Privacy Policy
We tell you clearly what data we process, why, for how long and what rights you have.
1. Who we are (the data controller)
InForm Studio processes your personal data as a controller, under Regulation (EU) 2016/679 (GDPR).
- Name: InForm Studio S.R.L.
- Tax ID (CUI): 54649423
- Trade Register no.: J2026030517000
- Registered office: Str. Crinului nr. 49, fl. 1, apt. 19, Chiajna, Ilfov County
- Studio address: Strada Soarelui nr. 26, Chiajna, Ilfov County
- Email: contact@informstudio.ro
- Phone: +40 766 266 967
2. Data protection officer
InForm Studio has not appointed a data protection officer, as the conditions of art. 37 GDPR are not met. For any request regarding your data, write to us at contact@informstudio.ro.
3. What data we process, for what purpose and on what basis
| Purpose | Data | Legal basis |
|---|---|---|
| Replying to messages from the contact form | Name, email, phone (optional), message | Consent, art. 6(1)(a) |
| Sending the newsletter | Consent, art. 6(1)(a) | |
| Booking and managing sessions | Name, contact, booking history | Performance of a contract, art. 6(1)(b) |
| Managing memberships and payments | Identification and billing data | Contract, art. 6(1)(b); legal obligation, art. 6(1)(c) |
| Issuing and keeping invoices | Billing data | Legal obligation (tax), art. 6(1)(c) |
| Adapting exercises to your physical condition, safely | Information about injuries or medical conditions, shared voluntarily | Explicit consent, art. 9(2)(a) (health data) |
| Safety in the 24/7 self-practice space | Video footage (CCTV) | Legitimate interest, art. 6(1)(f) |
| Measuring website traffic | IP, browser type, pages visited (statistics cookies) | Consent, art. 6(1)(a) |
| Defending our rights in a dispute | Relevant data | Legitimate interest, art. 6(1)(f) |
Health data (art. 9): if you tell us about an injury or a medical condition so we can adapt movement safely, we process this data only with your explicit consent, solely for that purpose, and we do not disclose it to third parties.
4. Video surveillance in the self-practice space
The 24/7 self-practice space is monitored by video for the safety of people training without an instructor. Monitored areas are signposted. Footage is kept 30 days and accessed only in case of an incident. Changing rooms and private areas are not monitored.
5. Who we share data with
We do not sell your data. We may share it only with the categories of recipients below, each under a data processing agreement (DPA, art. 28 GDPR):
- The online booking application provider
- The email marketing provider (Brevo)
- The payment processor
- The website hosting provider
- The accounting service, for invoicing
- Public authorities (ANAF, ANSPDCP, courts), on a request provided by law
6. Transfers outside the European Economic Area
If you accept statistics cookies (Google Analytics), some data (online identifiers, anonymised IP) may be transferred to the United States, based on the EU-US Data Privacy Framework and the Standard Contractual Clauses (EU Decision 2021/914); without your consent no such transfer takes place. When marketing tools (Meta) are activated, the same basis would apply. You can request a copy of these clauses by writing to us.
7. How long we keep data
| Data category | Duration |
|---|---|
| Contact form messages | 12 months from receipt |
| Newsletter | Until you unsubscribe |
| Billing data | 10 years (tax obligation) |
| Contractual data (memberships) | 5 years after the collaboration ends |
| Declared health data | While you are a client, then deleted |
| Self-practice CCTV footage | 30 days |
| Traffic statistics data | Up to 26 months |
8. Your rights
Under the GDPR, you have the right: of access (art. 15), to rectification (art. 16), to erasure (art. 17), to restriction (art. 18), to portability (art. 20), to object (art. 21, especially to direct marketing), not to be subject to an automated decision (art. 22) and to withdraw your consent at any time, without affecting prior processing.
To exercise your rights, write to us at contact@informstudio.ro. We reply within 30 days at most (extendable by 60 days for complex requests, with notice to you).
9. Complaint to the authority
If your rights are breached, you can lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP), B-dul G-ral Gheorghe Magheru nr. 28-30, Bucharest, anspdcp@dataprotection.ro, dataprotection.ro.
10. Whether providing data is required
Providing contact and billing data is necessary so we can book you and issue your tax documents; without it we cannot provide the service. Providing health information is optional, but it helps us adapt movement safely. We do not make automated decisions that affect you.
11. Cookies
Details about cookies and measurement tools are in our Cookie Policy.
Informational document, first version dated 6 July 2026, updated 13 July 2026 (Google Analytics activation). For any question about this document, write to us at contact@informstudio.ro.