Privacy policy

Who processes your data

PurForm Pilates Studio, Sheraton Tunis, Avenue de la Ligue Arabe, Tunis. The data controller is Jamel Abdennaceur Rouissi.

This site and the PurForm mobile app serve a single purpose: managing bookings for the studio's Pilates sessions and the relationship with its members. Your data is used for nothing else.

What we collect, and why

To maintain your account: first name, last name, email address — which serves as your identifier — and your password, stored as a hash and never in plain text. Optionally, and only if you provide them: title, phone number, profile photograph and a free-form introduction.

For bookings: the sessions you have booked, their status, your position on the waitlist, your actual attendance, your requests to change level and the reviews you publish.

For technical purposes: the hashes of the email verification and password reset codes (never the codes themselves), your device token if you accept notifications, and a log of the emails and notifications sent to you.

What we do not collect

No health, banking or payment data. No identity document number, no location data, no biometric data. Your profile photograph, if you upload one, is not subject to recognition of any kind.

This site carries no advertising trackers and no audience-measurement tools: no Google Analytics, no social media pixel, or any equivalent. We do not sell or rent your data to anyone.

Who else has access

Two service providers, and no others:

• OVHcloud, a French company, hosts the studio's server, database and email, in data centres located in France. Your data is therefore hosted outside Tunisia — a transfer subject to authorisation by the Instance nationale de protection des données à caractère personnel (Tunisia's personal data protection authority); the application for that authorisation is being prepared.
• Expo, a company established in the United States, delivers notifications to the mobile app. It receives only your device's technical token: neither your name nor your email address.

How long we keep it

The following time limits are enforced by the system itself: a verification or reset code expires after 15 minutes and after 5 attempts; a sign-in session expires after 7 days; the encrypted database backups are purged after 14 days.

Your account data and your booking history are kept for as long as your account exists. We prefer to state it this way rather than announce a retention period the system would not enforce. If you ask for your account to be deleted, they are erased — see below.

Your rights

You can view your account, your bookings and your reviews in full from the site or the app. You can change your name, phone number, introduction and photograph there yourself, and remove the photograph at any time.

Account deletion is not yet automated: write to us at the address below from the email address of your account, and we will delete your account and the data attached to it within 30 days. We will confirm the deletion by return email. You can also ask us for access to your data or for its rectification, or object to a processing operation, at the same address and within the same period.

How it is protected

Communication with the site and the app goes over HTTPS. Passwords are stored as a bcrypt hash and cannot be read back, not even by us. The database backups are encrypted, and their key is held only by the studio: the hosting provider cannot read the backups it hosts.