Privacy Policy

This privacy policy clarifies the nature, scope and purpose of the processing of personal data (hereinafter referred to as "data") within our online offer and the associated websites, functions and content as well as external online presences, such as our social media profile.

With regard to the terms used, such as "processing" or "responsible party", we refer to the definitions in Sec. 15 and, in addition, Art. 4 of the General Data Protection Regulation (GDPR).

1. Responsible party

The responsible party for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

House of Gravity GmbH
Jutastraße 5
80636 München
Deutschland

T: +49 172 852 887 2
M: info@houseofgravity.de

Represented by the management: Lilian Jill Heins and Nathalie Brychcy

2. Purposes of the processing

2.1 When visiting the website

When you visit our website, information is automatically sent from your browser to the server of our website. This information is stored in a log, the log file. The following information is collected and stored until automated deletion:

1. IP address of the requesting computer
2. Date and time of access
3. Name and URL of the retrieved file, and
4. Website from which access is made (referrer URL),
5. Browser used and, if applicable, the operating system of your computer as well as the name of your access provider.

The aforementioned data are processed for the following legitimate interests in accordance with Art. 6 para. 1 subpara. 1 lit. f GDPR (purpose):

1. Ensuring a smooth connection to the website,
2. Ensuring a comfortable use of our website, and
3. Evaluation of system security and stability.

The storage period of the log files is ≤ 14 days.

2.2 Contacting us by e-mail or via contact form

If you contact us by e-mail or via our form, your personal data transmitted to us will be processed exclusively for the purpose of answering your request. The legal basis for the processing of the data is our legitimate interest in answering your request in accordance with Art. 6 para. 1 subpara. 1 lit. f GDPR. Your data will be deleted after your request has been processed, provided that there are no statutory retention obligations to the contrary.

If your contact is aimed at concluding a contract with us, the legal basis for the processing is Art. 6 para. 1 subpara. 1 lit. b GDPR. The duration of the processing is based on the legal provisions of the German Commercial Code (HGB) and the German Fiscal Code.

2.3 Online presence in social media

We maintain online presences within social networks and platforms in order to be able to communicate with customers, interested parties and users active there and to inform them about our services. When accessing the respective networks and platforms, the terms and conditions and the data processing guidelines of their respective operators apply.

Unless otherwise stated in our privacy policy, we process the data of users if they communicate with us within the social networks and platforms, e.g. write posts on our online presences or send us messages.

2.4 Instagram

Within our online offering, functions and content of the Instagram service can be integrated, offered by Instagram Inc., 1601 Willow Road, Menlo Park, CA, 94025, USA. This may include, for example, content such as images, videos or text and buttons that allow users to express their liking for the content, subscribe to the author of the content or to our posts.

If the users are members of the Instagram platform, Instagram can assign the access to the above-mentioned content and functions to the users' profiles there. Instagram's privacy policy: http://instagram.com/about/legal/privacy/.

2.5 Recipients of your data

In addition to us, House of Gravity GmbH, the recipients of your data may be the web and mail hosters commissioned by us as well as our booking software MINDBODY, Inc. ("MINDBODY"). We have concluded corresponding contracts for order processing with these companies.

3. Using the MINDBODY Website Template and Online Booking

For our website, we use a website template and the booking software "MINDBODY" from MINDBODY. MINDBODY technically provides the website and, in particular, the booking interface and related features.

If you book classes or create a client account through our website, the information you provide (e.g., name, address, contact information, booking and payment information) will be transferred to MINDBODY and processed on our behalf in order to process course/appointment bookings and contractual relationships with you.

We and MINDBODY have a contract for order processing in accordance with Art. 28 GDPR, which regulates in particular security measures, rights to issue instructions and data deletion.

MINDBODY may use servers outside the EU/EEA to provide services, with appropriate safeguards for an adequate level of data protection (e.g., EU Standard Contractual Clauses, certifications). For details on data processing by MINDBODY, please refer to MINDBODY's Privacy Policy: https://www.mindbodyonline.com/company/legal/privacy-policy

The legal basis for the use of MINDBODY and the associated data processing is the implementation of pre-contractual measures and the performance of the contract with you (Art. 6 para. 1 lit. b GDPR), where applicable, our legitimate interests in efficient studio management (Art. 6 para. 1 lit. f GDPR).

4. Contacting us

If you contact us via contact form, e-mail or telephone enquiry, we will process the data you provide in order to respond to your enquiry.

The legal basis is our legitimate interest in effective communication with interested parties and customers (Art. 6 para. 1 lit. f GDPR), if necessary the implementation of pre-contractual measures (Art. 6 para. 1 lit. b GDPR).

5. Course/Membership Management and Payment Processing

For ongoing course participation, memberships and payment processing, we process the personal data required for this purpose (master data, contract data, payment data) in our systems and via MINDBODY.

The processing is carried out for the fulfilment of the contractual relationship (Art. 6 para. 1 lit. b GDPR) and for the fulfilment of statutory retention obligations (Art. 6 para. 1 lit. c GDPR, e.g. tax law requirements).

We may use external payment service providers (e.g. credit card providers, payment platforms); they will receive the necessary data for the execution of the payment. The legal basis is again Art. 6 (1) (b) GDPR.

6. Newsletter and Marketing

If you have consented to receive our newsletter, we will use your e-mail address to send you information about our courses, offers and studio news.

The legal basis is your consent (Art. 6 para. 1 lit. a GDPR). You can revoke your consent at any time with effect for the future, e.g. via the unsubscribe link in the newsletter or by sending us a message.

For newsletters sent via MINDBODY, as a data processor, we also refer to the data protection notices there.

7. Cookies and similar technologies

Our website uses cookies and similar technologies to provide certain functions (e.g. login, shopping cart/booking process) and – if used – to measure reach or analyze user behavior.

Technically necessary cookies are used on the basis of Art. 6 para. 1 lit. f GDPR (legitimate interest in a functional online offer). For optional cookies (e.g. statistical or marketing cookies), we obtain your consent in advance via a cookie banner (Art. 6 para. 1 lit. a GDPR).

Details on the type, purpose and storage period of the cookies used can be displayed in the cookie banner or in a separate cookie overview. MINDBODY's cookie mechanisms are covered; in addition, we refer to MINDBODY's cookie policy.

8. Analysis Tools

There are currently no analysis tools used on our website.

9. Storage period

We only store personal data for as long as is necessary for the respective purposes or as provided for by statutory retention obligations (e.g. commercial and tax obligations of up to ten years for certain documents).

After the purposes have ceased to exist and the deadlines have expired, the data will be deleted or anonymised.

10. Disclosure of data / recipients

In addition to MINDBODY and the hosting provider, we only share personal data with third parties if this is necessary for the performance of the contract (e.g. payment service provider), if we are legally obliged to do so, or if you have consented to it.

11. Your rights as a data subject

You have the following rights vis-à-vis us in relation to personal data concerning you:

1. Right to information
2. Right to rectification
3. Right to erasure ("right to be forgotten")
4. Right to restriction of processing
5. Right to data portability and
6. Right to object to certain processing.

You also have the right to revoke any consent you have given us at any time with effect for the future.

To exercise your rights, you can contact us at any time using the contact details provided in section 1 of this Privacy Policy.

12. Data protection information in the application process

We process the applicant data only for the purpose and within the framework of the application process in accordance with the legal requirements. The processing of applicant data is carried out in order to fulfil our (pre-)contractual obligations in the context of the application process within the meaning of Art. 6 (1) (b) GDPR, Art. 6 (1) (f) GDPR, if the data processing becomes necessary for us, e.g. in the context of legal proceedings (in Germany, § 26 BDSG also applies).

The application process requires applicants to provide us with the applicant data. If we offer an online form, the necessary applicant data is marked, otherwise results from the job descriptions and basically includes personal information, postal and contact addresses and the documents belonging to the application, such as cover letter, CV and certificates. In addition, applicants can voluntarily provide us with additional information.

By submitting the application to us, applicants agree to the processing of their data for the purposes of the application process in accordance with the nature and scope set out in this privacy policy.

To the extent that special categories of personal data within the meaning of Art. 9 (1) GDPR are voluntarily communicated in the course of the application process, their processing is also carried out in accordance with Art. 9 (2) (b) GDPR (e.g. health data, such as severely disabled status or ethnic origin). Insofar as special categories of personal data within the meaning of Art. 9 (1) GDPR are requested from applicants in the context of the application process, their processing is also carried out in accordance with Art. 9 (2) (a) GDPR (e.g. health data, if this is necessary for the exercise of the profession).

If provided, applicants can submit their applications to us using an online form on our website. The data is transmitted to us in encrypted form in accordance with the state of the art.

Applicants can also send us their applications via e-mail. However, please note that e-mails are generally not sent in encrypted form and that applicants must ensure encryption themselves. We can therefore not assume any responsibility for the transmission method of the application between the sender and the receipt on our server and therefore recommend using an online form or postal delivery. Instead of applying via the online form and e-mail, applicants still have the option of sending us the application by post.

In addition, applicants can send us their application via Instagram. In addition to our privacy policy, we refer to Instagram's.

In the event of a successful application, the data provided by the applicants may be further processed by us for the purposes of the employment relationship. Otherwise, if the application for a job offer is not successful, the applicant's data will be deleted. Candidates' data will also be deleted when an application is withdrawn, which applicants are entitled to do at any time.

Subject to a justified revocation by the applicants, the deletion will take place after a period of six months so that we can answer any follow-up questions about the application and meet our obligations to provide evidence under the Equal Treatment Act. Invoices for any reimbursement of travel expenses are archived in accordance with tax regulations.

13. Right to lodge a complaint with the supervisory authority

You have the right to complain to a data protection supervisory authority if you believe that the processing of your personal data infringes the GDPR. In particular, the supervisory authority of your habitual place of residence, your place of work or the place of the alleged infringement is responsible.

For Bavaria:
Bayerisches Landesamt für Datenschutzaufsicht (BayLDA)
Promenade 18
91522 Ansbach
Deutschland

14. Up-to-dateness of this privacy policy

We reserve the right to amend this privacy policy if our data processing or the legal framework changes. The current version published on this page always applies.

15. Terms used

"Personal data" means any information relating to an identified or identifiable natural person (hereinafter "data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier (e.g. a cookie) or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

"Processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means. The term is far-reaching and encompasses practically any handling of data.

"Responsible party" means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.