Privacy policy

1. Data controller

This Privacy Policy explains how personal information is handled when you visit https://heuretik.com, create an account, purchase content, book a session, or contact us. Data controller (operator of Pilates Pro): • Legal entity / company name: Pilates Pro • Legal form: Limited Liability Company • Registration number: 42181226 • VAT / tax ID: 37181226 • Registered office: Kyiv • Contact email: webmaster@heuretik.com • Data-protection contact: dpo@heuretik.com • Public address: 01001 Kyiv Ukraine • Phone: [TO COMPLETE — public contact phone] Fields marked “[TO COMPLETE — …]” must be completed with the operator’s official details.

2. Scope

This policy applies to personal data processed through the Pilates Pro website and related marketplace services: accounts, catalog, library, bookings, payments (WayForPay when enabled), contact forms, community forum (when enabled), marketing newsletter module (when enabled), and accounting tools / exports (when enabled). Transactional emails (orders, invoices, session reminders) fall under this policy but are not marketing; the newsletter module is described in § 12. It does not cover independent websites or services of instructors outside the platform, which may have their own policies. For newsletter campaigns sent by an instructor to their clients, the instructor acts as data controller (§ 12).

3. Information we collect

Depending on how you use Pilates Pro, we may process: • account details such as name, email address, preferred language, and authentication data; • profile information you choose to provide (for example instructor biography, photo, or studio details); • commercial records such as purchases, bookings, invoices, payment status, and generated accounting exports; • usage data needed for your library, including favorites and watch progress; • forum content and metadata (posts, reactions, categories, tags) when the forum is enabled; • marketing newsletter consents (platform, instructor, or platform→instructors scopes), date, source, text version, and hashed IP fingerprint; • newsletter engagement metrics (opens, clicks, delivery status, hashed IP fingerprint, truncated user agent) — without storing raw IP addresses; • contractual acceptances for newsletter and accounting tools (document version, checked boxes, timestamp); • messages and support requests you send through the Contact page or in-product forms; • technical logs such as IP address, browser type, device information, and approximate location derived from network data, for security and diagnostics. Payment card details are processed by the payment provider (WayForPay when enabled) and are not stored in full on Pilates Pro servers.

4. Purposes of processing

We use personal information to: • operate the marketplace and authenticate users; • deliver purchased digital content and manage physical session bookings; • communicate about orders, bookings, account security, and service updates (transactional emails); • enable instructors to fulfil offerings you purchase or book from them; • host the community forum, moderate content, and display posts according to platform rules; • send marketing newsletters with your consent (§ 12) and measure their engagement (opens, clicks); • provide instructors and authorized administrators with accounting export tools and transmission to mandated advisors (§ 13); • retain proof of consents and contractual acceptances; • improve product quality, performance, and user experience; • prevent fraud, abuse, and unauthorized access; • comply with legal, accounting, and regulatory obligations. We do not sell personal data.

5. Legal bases

Where data-protection laws such as the GDPR apply, we rely on one or more of the following bases: • performance of a contract (marketplace services, forum, transactional emails); • consent Art. 6(1)(a) for marketing newsletters (platform, instructor, platform→instructors scopes) and associated engagement tracking (open pixel, tracked links) — included in the global marketing consent; • legitimate interests (security, email deliverability, technical send logs, proof of consent, in a manner that respects your rights); • legal obligation (tax, accounting, or regulatory requirements, retention of evidence). There is no “legitimate interest” basis for sending marketing newsletters in the current module version.

6. Recipients and processors

We may share limited personal information with: • payment processors (WayForPay) to complete transactions; • hosting (LWS), email delivery (LWS SMTP), video delivery, media CDN (Bunny.net for newsletter banners/videos), and infrastructure providers; • instructors, when necessary to fulfil a purchase, booking, message, or newsletter campaign for which they are data controller; • accountants or any recipient mandated by the instructor or administrator during an accounting export (§ 13); • professional advisers or authorities when required by law or to protect our rights. For instructor → client newsletter campaigns, the instructor is data controller and Pilates Pro acts as technical processor (sending, tracking, unsubscribe). Instructors only access aggregated statistics for their campaigns, not emails of non-clients. Service providers are expected to process data only on documented instructions and with appropriate safeguards. Transfers outside the EEA/UA are covered by standard contractual clauses or equivalent mechanisms where required.

7. International transfers

If personal data is transferred outside your country or the European Economic Area, we take steps required by applicable law, such as standard contractual clauses or other approved transfer mechanisms, where appropriate.

8. Retention and security

We retain personal information only as long as needed for the purposes described above, including legal retention periods for commercial records (including at least 5 years for accounting documents under common Ukrainian practice). Indicative periods for recent modules: • newsletter consents: 36 months after last contact or revocation, then anonymization; • newsletter deliveries and analytics: 24 months, then detail deletion (aggregates retained); • legal acceptances (newsletter, accounting): 60 months; • newsletter tracking tokens: campaign duration, invalidated on deletion. When data is no longer required, we delete or anonymize it where reasonably possible. We apply reasonable technical and organizational measures: TLS encryption (HTTPS/SMTP), role-based access control, IP hashing (no raw IP retention for newsletter tracking), HTML sanitization of newsletter content. No online service can guarantee absolute security; please protect your password and notify us of any suspected incident at webmaster@heuretik.com.

9. Your rights

Depending on your location, you may have rights to access, correct, update, delete, or restrict processing of your personal data, to object to certain processing, and to data portability. You may also withdraw consent where processing is based on consent, without affecting prior lawful processing. To exercise these rights, contact dpo@heuretik.com or use the Contact page. You may also lodge a complaint with a competent supervisory authority if you believe your rights have been infringed.

10. Cookies and similar technologies

Pilates Pro uses cookies and similar technologies on the public marketplace. • Essential (always on): session, CSRF protection, authentication, and locale (`pp_cookie_consent` stores your banner choice). • Preferences (opt-in): saved catalog filters, onboarding flags, and anonymous visitor ID `pp_visitor_uid` (1 year, HttpOnly) to recognize returning visitors for the questionnaire. • Analytics (opt-in): Google Analytics (GA4) when a measurement ID is configured in Admin → Google connections. • Marketing (opt-in): newsletter open/click tracking is covered by your marketing consent (§ 12); no additional browser cookies are required for email campaigns. On your first visit, a banner lets you accept all, reject non-essential cookies, or customize categories. You can change your mind by clearing site cookies or contacting dpo@heuretik.com. Marketing emails may contain an open-tracking pixel and tracked links; this tracking does not rely on additional browser cookies.

11. Children

The marketplace is not directed at children under the age required to consent to information-society services in their jurisdiction. If you believe we have collected personal data from a child without appropriate consent, contact us so we can take suitable action.

12. Marketing newsletter

The newsletter module enables marketing communications (non-transactional), distinct from order, invoice, or session reminder emails. Consent scopes: • platform (`platform`) — news and offers from Pilates Pro; • instructor (`instructor`) — communications from a studio/instructor to their clients; • platform→instructors (`platform_instructor`) — platform marketing tips to instructors (when enabled). Consent checkboxes are not pre-ticked; consent is separate from acceptance of the Terms of Service. Each consent is logged (scope, date, source, text version, hashed IP fingerprint). GDPR roles: • Pilates Pro admin → client campaigns: Pilates Pro is data controller; • instructor → client campaigns: the instructor is controller, Pilates Pro is technical processor. Data processed: identity, email, consents, delivery status, open/click counters, hashed IP fingerprint, truncated user agent. No fine geolocation derived from IP. Withdraw consent: Communications tab in your account, or one-click unsubscribe link in each email. Withdrawal does not affect the lawfulness of prior sends. Target response time for requests: 30 days via dpo@heuretik.com. Newsletter media (banners, videos) may be delivered via Bunny.net (possible transfer outside the EU).

13. Accounting exports

The accounting tool allows authorized instructors and administrators to generate and transmit exports (CSV/Excel, PDF/HTML invoices, ZIP archives) containing personal data: client identity, email, amounts, commissions. Pilates Pro facilitates commercial management; it does not replace an accountant or tax advisor. Exports do not constitute fiscalization (PRRO, fiscal receipt), certified income ledger, VAT/ПДВ registers, or certified balance sheet. Before any first export or send to an accountant, the interface requires acceptance of the accounting export liability waiver (checkboxes E1–E3 for instructors, A1–A3 for administrators). Proof retained: document version, timestamp, hashed IP fingerprint, user id, checked boxes. The instructor or administrator remains responsible for verifying exports, lawful basis for transfer to the mandated advisor, file confidentiality, and document retention (including 5 years). Restrict access, secure email delivery, and share only with mandated recipients.

14. Community forum

When the forum is enabled, users may publish discussion threads, replies, reactions, and associated metadata (categories, tags). Content is visible according to forum configuration and moderation rules of the platform and relevant instructors. Posts are processed to host the service, moderate content, prevent abuse, and improve the community experience. Legal basis: contract performance and legitimate interest (security, moderation). You are responsible for content you publish. Do not publish sensitive data, detailed medical information, or third-party personal data without a lawful basis. Pilates Pro and authorized moderators may remove or hide content that violates the Terms of Service. Forum data is retained while the service is active and according to applicable legal periods; account deletion may lead to anonymization or deletion of content per the procedure in force.

15. Updates and contact

We may update this Privacy Policy from time to time. The “Last updated” date at the top of this page will change when revisions are published. Material changes may also be highlighted on the marketplace or by email when appropriate. For privacy requests or questions: dpo@heuretik.com, or use the Contact page on Pilates Pro.