Privacy Policy

How we process your personal data.

As of: 3 August 2026.
This Privacy Policy informs you about the nature, scope and purpose of the processing of personal data within our online offering and the associated websites, features and content, as well as our mobile iOS application (hereinafter jointly referred to as the "Online Offering" or "App").

1. Controller

The controller responsible for data processing within the meaning of Art. 4 No. 7 GDPR is:

The Hundred GmbH
In der Au 27
61440 Oberursel (Taunus)
Germany

Represented by the managing directors: Jana Uhrmeister, Rick Jäger
Email: info@thehundred-pilates.de

Commercial register: Amtsgericht Frankfurt am Main (local court), HRB 17571

2. General information on data processing

2.1 Scope of processing of personal data

As a matter of principle, we process our users' personal data only to the extent necessary to provide a functional website and mobile app, our content and services. Processing regularly takes place only with the user's consent or on one of the legal bases set out in Art. 6 (1) GDPR.

2.2 Legal bases

Art. 6 (1) (a) GDPR (consent) where consent has actively been given (e.g. newsletter, push notifications, marketing photos, reach measurement via the Meta Pixel on our campaign pages — see Section 13).
Art. 6 (1) (b) GDPR (contract) for processing bookings, memberships, payments and customer accounts.
Art. 6 (1) (c) GDPR (legal obligation), e.g. for the retention of invoices under commercial and tax law.
Art. 6 (1) (f) GDPR (legitimate interest) for the technically secure and stable provision of the website / app, server logs, fraud prevention.

2.3 Storage period

We store personal data only for as long as is necessary to achieve the purpose of processing, or for as long as statutory retention obligations exist (in particular § 257 HGB, § 147 AO — generally up to 10 years). Once the purpose ceases to apply or the period expires, the data is deleted or anonymised.

2.4 Transfer to third countries

Where we transfer data to countries outside the European Economic Area (EEA), in particular to the USA, this is done on the basis of the EU-US Data Privacy Framework (adequacy decision of 10 July 2023) or pursuant to EU Standard Contractual Clauses under Art. 46 GDPR. The individual services are listed in Section 8 of this policy.

This also covers the data transfer to Meta Platforms, Inc. in connection with the Meta Pixel used on our campaign pages: Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework, so this transfer likewise relies on the adequacy decision above (see Section 13 for details). This does not change the fact that setting and reading the Meta Pixel itself still requires your express consent under Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG.

3. Provision of the website and server log files

When you access our website, our hosting provider automatically collects data and information from the computer system of the accessing device in so-called server log files:

browser type and version
operating system
referrer URL
IP address (shortened where technically possible)
date and time of access

Purpose and legal basis: Processing is based on Art. 6 (1) (f) GDPR for the purpose of stable provision of the online offering and to ensure system security.

Storage period: Server logs are automatically deleted after a maximum of 30 days, unless a specific suspicion of misuse justifies longer storage in an individual case.

4. Customer account and booking data (website + iOS app)

4.1 Registration

Creating a customer account is required to use the booking and membership features. The following data is collected:

Mandatory details: first name, surname, email address, password (stored encrypted) or sign-in via Apple Sign In or Google Sign In (see Section 5).

Optional details: phone number, address (street, house number, postcode, town), personal notes on your training condition (e.g. injuries), profile photo, hands-on/hands-off setting.

Legal basis: Art. 6 (1) (b) GDPR (performance of a contract and pre-contractual measures).

Storage period: The data is stored for the duration of the contractual relationship. After the contract ends, the data is deleted unless statutory retention obligations (HGB, AO) apply — these then apply for up to 10 years.

4.2 Booking and membership data

In connection with booking classes and managing memberships, we process:

booking and cancellation history (class instances, timestamps, trainer, attendance status)
membership data (type of membership, term, remaining credits, renewal and expiry dates, pause periods)
Stripe customer ID (technical identifier without sensitive payment data)

Legal basis: Art. 6 (1) (b) GDPR.

Guest bookings (booking without a customer account): We store contact details from guest bookings (name, email address, phone number) for contract handling and for defending against or asserting legal claims (Section 195 German Civil Code) until the end of the third calendar year after the class date; after that they are deleted or anonymised automatically. Payment and billing records remain subject to statutory retention duties (Section 257 HGB, Section 147 AO) independently of this.

Follow-up email after your visit. If you have attended an intro session with us, or booked and paid for a class as a guest (without a customer account), we generally send a follow-up email on the evening of your visit or on one of the following evenings, to the address associated with your booking or your customer account. It thanks you for your visit and contains offers for continuing at our studio (e.g. discount codes). The legal basis is Art. 6 (1) (f) GDPR (legitimate interest in direct marketing to our customers; cf. § 7 (3) UWG). You can object to this use at any time — every such email contains an unsubscribe notice, and an informal message to info@thehundred-pilates.de suffices. After an objection you will receive no further promotional emails from us. So that you are not sent this email more than once after a paid guest booking, we also keep a permanent record that this address has already received one; this record is not subject to the retention period for guest booking data described in Section 4.2, and is kept until you object or request erasure under Art. 17 GDPR.

Visibility of "personal notes": The notes you store in your profile regarding pre-existing conditions, injuries or particular physical circumstances are visible — for organisational and safety reasons — to the trainers of the class you have booked. These notes are voluntary.

4.3 Secure storage

Passwords are stored exclusively as salted hashes via our processor Supabase (see Section 8.1). Plain-text passwords are never stored or transmitted.

4.4 Account deletion and retention

You can delete your customer account yourself at any time — in the iOS app under "Profile → Delete account" and on the website in the profile area.

Immediate deletion (no active subscription): If you have no ongoing subscription obligations, your personal data (name, contact details, address, profile photo, personal notes and internal notes about you) is immediately and irreversibly anonymised or removed; any unused credits are forfeited upon deletion. Signing in is no longer possible thereafter. Legal basis: Art. 17 (1) GDPR.
Deferral during an active membership: If you have an active membership, deletion is deferred until the end of the contractual term — the subscription is cancelled with effect from the end of the term and the account is then deleted automatically. Until then, you can cancel the scheduled deletion at any time. Legal basis for the deferral: Art. 17 (3) (b) GDPR or Art. 18 GDPR (restriction of processing for the duration of the existing contractual obligation).
Immediate deletion on request: Even during an active membership, you can request immediate deletion by contacting info@thehundred-pilates.de (subject to verification of your identity). Any fees still outstanding up to the regular end of the contract remain unaffected.
Statutory retention: We are required to retain invoices and payment records even after deletion for the statutory retention period (§ 257 HGB, § 147 AO — generally up to 10 years). These records are kept anonymised or separately from the remaining data and are used solely to fulfil our legal obligations. Legal basis: Art. 6 (1) (c) GDPR in conjunction with Art. 17 (3) (b) GDPR.
Exception for the free-intro-class campaign: If you redeemed a free intro class through a marketing campaign (e.g. via /gratis), we continue to store the associated normalised email address as proof of your participation beyond the deletion of your account, so the offer cannot be redeemed more than once. The legal basis is our legitimate interest in preventing abuse (Art. 6 (1) (f) GDPR); see the terms of participation of the respective campaign.

5. Sign-in with third-party providers (Apple / Google)

5.1 Apple Sign In

We offer sign-in via "Sign in with Apple". When you use this feature, you are redirected to Apple and authenticate there. Apple then transmits to us a pseudonymous identifier as well as your name and — if you have released it — your email address (either the real one or an Apple relay address from which we cannot derive whom it belongs to).

Provider: Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland.
Data processed: Apple user identifier, where applicable email address (real or relay), first name and surname (if released).
Purpose: simplified sign-in without a separate password.
Legal basis: Art. 6 (1) (b) GDPR (performance of a contract) and Art. 6 (1) (a) GDPR (consent given with the first tap on the Apple button).
Apple's privacy policy: https://www.apple.com/legal/privacy/en-ww/

5.2 Google Sign In

We offer sign-in via "Sign in with Google". When you use this feature, you are redirected to Google and authenticate there. This connection to Google is established only when you actively choose the feature — no Google services or scripts are loaded in the background beforehand.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; where applicable Google LLC, USA.
Data processed: Google account ID, name, email address, profile picture (if released).
Purpose: simplified sign-in without a separate password.
Legal basis: Art. 6 (1) (b) GDPR (performance of a contract) and Art. 6 (1) (a) GDPR (consent given with the first tap on the Google button).
Third-country transfer: USA, safeguarded via the EU-US Data Privacy Framework.
Google's privacy policy: https://policies.google.com/privacy

6. The iOS app in particular

6.1 Data processing in the app

The Hundred's iOS app accesses the same backend services as the website (Supabase, Stripe, Resend). The notes in Sections 4 and 8 therefore apply accordingly.

In addition, the app processes the following data locally on your device without transmitting it to our servers:

last selected class filters, last viewed class
onboarding status (seen yes/no)
draft data in forms that have not yet been submitted

6.2 Push notifications (Apple Push Notification Service / APNs)

With your consent, we send push notifications, e.g. as a reminder 24 hours before a booked class or when the check-in window opens.

Provider: Apple Distribution International Ltd. (Ireland) / Apple Inc. (USA) as sub-processor.
Data processed: device token (pseudonymous push identifier), the content of the notification (class name, time, booking ID).
Purpose: sending reminder and service push messages.
Legal basis: Art. 6 (1) (a) GDPR (consent at the first system prompt by iOS) and Art. 6 (1) (b) GDPR (performance of a contract for booking-related notifications).
Withdrawal: You can disable push notifications at any time in the iOS system settings under "The Hundred → Notifications" or in the app under "Profile → Notifications". When disabled, the device token is removed from our servers.
Third-country transfer: USA (via APNs), safeguarded via the EU-US Data Privacy Framework.

6.3 App permissions

The app requests the following iOS permissions as needed:

Notifications (for push notifications, see 6.2)
Camera (optional, for profile photo upload)
Photo library (optional, for profile photo upload)

You can revoke each permission at any time in the iOS system settings under "The Hundred".

6.4 No analytics trackers

The app uses no third-party analytics frameworks (e.g. Google Analytics, Firebase, Mixpanel, Facebook SDK). There is no tracking across app sessions, app usage or devices.

7. Payment processing (Stripe)

To process purchases (single classes, 5-class card, memberships) we use the payment service provider Stripe. When you complete a paid transaction, the payment data required for it (in particular card number, expiry date, security code; for SEPA direct debit the IBAN; for Apple/Google Pay tokenised payment data) is transmitted directly to Stripe. We have no access to this data and do not store it on our servers.

Provider (EU): Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.
Data processed by Stripe: payment-method data, name, email address, billing address, IP address, device fingerprints (for fraud prevention), transaction history.
Data transmitted to us: Stripe customer ID (identifier without plain-text payment data), payment status (successful/failed), last 4 digits of the card (for display as "Visa •••• 4829"), card brand information, membership status.
Purpose: processing payments, managing the membership, invoicing, fraud prevention.
Legal basis: Art. 6 (1) (b) GDPR (performance of a contract); Art. 6 (1) (f) GDPR (fraud prevention).
Third-country transfer: Stripe processes data partly in the USA (Stripe, Inc.). The transfer is safeguarded via the EU-US Data Privacy Framework and EU Standard Contractual Clauses.
Stripe privacy policy: https://stripe.com/privacy

8. Processors and service providers used

We use the following processors within the meaning of Art. 28 GDPR. We have concluded data processing agreements (DPAs) with each of these providers.

Meta is deliberately not listed here. For the Meta Pixel described in Section 13, we and Meta Platforms Ireland Limited are joint controllers within the meaning of Art. 26 GDPR, not a processing arrangement under Art. 28 GDPR. See Section 13 for details, including the allocation of responsibilities.

8.1 Supabase (auth, database, edge functions, storage)

Provider: Supabase, Inc., 970 Toa Payoh North, #07-04, Singapore 318992 (registered office); EU region (Frankfurt) for data storage.
Data processed: customer account data, bookings, memberships, credit transactions, push tokens, all content generated by the app / website.
Purpose: database storage, authentication, provision of server functions, file storage (profile photos).
Legal basis: Art. 6 (1) (b) GDPR (performance of a contract).
Data storage: EU region (Frankfurt). Parts of the infrastructure (e.g. logging, support tooling) may be operated by Supabase, Inc. in the USA; the transfer is safeguarded via EU Standard Contractual Clauses and the EU-US Data Privacy Framework.
Supabase privacy policy: https://supabase.com/privacy

8.2 Resend (email delivery)

Provider: Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA.
Data processed: recipient email address, content of the email sent (order confirmations, cancellation confirmations, membership renewals, newsletter, credit-expiry warnings, cancellation confirmations).
Purpose: sending transactional and informational emails.
Legal basis: Art. 6 (1) (b) GDPR (performance of a contract) or Art. 6 (1) (a) GDPR (consent for the newsletter).
Third-country transfer: USA. Safeguarded via the EU-US Data Privacy Framework and EU Standard Contractual Clauses.
Resend privacy policy: https://resend.com/legal/privacy-policy

8.3 Apple Push Notification Service (APNs)

See Section 6.2.

8.4 Apple Sign In / Google Sign In

See Section 5.

8.5 Hosting (Netlify)

The website www.thehundred-pilates.de is delivered via Netlify, Inc. (44 Montgomery Street, Suite 300, San Francisco, CA 94104, USA). When the website is accessed, the server log files referred to in Section 3 are collected by Netlify. The transfer to the USA is safeguarded via the EU-US Data Privacy Framework and EU Standard Contractual Clauses.

Netlify privacy policy: https://www.netlify.com/privacy/

9. Newsletter

With your consent, we send a newsletter with current information on our offers and events. We use the Resend service named in Section 8.2 for delivery. Subscribing to the newsletter is voluntary and can be cancelled at any time: an informal email to info@thehundred-pilates.de is enough (double opt-in: after signing up you receive a confirmation email).

You can sign up for the newsletter without a customer account (e.g. via the form in the page footer). As proof of your consent (Art. 7 (1) GDPR) we store the time of sign-up and of confirmation, the IP address at the time of sign-up, and the wording of the consent given. The legal basis is Art. 6 (1) (a) GDPR. Unconfirmed sign-ups are deleted automatically after 30 days. You can unsubscribe at any time — informally by email to info@thehundred-pilates.de.

Legal basis: Art. 6 (1) (a) GDPR (consent). For existing customers, additionally Art. 6 (1) (f) GDPR in conjunction with § 7 (3) UWG for advertising of our own similar goods or services where applicable.

Storage period: Until consent is withdrawn. After withdrawal, the email address is removed from the mailing list but may be kept on a suppression list to prevent accidental re-subscription.

10. Photo and audio recordings at the studio

We may — only with your prior express consent — make and publish photo or audio recordings during selected classes or events (e.g. on Instagram or the website). Publication takes place only after voluntary consent in text form and can be withdrawn at any time with effect for the future.

Legal basis: Art. 6 (1) (a) GDPR (consent).

11. Social media

We operate profiles on social networks (in particular Instagram). The content is displayed via the platforms themselves. When you access our profile on a platform, that platform's respective privacy provisions apply.

Instagram: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. https://privacycenter.instagram.com/policy/

We use no social-media plugins on our website that send data to the platforms without your active consent. On our campaign pages (currently: /gratis) we use — only with your express consent — the Meta Pixel for reach measurement; see Section 13 for details, including the joint controllership with Meta.

11.1 Contact via WhatsApp

On our website and in our app we offer the option to contact us via WhatsApp. When you use the WhatsApp button, you are redirected to WhatsApp; in doing so, data (e.g. your IP address) may be transmitted to WhatsApp Ireland Limited, a company of the Meta group. Once you send a message, WhatsApp's privacy policy applies. We have no influence over the data processing carried out by WhatsApp/Meta.

12. Cookies

Our website uses technically necessary cookies and comparable storage technologies, e.g. to maintain the login status and to ensure the website's core functions. Under § 25 (2) No. 2 TDDDG, no consent is required for this technically necessary storage.

In addition, on our campaign pages (currently: /gratis) we use the Meta Pixel for reach measurement (see Section 13 for details). The Meta Pixel is activated only after your express consent via our consent banner — until that consent is given, no such script is loaded and no connection to Meta is made. You can withdraw your consent at any time with effect for the future via the "Cookie settings" link in the page footer.

On all other pages of our online offering, we use no tracking or marketing cookies.

The iOS app uses no cookies (cookies are a web concept).

13. Meta Pixel (reach measurement on campaign pages)

On our campaign pages (currently: /gratis) we use — only with your prior consent — the Meta Pixel, an analytics and advertising service operated by the Meta group of companies. The Meta Pixel allows us to measure the effectiveness of our campaign advertising on Instagram and Facebook (reach measurement / conversion tracking).

Joint controllership (Art. 26 GDPR). For the collection and transmission to Meta of the data generated when you access our campaign pages, we and Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland, are joint controllers within the meaning of Art. 26 GDPR (cf. CJEU, judgment of 29 July 2019, Case C-40/17 — "Fashion ID"). Any further processing by Meta — in particular for Meta's own purposes — takes place under the sole responsibility of Meta Platforms Ireland Limited or Meta Platforms, Inc., 1 Meta Way, Menlo Park, CA 94025, USA; our joint controllership expressly does not extend to this further processing.

Essence of the arrangement (Art. 26 (2) GDPR). In outline: we are responsible for ensuring the Meta Pixel on our campaign pages is activated only after consent has been obtained and that the data triggered by it is transmitted to Meta correctly. Meta Platforms Ireland Limited is your point of contact for any questions about the further processing of your data after it is transmitted to Meta. You can exercise your rights as a data subject (see Section 14) against us and/or against Meta Platforms Ireland Limited. Meta provides the full agreement (the "Controller Addendum") at https://www.facebook.com/legal/controller_addendum.

Data processed. When you access a campaign page with consent activated, the pixel code running in your browser transmits, among other things: IP address, browser and device information, the URL accessed, and the time of access. In addition, we specifically trigger the events "PageView" (page visit), "Lead" (after successful registration) and "CompleteRegistration" (after a successful booking).

Storage period. Cookies set by the Meta Pixel (in particular the _fbp cookie) have a storage duration of up to 90 days.

Advanced Matching. We have disabled Meta's "Advanced Matching" feature, which would otherwise automatically hash and transmit name and email address from form fields to Meta. No plain-text or hashed contact data (name, email address) is transmitted to Meta via the Meta Pixel.

Legal basis. Art. 6 (1) (a) GDPR (consent) in conjunction with § 25 (1) TDDDG (storing information, or accessing information already stored, on the end device).

Third-country transfer. Using the Meta Pixel involves transferring data to Meta Platforms, Inc. in the USA. This transfer is based on the European Commission's adequacy decision on the EU-US Data Privacy Framework of 10 July 2023 (Art. 45 GDPR); Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework. Setting and reading the Meta Pixel itself — independently of this transfer basis — still requires your express consent under Art. 6 (1) (a) GDPR in conjunction with § 25 (1) TDDDG (see "Legal basis" above).

Withdrawal. You can withdraw your consent at any time with effect for the future (ex nunc) via the "Cookie settings" link in the page footer. After withdrawal, the Meta Pixel will no longer be loaded on your next page visit.

Further information. Meta's data policy: https://www.facebook.com/privacy/policy/. Controller Addendum: https://www.facebook.com/legal/controller_addendum.

14. Your rights as a data subject

You have the right at any time:

to request information about the data stored about you (Art. 15 GDPR);
to request the rectification of inaccurate data (Art. 16 GDPR);
to request the erasure of your data, unless a statutory retention obligation applies (Art. 17 GDPR — "right to be forgotten");
to request the restriction of processing (Art. 18 GDPR);
to request data portability (Art. 20 GDPR);
to object to processing on grounds relating to your particular situation (Art. 21 (1) GDPR);
to withdraw consent given at any time (Art. 7 (3) GDPR) — withdrawal takes effect for the future;
to lodge a complaint with a supervisory authority (Art. 77 GDPR).

To exercise your rights or for any queries, please contact: info@thehundred-pilates.de.

Separate right to object to direct marketing (Art. 21 (2), (4) GDPR). Regardless of any particular situation, you can object at any time and without giving reasons to the processing of your data for the purpose of direct marketing. This includes, in particular, reach measurement via the Meta Pixel on our campaign pages (Section 13) and the follow-up email after your visit described in Section 4.2. Following such an objection, we will no longer process your data for these purposes. The easiest way to withdraw your consent to the Meta Pixel is via the "Cookie settings" link in the page footer; for other direct marketing, an informal message to info@thehundred-pilates.de is sufficient.

Competent supervisory authority:
The Hessian Commissioner for Data Protection and Freedom of Information
Postfach 3163, 65021 Wiesbaden
Phone: +49 611 1408-0
Email: poststelle@datenschutz.hessen.de
https://datenschutz.hessen.de

15. Data security

For website visits and in the app we use the widely adopted TLS (Transport Layer Security) method to encrypt connections. Personal data is transmitted exclusively in encrypted form. Passwords are stored salted and hashed; plain-text passwords are never stored or processed.

We take technical and organisational measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction, or unauthorised access by third parties.

16. Changes to this Privacy Policy

We reserve the right to amend this Privacy Policy so that it always complies with current legal requirements or to implement changes to our services, e.g. when introducing new services. The version current at the time then applies to your renewed visit. This English version is available at https://thehundred-pilates.de/en/datenschutz; the binding German version is at https://thehundred-pilates.de/datenschutz.