Privacy Policy

Data controller

Libra 3 Frank (sole proprietorship), Alemannenstrasse 19, 4106 Therwil, Switzerland. Studio: Frohburgerstrasse 32, 4132 Muttenz. Contact: info@libra-studio.ch

What data we process

• Account: email address, name, and your password (stored only as a hash by our authentication provider). If you sign in with Google, we receive your name and email address from Google.
• Bookings and credits: the classes you booked with status and time, your credit balance, and every credit movement (purchases, redemptions, refunds).
• Payments: payments and subscriptions are handled by our payment provider Stripe, whether by card, TWINT, Apple Pay, or Google Pay. We never see or store card details, only the amount, confirmation, and reference numbers.
• Booking without an account: if you book as a guest and pay online, we receive your email address from Stripe and send you a confirmation with a personal link to cancel the booking.
• Libra Club: the status and term of your membership.
• Libra Club profile (optional): as a member you can add your postal address and date of birth in your account. We use both only to send you birthday wishes and mail from the studio. You can change or remove them at any time; they are deleted together with the account.
• Bring a friend: if you invite someone as a member, we record that person’s name and email address and send them the booking email as well as the link to the health questionnaire. Please only invite people who agree to this.
• Studio notes: our team can record internal notes on your account, for example an agreement about a refund. You do not see them in your account; on request you receive them with your data export. They are deleted together with your account.
• Technical access data: when you visit the site, our hosting provider logs IP address, time, and browser to keep the service running.

Health information

Before your first class we ask for a few details about pain and injuries, your back and joints, heart and circulation, surgery and ongoing treatment, pregnancy, and anything else your trainer should know, including any recommendations from your doctor or therapist. This is sensitive personal data, so:

• It is optional and stored only with your explicit consent.
• Its sole purpose is to look after you safely in training.
• It is stored encrypted (AES-256), visible only to our studio team, and every access to your answers is logged.
• With an account you can view, change and delete it there at any time; deleting your account deletes it too. As a guest you fill it in or fill it in again via the link in the e-mail (valid for 30 days, a new one is sent on request); for access or deletion contact the studio at info@libra-studio.ch. If you later register with the same e-mail address, the guest record is deleted and you fill in the questionnaire again in your account.
• Entries not updated for 24 months are deleted automatically; every update you make restarts that period.

Why we process it

We use this data to make classes bookable, manage your credits and membership, look after you safely, communicate with you (booking confirmations, cancellations, changes, account notices; no newsletter), and operate and improve our website.

Promotions, discount codes and cooperations

If a promotion applies to a booking or purchase, or you redeem a discount code, we store which promotion or code you used, when, and for which booking or purchase. For a cooperation code that we issue for a partner, for example for the employees of a company, we also store when you confirmed the code’s condition.

To check whether you meet the condition of a cooperation code, we may give the cooperation partner your name, the dates of your first and last redemption and their number, and ask whether the condition is still met. The partner thereby learns that you attend classes at LIBRA Studio. We do not pass on your email address, your bookings or your health information. You can see which partner a code belongs to when you redeem it. We keep the redemption details together with the booking or purchase.

Cookies

Required for operation and set without consent: a session cookie that keeps you signed in for 14 days, plus your cookie decision and any notice bar you dismissed. Both are stored in your browser only, we never see them. Only with your consent in the cookie banner: Google Analytics. Google uses it to analyse how our website is used, under a random identifier. Google does not receive your name or your email address. You can change or withdraw your consent at any time via “Cookie settings” in the page footer. Stripe’s own terms apply on its payment pages.

Providers and transfers abroad

To run the service we work with the following providers:

• Google Firebase (hosting, database, sign-in, file storage, analytics) — Google Ireland Ltd. / Google LLC, USA
• Stripe (payment processing, subscription management) — Stripe Payments Europe Ltd., Ireland / Stripe Inc., USA
• Resend (delivery of our emails) — Resend Inc., USA

Our database, our file storage, and our servers are hosted on Google Cloud in Europe (Netherlands, Belgium, and Switzerland).

Data may nevertheless be transferred to the USA. Transfers rely on standard contractual clauses or the Swiss-U.S. Data Privacy Framework where the provider is certified.

When you pay, Stripe processes your payment data on its own responsibility and not only on our behalf. Stripe’s own privacy policy applies to this.

Retention

We keep account data until you delete your account. Bookings and credit movements are business records we must retain for 10 years (Art. 958f Swiss Code of Obligations). When you delete your account, we remove your name and your email address from past bookings; the amount, date, and reference numbers remain. A future class you booked without an account keeps its email address, because otherwise you could neither attend nor cancel it.

Health information stays until you delete it or your account. We keep a log of who accessed your health information and when. That log remains even once the information itself is deleted, because it is the proof that deletion happened and when. Technical access data is kept as logs at Google Cloud, and Google deletes those logs automatically after 30 days.

For the birthday greeting we store the day and month of your birthday, when we sent you the email and when we handed you the small gift, for the current and the previous calendar year. This stays even if you remove the birthday from your profile; it is deleted together with the account.

Your rights

You have the right to access, correct, delete, and receive a copy of your data, and to withdraw consent at any time. You can delete your account and your health information directly in your account; for anything else, contact info@libra-studio.ch. Before you delete: unused credits expire in the process, and a running Libra Club membership ends without a refund. Our terms and conditions explain exactly what happens. The competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner (FDPIC).

Changes to this policy

We update this policy when the law or our offering changes. The current version, with its date, is always available on this page.