Privacy Policy

Last updated: April 8, 2026

SABDA STUDIO S.L. is committed to protecting the privacy and personal data of users of this website. This Privacy Policy explains how we collect, use, store, and protect your personal data in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, "GDPR") and Spanish Organic Law 3/2018, of 5 December, on Personal Data Protection and Guarantee of Digital Rights ("LOPDGDD").

Data Controller

Company: SABDA STUDIO S.L. Tax ID (CIF): B44704401 Address: Carrer de Muntaner 83B, Local 2, 08011 Barcelona, Spain Email: [email protected]

Personal Data We Collect

Depending on your interaction with the website, we may collect the following categories of personal data:

Identification and contact data: Full name, email address, phone number, postal address, date of birth (for age verification where required).

Booking and transaction data: Class bookings, membership subscriptions, payment information (processed through Stripe — we do not store full card details), billing information, purchase history.

Newsletter subscription data: Email address, first name, language preference.

Corporate and event inquiry data: Name, company, email, phone, event type, capacity requirements, preferred dates, budget information.

Website usage data: IP address, browser type and version, device information, operating system, pages visited, time spent on pages, referral source, approximate geographic location, and other analytics data collected via cookies and similar technologies.

Communication data: Any information you provide when contacting us via email, contact forms, or social media.

Legal Basis and Purpose of Processing

We process your personal data on the following legal bases:

Execution of a contract (Art. 6.1.b GDPR): To process class bookings, manage memberships, process payments, deliver services, and respond to inquiries about our offerings.

Legal obligation (Art. 6.1.c GDPR): To comply with accounting, tax, and consumer protection obligations under Spanish and EU law.

Consent (Art. 6.1.a GDPR): To send newsletters and marketing communications, to install non-essential cookies, and for any additional processing that requires your explicit permission. You may withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

Legitimate interest (Art. 6.1.f GDPR): To improve our website, analyze usage patterns, prevent fraud, ensure security of the site, and pursue our commercial interests in a proportionate manner that does not override your fundamental rights.

Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, including to comply with legal, accounting, or reporting requirements. Specifically:

• Booking and transaction records: Retained for the period required by Spanish tax and commercial law (generally 6 years).
• Newsletter subscription data: Retained until you unsubscribe or request deletion.
• Corporate inquiry data: Retained for up to 2 years after the last meaningful interaction.
• Website analytics data: Retained according to the retention policies of our analytics providers (typically 14 to 26 months).

After the applicable retention period, your data will be securely deleted or anonymized.

Data Sharing and Third Parties

We do not sell, rent, or trade your personal data. We may share your data with the following categories of recipients, always under appropriate data processing agreements and solely for the purposes described in this policy:

Momence, Inc. — Booking platform and class management. Used to process all class reservations, memberships, customer accounts, and related transactions. Data transferred: name, email, booking details, transaction data. Momence processes data in the United States under Standard Contractual Clauses.

Stripe Payments Europe, Ltd. — Payment processing. Used to securely process credit and debit card payments. We do not store full payment card details; these are handled directly by Stripe. Stripe may process data outside the EEA under Standard Contractual Clauses.

Google LLC (Google Analytics 4, Google Maps) — Website analytics and map display. Used to understand how visitors use our site and to display our location. Data transferred: IP address (anonymized where possible), device information, browsing behavior, approximate location. Google may process data in the United States under Standard Contractual Clauses and the EU-US Data Privacy Framework.

Meta Platforms, Inc. (Meta Pixel) — Advertising analytics and retargeting. Used to measure ad effectiveness and deliver relevant advertising. Data transferred: page views, conversion events, hashed identifiers. Meta processes data in the United States under the EU-US Data Privacy Framework.

Mailchimp (The Rocket Science Group LLC) — Email marketing and newsletter distribution. Data transferred: name, email, subscription preferences. Mailchimp processes data in the United States under Standard Contractual Clauses.

Public authorities: Where required by law, court order, or legitimate government request.

International transfers outside the European Economic Area are carried out with appropriate safeguards as required by Chapter V of the GDPR.

Your Rights

Under the GDPR and LOPDGDD, you have the following rights regarding your personal data:

• Right of access — to obtain confirmation of whether we process your data and a copy of it.
• Right of rectification — to correct inaccurate or incomplete data.
• Right of erasure ("right to be forgotten") — to request deletion of your data under certain circumstances.
• Right to restriction of processing — to limit how we use your data in specific situations.
• Right to data portability — to receive your data in a structured, commonly used format.
• Right to object — to processing based on legitimate interests or direct marketing.
• Right to withdraw consent — at any time, without affecting prior lawful processing.
• Right not to be subject to automated decision-making — including profiling, where it produces legal effects.

To exercise any of these rights, please contact us at [email protected], including a copy of your ID or equivalent identification document to verify your identity.

If you believe your rights have been violated or your data has been handled unlawfully, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos — AEPD), located at C/ Jorge Juan 6, 28001 Madrid, or online at www.aepd.es.

Security Measures

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, accidental loss, alteration, disclosure, or destruction. These measures include encryption of data in transit (HTTPS), access controls, regular security audits, and staff training on data protection.

However, no method of transmission over the internet or electronic storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

Minors

This website is not directed at persons under the age of 14. We do not knowingly collect personal data from minors under 14. If you become aware that a minor has provided us with personal data without parental consent, please contact us immediately and we will take steps to delete such information.

For users between 14 and 18 years of age, parental or guardian consent may be required for certain services.

Cookies

This website uses cookies and similar tracking technologies. For detailed information about the cookies we use and how to manage your preferences, please refer to our Cookie Policy.

Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or service offerings. We will notify you of significant changes by posting the updated policy on this page and updating the "Last updated" date. We encourage you to review this policy regularly.

Contact

For any questions about this Privacy Policy or to exercise your data protection rights, please contact:

SABDA STUDIO S.L. Carrer de Muntaner 83B, Local 2, 08011 Barcelona, Spain Email: [email protected]