PRIVACY POLICY
Laura Gabriella Pilates
Website, Streaming Platform and Services
Version 13 June 2026
This Privacy Policy informs you about how Laura Gabriella Celle (“Laura”, “we”, “us”) processes and protects the personal data of users who visit our Website, streaming platform, and/or Instagram account identified below (the “Platform”) including to access Pilates-based content, private or group lessons, and the online video library (the “Services”).
We comply with applicable data protection laws, in particular:
• Regulation (EU) 2016/679 of 27 April 2016 (General Data Protection Regulation, “GDPR”).
• Organic Law 3/2018, of 5 December, on the Protection of Personal Data and Guarantee of Digital Rights (“LOPDGDD”).
• Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce (“LSSICE”), in so far as it applies to personal data collected through electronic communications.
Use of the Platform constitutes acceptance of this Privacy Policy, as well as the Terms and Conditions and the Legal Notice.
Data Controller: Laura Gabriella Celle
Tax ID (NIF): X5595690C
Address: Seville, Spain
Website: www.lauragabriella.es
Streaming Platform: https://laurasmembership-e4e6.uscreen.io/
Instagram: lauragabriella_pilatesmovement
Contact email: youmovepilates@gmail.com
When we process your personal data, we observe the following principles set out in Article 5 GDPR:
• Lawfulness, fairness and transparency: we process your data only where we have a valid legal basis, and we provide clear information about that processing.
• Purpose limitation: we collect your data for specified, explicit and legitimate purposes and do not process it in a manner incompatible with those purposes.
• Data minimisation: we request only the data that is strictly necessary for the purposes described in this Policy.
• Accuracy: we take reasonable steps to ensure that the data we hold is accurate and, where necessary, kept up to date.
• Storage limitation: we retain your data only for as long as necessary for the relevant purposes or to comply with legal obligations. When we are required to erase or rectify data, we apply the ‘blocking’ procedure described in Section 10.
• Integrity and confidentiality: we process your data in a way that ensures appropriate security and confidentiality, using technical and organisational measures proportionate to the risk.
• Accountability: we are responsible for, and can demonstrate compliance with, the above principles.
You do not need to provide personal data simply to browse our Platform. However, certain data must be provided to create an account, access certain content, book a lesson, or contact us.
We may process the following categories of personal data:
Name, surname, email address, postal address, country, telephone number, and any other details you provide through forms, your account, or direct communications with us (including by email, WhatsApp or similar messaging services).
Username, password (stored in encrypted form), subscription type, services purchased, invoices, billing history, and payment status.
Limited billing information (for example, the last four digits of your card and its expiry date) as necessary to identify and manage transactions. Full card data is handled exclusively by our payment service providers; we do not store your complete card details.
IP address, browser type, device type, operating system, Internet service provider, entry and exit pages, date and time of access, approximate location based on IP, and information about how you interact with the Platform, including pages visited and features used.
The content of communications you send to us by email, WhatsApp, telephone or any other channel, to the extent necessary to respond to and manage those communications.
Where you voluntarily provide information about your physical condition, injuries, medical history, pregnancy, or similar matters, this constitutes health data within the meaning of Article 9 GDPR and is subject to heightened protection. See Section 5 below for the specific legal basis on which we process this data.
We do not collect health data through ordinary account registration forms. We encourage you not to include health information in free-text fields beyond what you consider strictly necessary for us to provide the Services safely.
Information collected through cookies and similar technologies, as described in our Cookie Policy.
We obtain your personal data directly from you when you:
• Create an account or register on the Platform.
• Purchase a subscription, pay-per-view access, or other Services.
• Book a private or group lesson.
• Complete the Health and Activity Acknowledgement.
• Contact us by email, WhatsApp, telephone or through forms on the Platform.
• Update your profile or account settings.
• Subscribe to our mailing list or consent to receive marketing communications.
• Post content in any community or interactive area of the Platform.
We also obtain data automatically when you browse the Platform through cookies, server logs and similar technologies (see Section 6 and the Cookie Policy).
All personal data is stored on servers located in Spain or in the European Economic Area, or in countries that benefit from an adequacy decision of the European Commission, or that are subject to other appropriate safeguards as described in Section 9.
We process your personal data for the following purposes and on the following legal bases under the GDPR:
To register you as a user, manage your account, provide access to the Platform and Pilates content, process purchases and payments, manage lesson bookings, and offer customer support.
Legal basis: Performance of a contract or steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR).
Where you provide information about your physical condition, injuries, medical history, pregnancy, or similar matters, we process the health-related information you provide in order to: (a) understand any limitations that may affect the safe delivery of the Services to you; (b) maintain a record of your acceptance of the relevant risks; and (c) protect the health and safety of all parties.
Legal basis: Your explicit consent (Article 9(2)(a) GDPR), given when you accept the Health and Activity Acknowledgement; and, where applicable, the defence of legal claims (Article 9(2)(f) GDPR). You may withdraw your consent at any time, but withdrawal may mean we are unable to continue providing certain Services to you.
We do not use health data for any purpose other than those described above and we do not share it with third parties except where strictly required by law.
To send you service messages, including welcome emails, confirmations of registration or purchase, booking confirmations, technical notices, security alerts, and notifications of changes to our Terms and Conditions, Privacy Policy or Services.
Legal basis: Performance of a contract and our legitimate interest in keeping you informed about your account and the Services (Articles 6(1)(b) and 6(1)(f) GDPR).
To analyse how users interact with the Platform, including aggregated information about visits, navigation patterns and use of features, in order to improve our content, functionality and security.
Legal basis: Our legitimate interest in maintaining and improving the Services (Article 6(1)(f) GDPR), and, where cookies or similar technologies require it by law, your consent.
To send you information about features, content, services, news or promotions related to the Platform and our Services.
Legal basis: Your consent (Article 6(1)(a) GDPR) when you sign up to receive marketing emails or messages; or our legitimate interest in promoting the Services to existing customers (Article 6(1)(f) GDPR), subject to your right to object at any time. You may opt out at any time using the unsubscribe link in our emails or by contacting us.
To comply with tax, accounting, consumer protection and other legal obligations, and to respond to lawful requests from public authorities.
Legal basis: Compliance with a legal obligation (Article 6(1)(c) GDPR).
To ensure compliance with our Legal Notice and Terms and Conditions, prevent fraud, misuse or abuse of the Services, and protect our rights, property and safety and those of our users.
Legal basis: Our legitimate interest in protecting the Services and enforcing our rights (Article 6(1)(f) GDPR).
When you register for an account, purchase the Services or book a lesson, your contact details may be used to send you:
• Welcome messages and account information.
• Transactional messages related to your account, purchases or lesson bookings.
• Service notifications, security alerts and updates to our policies.
• Information about new content, features or Services (where you have consented to marketing communications).
Where you contact us by WhatsApp, telephone or other messaging services, we will process your contact details and the content of those communications in order to respond to you and, where relevant, to manage any booking or service request. Please note that these communications may not be encrypted end-to-end from our side and we therefore encourage you not to send sensitive information through those channels where it can be avoided.
You can unsubscribe from marketing communications at any time using the unsubscribe link included in emails or by contacting us at youmovepilates@gmail.com. You will continue to receive essential service communications even if you opt out of marketing.
We do not sell or rent your personal data to third parties. We may share data only in the following circumstances:
With third-party providers who help us operate the Platform and deliver the Services. These may include hosting and infrastructure providers, payment processors, email delivery services, analytics providers, booking or scheduling tools, and video streaming infrastructure. These providers act as processors under Article 28 GDPR and are subject to written data processing agreements that require them to maintain appropriate confidentiality and security standards and to process data only on our instructions.
Where we work with other instructors or professionals in connection with the Services, and that collaboration requires access to personal data (for example, contact details necessary to coordinate a booking), we will inform you of the identity of the collaborator and the purpose of the collaboration before sharing your data, unless an exception applies under applicable law.
With public authorities, courts, or law enforcement bodies when required by applicable law, judicial order, or where necessary to protect our rights, the safety of users, or those of third parties.
In the event of a merger, acquisition, or transfer of all or part of our business or assets, personal data may be transferred as part of the transaction. We will notify you if such a transfer takes place and ensure that it is carried out in accordance with applicable law and with appropriate safeguards.
In any other circumstances with your prior express consent, which you may withdraw at any time.
Our primary storage and processing takes place in Spain and within the European Economic Area (EEA). Where we engage service providers or use tools that involve transferring personal data outside the EEA, we ensure that any such transfer is subject to an appropriate safeguard under Chapter V GDPR, which may include:
• An adequacy decision adopted by the European Commission in respect of the recipient country (for example, the EU-US Data Privacy Framework for transfers to participating US companies, or adequacy decisions for the UK, Japan, and certain other countries).
• Standard Contractual Clauses (SCCs) as approved by the European Commission.
• Binding Corporate Rules (BCRs) or other appropriate safeguards permitted under the GDPR.
Please not hesitate to contact us with any questions or concerns at youmovepilates@gmail.com.
We retain your personal data only for as long as necessary for the purposes described in this Policy, or for the period required by applicable law. Our general retention approach is as follows:
• Account and transactional data: for the duration of your contractual relationship with us, and thereafter for the limitation periods applicable under Spanish tax, accounting and consumer protection legislation (generally four years for tax obligations under the Ley General Tributaria, and the applicable civil prescription periods for contractual claims).
• Health and activity data: for the duration of your use of the Services and for the period thereafter during which claims relating to personal injury or the Services could be brought under applicable law.
• Usage and analytics data: for a limited period necessary to produce aggregated statistics and improve the Services, after which it is deleted or anonymised.
• Marketing data: until you withdraw your consent or object to the processing, after which we will cease using it for marketing purposes (though we may retain a record of the opt-out itself for compliance purposes).
• Data linked to legal obligations or disputes: for as long as necessary to comply with such obligations or to defend against possible claims, including for the applicable statutory limitation periods.
Under Article 32 of the LOPDGDD, when we are required to rectify or erase personal data (for example, following the exercise of your right to erasure or rectification), we do not simply delete the data immediately. Instead, we ‘block’ it: we restrict access to it so that it cannot be used for ordinary operational purposes, but we retain it in a protected state until the expiry of any limitation periods during which it might be required to defend against legal claims or comply with legal obligations. Once those periods expire, we destroy the data.
This means that if you request erasure and we are required to block rather than immediately delete your data, we will inform you of this and of the expected blocking period.
The Platform and the Services are intended for users who are at least 18 years of age. We do not knowingly process the personal data of children for the purpose of providing the Services without parental consent.
If you are a parent or guardian and you believe that your child under the age of 14 has provided personal data to us without your consent, please contact us at youmovepilates@gmail.com and we will take appropriate steps to delete that data.
Under the GDPR and the LOPDGDD, you have the following rights in relation to your personal data. These rights are sometimes referred to by the Spanish acronym “ARSOPOL”:
• Access (A): to obtain confirmation of whether we are processing your personal data and, if so, to access a copy of it.
• Rectification (R): to request correction of inaccurate or incomplete data.
• Erasure / Suppression (S): to request deletion of your data when it is no longer necessary for the purposes for which it was collected, when you withdraw consent, or in other circumstances provided by law. See Section 10 regarding the blocking duty that may apply.
• Opposition / Objection (O): to object to the processing of your data on grounds relating to your particular situation, where the processing is based on our legitimate interests; and to object at any time to the processing of your data for direct marketing purposes.
• Portability (P): where technically feasible and legally applicable, to receive your data in a structured, commonly used, machine-readable format and to transmit it to another controller.
• Limitation / Restriction (L): to request that we restrict the processing of your data in certain circumstances (for example, while the accuracy of data is contested, or where you have objected to processing pending verification of our legitimate grounds).
• Withdrawal of consent: where processing is based on your consent, to withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, please send a written request to: youmovepilates@gmail.com
We may ask you to provide a copy of your National Identity Document (DNI) or equivalent identification document in order to verify your identity before processing your request. We will respond within one month of receipt of your request, extendable by a further two months where the request is complex or burdensome.
The exercise of these rights does not affect any data we must retain in order to comply with legal, administrative or security obligations, or any data subject to the blocking duty described in Section 10.
If you believe that the processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD):
Website: www.aepd.es
Address: C/ Jorge Juan, 6, 28001 Madrid, Spain
Telephone: +34 901 100 099 / +34 912 663 517
You may also contact any other competent supervisory authority in the EU member state of your habitual residence, place of work, or the place of the alleged infringement.
We would, however, appreciate the opportunity to address your concerns before you contact the AEPD. Please contact us first at youmovepilates@gmail.com.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the AEPD without undue delay and, in any event, within 72 hours of becoming aware of the breach, in accordance with Article 33 GDPR.
Where a breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, in accordance with Article 34 GDPR, describing the nature of the breach, the likely consequences, and the measures we have taken or propose to take to address it.
We maintain a register of data breaches, including those that do not require notification to the AEPD, in order to comply with our accountability obligations under Article 5(2) GDPR.
You are responsible for ensuring that the personal data you provide to us is correct, complete and up to date, and for informing us of any changes. We cannot be held responsible for any consequences arising from inaccurate, incomplete or outdated data that you have provided.
You may review, update or correct your personal data at any time by contacting us at youmovepilates@gmail.com.
We implement reasonable technical and organisational security measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures are proportionate to the nature and sensitivity of the data we process and the risks involved.
However, no system is completely secure. We cannot guarantee that our measures will prevent all unauthorised access or misuse. You are responsible for maintaining the confidentiality of your login credentials and for using a strong password on your account.
If you suspect any unauthorised access to your account, please notify us immediately at youmovepilates@gmail.com.
Pages on the Platform may include embedded content (for example, videos, images, or articles) from other websites, or links to third-party platforms (for example, social networks, payment processors or booking tools). Embedded content from other websites behaves as if you had visited those sites directly and may set their own cookies, collect data about you and monitor your interaction with that content.
We are not responsible for the personal data practices of third-party websites. We recommend that you review (preferably with qualified legal counsel) the privacy policies of any third-party sites you visit through our Platform.
If you have a complaint or concern about our processing of your personal data, please contact us in the first instance at youmovepilates@gmail.com. We will try to resolve your concern as promptly as possible.
If your concern is not resolved to your satisfaction, you have the right to lodge a complaint with the AEPD (see Section 12) or with the competent supervisory authority in your country of residence.
For any dispute arising out of or in connection with this Privacy Policy that is not a data protection complaint, the parties agree to attempt in good faith to resolve the matter through appropriate out-of-court dispute resolution (MASC) before commencing court proceedings, in accordance with Organic Law 1/2025. See the Terms and Conditions for further details.
This Privacy Policy is published in English and in Spanish. Both versions are intended to have the same meaning and have been reviewed to ensure legal equivalence. In the event of any apparent inconsistency between the two versions, please contact us at youmovepilates@gmail.com so that the discrepancy can be clarified and, where necessary, corrected. Neither version takes precedence over the other.
We may update this Privacy Policy from time to time to reflect changes in applicable law, in the Services, or in our internal practices. The updated version will be published on this page with the date of the latest revision indicated at the top.
Where changes are material, we will notify you by email or through a prominent notice on the Platform before the changes take effect, giving you reasonable time to review them. Your continued use of the Platform after that date will constitute acceptance of the updated Policy.
We recommend that you review this Policy periodically. Previous versions are available on request.
For any questions about this Privacy Policy or about the processing of your personal data, please contact Laura at youmovepilates@gmail.com.
© Laura Gabriella Pilates. This Privacy Policy is governed by Spanish law and EU data protection legislation.