Privacy & cookies

1. Who is responsible

Reformer Sessions FlexCo, Weintraubengasse 9/top 1-2, 1020 Vienna, Austria, is responsible for the processing described here. Contact us at hello@reformersessions.at or +43 664 542 82 88.

External providers also process data under their own responsibility for certain services. Their notices are linked below.

2. Visiting the website and hosting

The public website at reformersessions.at uses Websupport hosting. The hosting provider receives technical request data, which can include your IP address, request time, requested page, response status and browser or device information.

These data enable delivery, troubleshooting and protection against misuse. Our legal basis is our legitimate interest in operating a reliable, secure website under Article 6(1)(f) GDPR. Technical logs are retained only as needed for these purposes, investigation of an incident or applicable legal obligations. The precise retention depends on the hosting configuration.

Website fonts, photographs and static map images are served with the website. Our own website code does not include analytics or advertising trackers. External services can use their own technologies when loaded. See Websupport.

3. Your cookie and embed choices

Our consent tool stores your choice in your browser using local storage under rs-consent-v1. It records the consent version, date and time, and your separate Eversports and Instagram selections. The choice is valid for 180 days. Invalid or expired entries are not accepted and are removed when the preference is next read, where browser storage is available. This necessary storage lets us respect your choices, based on our legitimate interest under Article 6(1)(f) GDPR.

Eversports and Instagram embeds, including the newsletter form, remain disabled until you enable the relevant service. Loading them relies on your consent under Article 6(1)(a) GDPR. Enabling Eversports does not subscribe you to marketing emails. Direct links remain available without enabling an embed.

Use Cookie settings to change or withdraw your choice. Withdrawal reloads the page to unload embedded services and is also applied in other open tabs of this website. It does not undo earlier lawful processing or automatically delete data held by a provider. If your browser cannot save a choice, optional content stays blocked; a necessary-only setting in the page address keeps it blocked during navigation. Closing the preferences without saving grants no new permissions.

For storage on or access to your device, section 165(3) of the Austrian Telecommunications Act 2021 (TKG) also applies. The necessary preference storage is used to provide the privacy choices you request. Optional storage and access require your prior consent.

Analytics and marketing

Google Analytics. If you consent to the “Analytics” category, we load Google Analytics (Measurement ID G-25SWFPTEXZ) to understand use of our website. It is not loaded before your consent.

Meta Pixel. If you consent to the “Marketing” category, we load the Meta Pixel (Pixel ID 1398037355644009). This allows us to measure page views and assess advertising effectiveness. The Meta Pixel is not loaded before your consent.

The legal basis for these optional services is your consent under Article 6(1)(a) GDPR and, where information is stored on or accessed from your device, section 165(3) Austrian TKG 2021. You can withdraw consent at any time through “Cookie settings”. These services may involve processing or transfers of personal data outside the EEA, including to the United States. Further information is available in Google’s and Meta’s privacy notices.

4. Contacting us

If you contact us by email or telephone, we process the contact details and information you provide to handle your enquiry. The legal basis is Article 6(1)(b) GDPR for enquiries about a contract or booking, and Article 6(1)(f) GDPR for our legitimate interest in answering other correspondence. Necessary business records may also be retained under Article 6(1)(c) GDPR. The website does not operate its own contact form.

5. Booking and payments with Eversports

We use Eversports for class bookings, memberships, products and payment checkout. Loading a widget sends technical connection data to Eversports. When you book or purchase, the service processes the details needed for that transaction, including your name, contact details, selected class or product, booking information and payment or transaction information. We receive the information needed to manage your participation, membership and purchase.

Our processing to arrange and fulfil your booking is based on Article 6(1)(b) GDPR. Accounting and other applicable statutory obligations are based on Article 6(1)(c) GDPR. Required details are identified during checkout; without them the requested transaction may not be possible.

Eversport GmbH operates the platform. Its role depends on the activity: it provides tools for our studio administration and also operates its own user accounts and platform services. Payment providers involved in checkout may have their own responsibilities. See the Eversports privacy policy and the information shown during checkout.

We receive booking and membership data from you and through the Eversports booking platform. Payment details accessible to us depend on the payment method and platform permissions.

6. Newsletter

Our Eversports newsletter form collects your first name, last name and email address so we can send studio news, offers and class updates. Subscription is voluntary and based on your consent under Article 6(1)(a) GDPR. Enabling the Eversports embed is separate from subscribing to marketing emails.

The sign-up process asks you to confirm your email subscription by email, known as double opt-in. Subscription and confirmation records help document your choice. You can withdraw at any time using the unsubscribe option in the newsletter or by emailing hello@reformersessions.at. Withdrawal does not affect earlier lawful processing. Necessary evidence of consent or withdrawal may be retained to demonstrate compliance and prevent further unwanted emails, subject to the retention criteria below.

Electronic direct marketing also requires compliance with section 174 TKG 2021. Newsletter consent is voluntary and is not a condition for purchasing classes or memberships.

7. Protection of embedded forms

The Eversports newsletter form has displayed Google reCAPTCHA protection against automated submissions. This protection is integrated by the form provider, rather than by a separate script in our own website code. When used, it can process technical and interaction data to assess whether a request is legitimate. Its precise configuration, storage and processing arrangements depend on the provider integration.

Consult the Eversports notice and Google's current reCAPTCHA information. You can contact us by email if you prefer not to use the embedded form.

8. Instagram videos

Instagram videos are loaded only after you enable Instagram in Cookie settings. Meta then receives technical information such as your IP address and browser details and may use cookies or similar technologies. If you are signed in to Instagram, Meta may associate your interaction with your account. Our use of this optional embed is based on your consent under Article 6(1)(a) GDPR. You can instead use the direct Instagram link. See the Meta privacy policy.

9. WhatsApp, maps and other links

WhatsApp, Google Maps, social profiles and other external services are linked from our pages. These links are not embedded chat or map services. Following a link opens the provider's service, where its own privacy information applies and it can receive technical data from your browser. If you contact us through WhatsApp, we also receive the message and contact information you share. Email and telephone are available as alternatives.

10. Recipients and international processing

Data may be accessible to the hosting and communication providers needed to operate the website and answer you, to Eversports and the payment services needed for your transaction, and to professional advisers or public authorities where required. Optional providers receive data when you enable or visit their services.

Some providers may process data outside the European Economic Area. Their current notices explain the locations and safeguards applicable to their services, such as adequacy decisions or standard contractual clauses. Contact us for information about the arrangements relevant to our processing. Enabling an embed does not replace any legally required transfer safeguard.

11. How long data are kept

We retain data for the purpose for which they were collected and then delete or anonymise them unless a further lawful reason requires retention. Relevant criteria include whether an enquiry is resolved, whether a booking or membership is active, whether newsletter consent continues, applicable accounting and tax obligations, and the need to establish or defend legal claims. Access to records kept solely for legal obligations or claims is limited accordingly. Providers may apply separate periods for processing under their own responsibility.

Accounting records and tax-relevant supporting documents are generally retained for seven years under section 132 BAO, calculated from the end of the relevant calendar year. Pending proceedings or other applicable obligations can require longer retention. This does not mean that all website, enquiry or newsletter data are kept for seven years.

12. Your rights

Subject to the conditions of the GDPR, you can request access, rectification, erasure, restriction and data portability. You can object to processing based on legitimate interests for reasons relating to your situation. You can object to direct marketing at any time without giving a reason. Consent can be withdrawn at any time with effect for the future.

Contact hello@reformersessions.at to exercise your rights. You may complain to a competent supervisory authority, including the Austrian Data Protection Authority. Our website code does not implement decisions based solely on automated processing that produce legal or similarly significant effects. This notice may be updated when our services or processing change.

You can contact the Austrian Data Protection Authority at Barichgasse 40–42, 1030 Vienna, Austria, or dsb@dsb.gv.at.