Privacy policy

The data controller is SYN Studio (ΑΦΜ 160478360, ΔΟΥ Περιστερίου), Karaiskaki 9, Peristeri 121 31, Greece. For anything about your data, email info@synstudio.gr or call 21 0574 3099.

• Your account: name, email address and password (stored only in encrypted, hashed form). If you sign in with Google, we receive your name, email and profile photo from Google.
• Your preferences: language, newsletter choice, whether you appear on the studio board, and the disciplines you practise.
• Your practice: classes you book, cancel or wait for, attendance, and the points, streaks and badges that come from it.
• Personal training requests: the discipline, goals, preferred times, experience, your phone number and any notes you add. Notes may include health information, such as an injury, only if you choose to share it.
• Technical data: our hosting provider briefly logs requests (such as IP address and browser) to keep the site secure and working.

• To run your account, bookings, waitlist and personal training requests, and to send you emails about them: this is needed to provide the service you signed up for (GDPR article 6(1)(b)).
• To send the newsletter, only if you opted in: your consent (article 6(1)(a)). You can unsubscribe from any newsletter or in your account.
• Health information in training notes is used only to plan a safe session, based on your explicit consent when you choose to share it (article 9(2)(a)).
• To show the studio board, points and badges, and to keep the site secure: our legitimate interest in a friendly, safe studio community (article 6(1)(f)). You can hide yourself from the board in your account at any time.

We don't sell your data, use it for advertising, or make automated decisions with legal effects about you.

Studio staff (instructors and admins) see what they need to run classes: names, bookings, attendance and training requests. Other students see only your first name, last initial and points on the studio board, unless you hide yourself.

We use these providers, who process data on our behalf under data processing agreements:

• Supabase: database and sign-in. Data is stored in the EU (Ireland).
• Cloudflare: website hosting and security.
• Resend: sending emails. Resend is based in the USA; transfers are covered by the EU–US Data Privacy Framework and the European Commission's standard contractual clauses.
• Google: only if you choose to sign in with Google, or to show the map on the About page.

We use only cookies that the site needs to work: one keeps you signed in, and one remembers your language. We use no analytics or advertising cookies, so we don't ask for cookie consent.

The map on the About page comes from Google Maps. It loads only when you choose to show it; Google may then set its own cookies under Google's privacy policy.

We keep your data while you have an account. When you delete your account (Account → Delete account), your profile, bookings, points and training requests are deleted straight away. Encrypted backups are overwritten within 30 days. Provider security logs are kept only briefly.

You can ask to access, correct or delete your data, to receive it in a portable format, to restrict or object to its use, and to withdraw consent at any time (without affecting what was done before). Many of these you can do yourself in your account. For the rest, email us and we'll reply within one month.

You can also complain to the Hellenic Data Protection Authority (www.dpa.gr, Kifisias 1-3, 115 23 Athens).

Children under 15 need a parent or guardian to create or approve their account, in line with Greek law (Law 4624/2019).

If we change this policy, we'll update the date below, and tell you by email if the change is significant.