Privacy and Cookie Policy
Version: 1.4 · Effective date: 20 September 2026 · Last updated: 1 November 2026 (sign-in to “My account” with email and password, class reminders and weekly timetable summary).
This policy describes with full transparency how your personal data is collected, processed, protected and retained when you request a pre-booking or browse our website, in accordance with the principles of the Swiss Federal Act on Data Protection (FADP / revFADP) and following the information guidelines of the Swiss Federal Data Protection and Information Commissioner (FDPIC / EDÖB).
1. Data Controller
The controller of the data collected on this website is:
- Controller: Grecia Suárez.
- Trade name and brand: Grecia Suárez (@GRECIASUAREZ).
- Address and location of the studio: Zurich, Switzerland.
- Contact email and exercise of rights: greciavsp@studio99gs.com.
- Official contact channels: Email (greciavsp@studio99gs.com), the studio’s official WhatsApp and Instagram profile (@greciasuarez).
2. Personal Data Collected
In line with the principle of data minimisation (Art. 6 FADP), we only collect the information strictly required to provide the requested service:
Identification and contact data
- Full first name and last name(s).
- Email address.
- Phone number with international code (coordination by phone call or WhatsApp).
Service and attendance data
- Discipline selected (individual Barre or group Mobility Flow).
- Format (in person at the studio or live online).
- Price or pack purchased, in CHF.
- Date, time and status of the booking.
- Class attendance history and available credits.
Student account (“My account”)
You need an account to request a pre-booking. In it we keep your first name, your last name(s) and your email address, which you confirm by opening a link that we send you; your password, only transformed in an irreversible way (never the password itself); the language in which we write to you; your email notification preferences; and the dates on which it was created, the email address was confirmed, the password was last changed and the account was last modified. Your phone number is added to your account with your first pre-booking and you can change it in “My account”. When Grecia confirms your first class, the account is joined to your student record (if you already had a record with that same email address, it is joined to it when you confirm your email address). The account does not store health notes.
Sensitive health data (strictly optional)
Information that the student chooses to provide voluntarily about physical discomfort, previous injuries, surgery or pregnancy. Providing this data is not required in order to book. Its sole purpose is to adapt the exercises to your biomechanics.
Browsing data with Google Analytics (only with consent)
Only if you accept analytics cookies does Google Analytics 4 collect how the website is used: pages visited, where you come from (search engine, social network or campaign), type of device and browser, approximate location (country or city, derived from the IP address, which Google Analytics does not store) and the booking form steps you complete (for example, the discipline chosen, never your data). Your browser is recognised by a random identifier stored in a cookie. This data is not linked to your booking or to your name, email or phone number. If you reject analytics, none of this is collected.
Until 27 September 2026, if you accepted measurement, the channel through which you arrived (for example, Instagram or a campaign) was stored together with your pre-booking. Since that date it is no longer stored. If you booked before then, you can ask for that data to be deleted by writing to greciavsp@studio99gs.com.
3. Separate Purposes and Legal Bases
We do not use your data for generic or mixed purposes. Each processing operation has its own separate basis and purpose:
1. Management of the pre-booking and performance of the service (Basis: contractual relationship / performance of the service)
Managing the request for a place in the schedule, coordinating date and time, confirming availability, controlling the maximum safety capacity of the classes and sending strictly necessary transactional communications (pre-booking receipt, confirmation, schedule changes or reminders). It also includes creating and maintaining your student account (“My account”), which you sign in to with your email address and your password, so that you can see your classes and passes and do not have to repeat your details for every pre-booking, as well as the account emails (confirming your email address, creating or changing your password and notifying you of a change). Reminders are only sent for confirmed classes, a few hours before the class, and you can turn them off in “My account” → “Privacy”.
2. Biomechanical and health adaptation of the session (Basis: explicit consent, Art. 6 FADP)
Assessing and adapting the postures, exercises and loads during the session when the student voluntarily shares discomfort or injuries. This processing is based on your express consent through a specific checkbox. If you decide not to share this information or to withdraw your consent, the practice will follow the general guidelines for the level.
3. Website measurement (Basis: consent to analytics cookies)
Finding out how many people visit the website, through which channels they arrive (Instagram, Google, campaigns) and at which step of the form bookings are abandoned, in order to improve the website and the studio’s communication, using Google Analytics 4. It is only activated if you click “Accept analytics” in the cookie notice, and you can withdraw your consent at any time from “Cookie Preferences” in the website footer.
4. Marketing and promotional communications (Basis: express and separate consent)
Sending information about new times, masterclasses, promotions or exclusive content. Separate checkboxes are required for each channel (Email or WhatsApp). If you do not tick them, you will never receive marketing and your phone number will never be reused for marketing purposes. The weekly summary of the timetable with free places has its own consent: you only receive it if you turn it on in “My account” → “Privacy”, you can turn it off there or with the link in each email, and unsubscribing from marketing emails also turns it off.
4. Protected Processing of Health Information
In accordance with Art. 5(c) of the Swiss FADP, data on physical health is classified as particularly protected (sensitive) personal data. We apply the following strict safeguards:
- Strictly restricted access: Only the instructor, Grecia Suárez, has access to the health notes, in order to plan how the class is adapted.
- Hidden in administrative lists: Health data is not shown in the general lists or tables of the administration panel; it can only be viewed by opening the student’s protected record.
- Excluded from ordinary emails: We never include your health notes or injuries in automatic confirmation emails or reminders.
- Fully excluded from analytics: Health information is never sent to Google Analytics or to external measurement systems.
- No substitute for medical judgement: Postural adaptation in Barre and Mobility is of a physical wellbeing and conscious training nature; it never replaces the diagnosis, treatment or supervision of a doctor or registered physiotherapist.
- Right not to provide or to delete: You can book leaving the field completely empty. If you previously provided health notes, you can request their immediate deletion at any time.
5. Recipients of the Data and Transfers Outside Switzerland
We do not sell or transfer your personal data to third parties for their own commercial purposes. To run the boutique studio technically, we use the following verified providers:
| Provider and Service | Purpose | Countries of processing | Applicable safeguards |
|---|---|---|---|
| Google Ireland Ltd. / Google LLC (Firebase Hosting, Google Sheets and Google Apps Script) |
Hosting and delivery of this website (pages, images and fonts, which are served from the website’s own domain, without Google Fonts), the studio’s private database, backend and booking logic. | Switzerland, Ireland (EU) and the United States. | Standard Contractual Clauses (SCCs) and Swiss-U.S. Data Privacy Framework. |
| Cloudflare, Inc. (Turnstile, only on the forms) |
Anti-bot verification of the booking form and of the forms to create an account, sign in to “My account” and recover your password, to curb automated submissions. It only loads when you open those forms. Cloudflare receives technical connection data (IP address, TLS fingerprint, browser and the website of origin) and states that it cannot identify anyone with it; it also uses it, as a controller, to improve its bot detection. | United States and Cloudflare’s global server network. | Swiss-U.S. Data Privacy Framework and Standard Contractual Clauses (SCCs). |
| Google Workspace / Gmail (Gmail of the studio’s account) |
Sending the account emails (confirming your email address, creating or changing your password and change notices), the pre-booking receipt, reminders of confirmed classes and, if you turn it on, the weekly timetable summary. | Switzerland, Ireland (EU) and the United States. | Standard Contractual Clauses (SCCs) and Swiss-U.S. Data Privacy Framework. |
| Google Calendar (Google LLC) | Optional link generated so that the student can add the session to their personal calendar. | Local client / The student’s Google account. | Initiated voluntarily by the user through an external link. |
| Google Analytics 4 (Google Ireland Ltd. / Google LLC) (Only with cookie consent) |
Statistics on the use of the website and the origin of visits, without contact or health data. | Ireland (EU), the United States and other countries where Google has servers. | Google Analytics does not store IP addresses. Google Signals and ad personalisation disabled. Standard Contractual Clauses and Swiss-U.S. Data Privacy Framework. |
6. Information Retention Periods
Personal data is kept only for as long as strictly necessary to fulfil the purpose for which it was collected or to meet legal requirements in Switzerland:
Pre-bookings that are cancelled or not formalised
They are kept for a maximum of 30 days after the scheduled date of the class for operational purposes, after which they are deleted or anonymised.
Booking and class attendance history
It is kept while the student has active passes or classes and, afterwards, for the legally required periods for business records under the Swiss Code of Obligations (Art. 958f CO: up to 10 years). This includes absences and late cancellations that used up a class. The period is counted from the end of the pass to which each class belongs. After that period, contact details and notes are deleted, and the pass and its classes are no longer linked to the student’s record (anonymisation); only the records needed to reconcile balances are kept, without identifying data.
Information on health and discomfort
It is kept for the shortest time necessary. It is deleted 90 days after the end of the last pass or class purchased, unless consent is withdrawn earlier or the student expressly requests its deletion.
Google Analytics data
Browsing data is kept in Google Analytics for 2 months, and data associated with your browser’s identifier for 14 months from your last visit. The _ga cookies expire 13 months after your last visit, or earlier if you withdraw your consent.
Marketing consents
They are kept indefinitely until the student decides to withdraw their consent. Once it is withdrawn, the contact is immediately excluded from future campaigns.
Student account (“My account”)
It is kept for as long as you keep the account: it is not deleted automatically. You can ask us to delete it at any time by writing to greciavsp@studio99gs.com; your bookings and passes follow the periods in this section. If your student record is deleted, the account joined to it is deleted with it. Your transformed password is replaced every time you change it and is deleted with the account. The record of each reminder or summary sent (without the content of the email) is deleted after 60 days.
8. Rights of the Data Subject and How to Exercise Them
Under Arts. 25 to 29 of the Swiss FADP, you have the following rights, which you can exercise free of charge:
- Right of access: To know what personal data we process about you and to obtain a copy of the information.
- Right to rectification: To correct any inaccurate or incomplete data (for example, changes of phone number or email). You can also correct your first name, last name(s) and phone number directly in “My account” → “My profile”.
- Right to erasure / to be forgotten: To request the deletion of your data when it is no longer necessary or when you withdraw your consent.
- Right to withdraw consent: You can withdraw at any time your consent to marketing communications or to the processing of your health data, without affecting the lawfulness of the processing carried out before.
- Right to object: To object to receiving promotional communications. In “My account” → “Privacy” you can turn off class reminders and the weekly summary at any time.
Official channel for exercising your rights
To exercise any of your rights, send an email to greciavsp@studio99gs.com with the subject line "Protección de Datos - Ejercicio de Derechos" (Data Protection - Exercise of Rights), together with your first name, last name(s) and your specific request. We will respond to your request with the utmost diligence and within the legal deadlines set by Swiss regulations (maximum 30 days).
9. Security and Protection of Information
We adopt proportionate organisational and technical measures to protect your personal data against unauthorised access, loss or alteration:
- The Google Sheets database resides in a private spreadsheet with restricted access and no public read or write permissions.
- The administration panel is protected with strong passwords, session authentication with cryptographic tokens (SHA-256) and automatic time-based expiry.
- You sign in to “My account” with your email address and a password of at least 10 characters. The password is never stored or logged as such: it is stored transformed in an irreversible way with PBKDF2-HMAC-SHA256 (600,000 iterations and a random value of its own) and a secret server key that is not in the database, so nobody, not even the studio, can read or recover it.
- The account is only activated once you confirm your email address. The links to confirm it (60 minutes) or to choose a password (30 minutes) can only be used once, failed sign-in attempts are limited, changing your password closes the open sessions and we notify you by email, and the session expires after 6 hours at the most.
- All web communication and form submission takes place over encrypted HTTPS / TLS protocols.
- Formula injection control mechanisms are in place to neutralise problematic characters in the spreadsheets.
Please note that, although we apply rigorous security standards, no digital transmission or storage system is 100% infallible, and it is not possible to guarantee the complete absence of residual risk.
10. Minimum Age and Minors
The services and bookings of our studio are aimed at people with legal capacity and sufficient discernment to give valid consent under the applicable Swiss legislation. In the case of minors or persons under parental authority or guardianship who do not have such independent capacity, booking or attending the sessions will require the prior and express authorisation or involvement of their parents or legal representatives.