Privacy Policy
This Privacy Policy explains what personal data Nomi Pilates Studio collects when you book a class or use our website, why we process it, how long we keep it, and what rights you have over it, in line with the General Data Protection Regulation (GDPR) and Serbia's Law on Personal Data Protection.
Last updated: 5 July 2026.
Data controller
The controller of your personal data is Nomi Pilates Studio (owner and founder Željka). For any questions about this Privacy Policy or your data, you can reach us using the contact details at the end of this page.
Nomi Pilates Studio
Dobanovačka 57, Zemun, Beograd 11080
@nomipilatesstudio
What data we collect
When you create an account and book classes, we collect:
- Full name
- Email address
- Phone number (used only to contact you about your sessions)
- Booking history: which classes you booked, cancelled, or attended
- Attendance record (attended / no-show)
Lawful basis for processing
We process your data primarily on the basis of performance of a contract, so that we can let you book, manage, and attend the Pilates sessions you reserve through the site. Your phone number is processed on the same basis, solely to communicate with you about your sessions.
If you separately give us your consent for marketing messages in the future (e.g. notices about new sessions or promotions), that processing is based on your consent, which you can withdraw at any time.
Data processors (third parties)
We do not sell your data. To provide the service, we rely on the following carefully-chosen processors:
- Cloudflare Pages: hosts the website and serves its static pages.
- Supabase (eu-central-1 region, Frankfurt): stores your account, bookings, and attendance data in a database located in the European Union, and powers sign-in (authentication).
- Cloudflare Web Analytics (Cloudflare, Inc.): anonymous, cookieless website-visit analytics; it does not track you individually or build a profile of you.
How long we keep your data
We keep records of past and cancelled bookings for 24 months for operational history (e.g. resolving disputes, attendance statistics), after which we anonymize them (remove the link to your account) or permanently delete them.
If your account is inactive for 24 months (no sign-in and no bookings), we will email you and then delete the account if you do not respond.
Sign-in (auth) logs are kept per Supabase's default retention settings.
International data transfers
Your data is stored in the European Union (Frankfurt, Germany). Some of our processors (e.g. Cloudflare) are US-headquartered and may process certain technical data (e.g. delivering static files over a global network) outside the EU, under appropriate safeguards such as Standard Contractual Clauses (SCCs).
Note: because some processors are US companies, they could in theory be compelled to respond to a US authority request under the US CLOUD Act, even where the data is physically stored in the EU. This is a general risk with any US-based provider, and we choose processors that offer the strongest contractual and technical safeguards available.
Your rights
Under the GDPR and Serbia's Law on Personal Data Protection, you have the right to:
- Access your data: you can view your bookings and profile within your account.
- Rectify inaccurate data: update your name, email, or phone number in your account settings.
- Request erasure (right to be forgotten): deleting your account permanently removes your profile and all bookings. You can do this yourself from your account, or contact us directly.
- Lodge a complaint with the Serbian Commissioner for Information of Public Importance and Personal Data Protection, if you believe your data has been processed unlawfully.
Contact for privacy questions
For any questions about this Privacy Policy or how we handle your data, you can reach us at:
@nomipilatesstudio · Instagram
Dobanovačka 57, Zemun, Beograd 11080