Who sees it: the people who run the desk, and the instructor teaching a class you are booked into. It is kept out of sight on the studio's own screens until somebody needs it, because those screens sit in rooms with other people in them. It is not shown to other members anywhere, and it is never sent outside the studio. We ask for it because five people on five reformers is a room where the instructor needs to know whose shoulder to watch. Nothing here is medical advice and the studio is not a clinic: if you are unsure whether you should be exercising, ask a doctor rather than us.
Card payments
The studio uses a specialist payment provider to take card payments. When you pay, the card fields on the checkout page belong to that provider and are shown inside frames it controls; your card number, expiry date and security code go straight to it and are never sent to this website, never stored by it, and never seen by the studio. What we keep is the record of the payment: how much, when, in what currency, which method, the invoice number, the provider's own reference, and a link to the receipt it hosts. That receipt shows the last four digits of the card, which is the provider's record rather than ours. The provider is a regulated payment processor with its own responsibilities for parts of what it does, and it publishes its own privacy notice. Write to info@apexfitnesscentrecy.com and the studio will tell you which provider it uses and where that notice is. If you pay in cash or by card at the desk, reception records the amount and the method, and no card details are held in either case.
Who else handles your information
The studio uses a small number of companies to run this service. Each one only receives what it needs, and each is bound by a contract that allows it to use the information only for the studio's instructions. A hosting company runs the website and its database, in a data centre in Frankfurt, Germany. A payment provider takes card payments, as described above. An SMS company based in Cyprus sends text messages. It receives a telephone number and the text of the message, and only when a message is actually sent to you by SMS. An email provider carries the studio's mailbox, so any email we send you passes through it. A backup service keeps an off-site copy of the studio's database, so the records can be restored if the main copy is ever lost. That copy contains everything the database holds, the health notes above included. Two more things your browser does that are worth naming. The typefaces on this site are requested from a font service, which means that service sees the network address your device is using; the site can be changed to serve the typefaces itself if the studio prefers. And notifications are delivered by whichever push service your own browser uses, which depends on your device and which the studio has no relationship with or control over. We do not use any analytics, advertising or tracking service. Nothing on this site reports your behaviour to anybody, and there is no third-party script anywhere on it apart from the payment provider's, which loads only on the checkout page. If you want the names, ask for them. Write to info@apexfitnesscentrecy.com and the studio will tell you exactly which companies these are. They are described by what they do rather than by name so that this page does not go out of date every time a supplier changes, and not in order to keep them from you. We do not sell your information and we never will.
Where it is kept, and whether it leaves Europe
The database lives in Frankfurt, Germany, inside the European Union. The payment provider and the email provider both operate outside the European Economic Area as well as inside it, and information reaching them may be transferred to countries whose laws differ from ours. Where that happens they rely on the safeguards European law provides for it, which are either a European Commission decision that the country protects information adequately, or the Commission's standard contractual clauses. The off-site backup of the database is held by a service that operates outside the European Economic Area, under those same safeguards.
How long we keep it
Your account, until you ask us to erase it. We do not delete accounts for being quiet. Somebody who trained here two years ago and comes back should find their history where they left it. An account that never confirmed its email address: 7 days. If you start registering and never enter the code, the whole record is deleted automatically after 7 days, unless it has a payment or a booking on it. An address the studio has no relationship with is not one it should be holding. Confirmation codes: 24 hours after they expire. Then the record of the code is deleted. We never store the code itself, only a value derived from it that cannot be turned back into the code. Payment records: six years from the end of the year they relate to. Tax and company law in Cyprus requires it, and this is the one category we cannot delete on request while that period is running. It is why erasing a member removes who they were but leaves the fact that a payment of a certain amount happened on a certain date. Everything else, until you ask. Bookings, attendance, session history and the messages we sent you stay on the account until you ask us to erase it, and then they are treated as described in the next section. We should be straight with you about one thing: apart from the two automatic sweeps named above, nothing here deletes itself on a timer. The studio deletes on request, and does so properly.
What erasing your information actually does
You can ask the studio to erase you and it will. Here is exactly what happens, because "we will delete your data" is a sentence that usually hides something. Removed completely: your name, which becomes "Erased member"; your email address, which is replaced with a placeholder at a domain that cannot receive mail; your telephone number; your date of birth, height and weight; everything you told us about your health; your pilates level and experience; the studio's own notes about you; your profile photograph; every device registered for notifications; any half-finished confirmation code; and any message you sent us through the contact form. Your password is replaced with one nobody holds, so the account cannot be signed into again. Marketing consent, email and SMS notifications are all switched off. Kept, and why: the payments themselves, and the bookings and attendance attached to them. Not because they are convenient to keep, but because the studio's takings for last March are a sum of those rows, and deleting them would rewrite accounts that have already been filed. What is left is a record that a payment of an amount happened on a date, with no name on it. Also kept is the date on which you gave consent to be contacted, which is the evidence the studio may need precisely if you later dispute its dealings with you. Not automatically cancelled: classes you are already booked into. The studio will tell you how many there are so you can decide. If you have classes booked or a balance you have paid for, tell us what you want done with them first: erasure cannot be undone.
Your rights
You can ask the studio to: Show you what it holds, as a copy you can keep. Correct anything wrong. Most of it you can also correct yourself in My account, and reception can correct the rest while you wait. Erase you, as described above. Stop using it for a while, if you dispute something and want it frozen rather than deleted. Object to the studio's use of information where that use rests on its legitimate interests, which is the studio's own working notes. Hand it over in a portable form, for the information you gave us and that we hold under our contract or your consent. Withdraw a consent you gave, at any time. Offers and news are switched off in My account with one press. Health information can be cleared the same way. Withdrawing consent does not undo anything done while it was in force. Ask by writing to info@apexfitnesscentrecy.com. The studio will reply within one month, and will tell you if it needs longer and why. There is nothing to pay. If you are not satisfied with how the studio has answered, you can complain to the Office of the Commissioner for Personal Data Protection in Cyprus, at commissioner@dataprotection.gov.cy or www.dataprotection.gov.cy. You can complain to them without asking us first, though we would rather have the chance to put it right.
Decisions, and how the studio chooses who to write to
Nothing on this site makes an automated decision about you that has a legal or similarly significant effect. No algorithm decides whether you may book, what you pay, or whether you are welcome. When the studio sends an announcement it can narrow the list, for example to members who have not been for a while. That is a filter on who receives a message, applied by a person who then presses send. It changes nothing about your account and has no consequence beyond whether one message arrives.
Age
Accounts are for people aged 16 and over. The site asks for a date of birth if you choose to give one and will not accept one that makes you younger than 16. The studio does not knowingly hold information about children. If you believe a child has registered, write to info@apexfitnesscentrecy.com and it will be removed.
How your information is protected
Passwords are never stored. What is stored is a value produced from your password by a one-way function designed to be slow to attack, and it cannot be turned back into your password. Nobody at the studio can read it or tell you what your password is. The whole site is served over an encrypted connection. Confirmation codes are stored the same way as passwords, as a derived value rather than the code. Inside the studio, access is divided on purpose: the people at the desk can see what they need in order to serve you and no more, and the studio's own figures are not part of that. Staff screens in public parts of the building ask for a password of their own and lock themselves when they are left alone. No system is perfect. If something does go wrong and it is likely to put you at risk, the studio will tell you and the Commissioner, as the law requires.
Cookies
This site sets three cookies and stores one preference on your device. None of them is for advertising or tracking, and there is no analytics of any kind. The cookies page sets out each one, what it is for, how long it lasts, and how to remove it.
Changes to this notice
If the studio changes how it uses your information, this page changes with it and the date below changes too. Where a change matters to you, you will hear about it rather than being left to notice it. Last updated: September 2026.