THE BALANCE SPACE

GDPR — Personal Data Processing Information

Effective from: 1 March 2026 · Last updated: 1 March 2026

Pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter: the "GDPR"), we hereby inform you as follows:

1. Data Controller

The controller of your personal data is:

Aliaksei Lapuka
conducting business activity under the business name Aliaksei Lapuka
ul. Augustyna Szamarzewskiego 21/2, 60-514 Poznań
NIP: 7831854033, REGON: 521561577
E-mail: thebalancespacehq@gmail.com

2. Purposes and Legal Bases for Processing

Your personal data is processed for the purposes of:

  • Performance of the service agreement (Art. 6(1)(b) GDPR) — Account registration, Class bookings, payment processing, Pass fulfilment.
  • Compliance with legal obligations (Art. 6(1)(c) GDPR) — maintaining accounting records, fulfilling tax obligations, handling complaints.
  • Legitimate interests of the Controller (Art. 6(1)(f) GDPR) — ensuring Platform security, analysing service quality, pursuing legal claims.

3. Categories of Personal Data

  • Identification data (first name, surname).
  • Contact data (phone number, e-mail address).
  • Transaction data (booking history, payments, Passes).
  • Technical data (IP address, device type, logs).

4. Data Recipients

Your data may be disclosed to:

  • Payment operator — PayNow (mBank S.A.).
  • E-mail service provider — Brevo (Sendinblue GmbH), based in the EU.
  • Infrastructure providers — Cloudflare, Inc. (USA, on the basis of SCC), Hetzner Online GmbH (Germany).
  • Push notification provider — Google LLC (Firebase, USA, on the basis of SCC).

5. Data Transfers to Third Countries

In connection with the use of Cloudflare and Google services, certain data may be transferred to the United States. Such transfers are carried out on the basis of Standard Contractual Clauses (SCC) approved by the European Commission, with additional security measures in place (end-to-end encryption).

6. Data Retention Period

  • Account data — for the duration of service use + 30 days after Account deletion.
  • Transaction data — 5 years (tax obligations).
  • Technical data (logs) — 90 days.
  • Data for pursuing claims — up to 6 years (limitation period).

7. Rights of the Data Subject

You have the right to:

a) Right of access (Art. 15 GDPR)

You have the right to obtain from the Controller confirmation as to whether your personal data is being processed and, if so, to access those data along with information on the purposes of processing, categories of data, recipients, and the envisaged retention period.

b) Right to rectification (Art. 16 GDPR)

You have the right to request the prompt rectification of inaccurate personal data and the completion of incomplete data.

c) Right to erasure — the "right to be forgotten" (Art. 17 GDPR)

You have the right to request the erasure of your personal data where:

  • The data is no longer necessary for the purposes for which it was collected.
  • Consent has been withdrawn and there is no other legal basis for processing.
  • The data is being processed unlawfully.

Account deletion can be performed directly in the application, in the profile settings.

d) Right to restriction of processing (Art. 18 GDPR)

You have the right to request the restriction of processing where you contest the accuracy of the data, the processing is unlawful, or the Controller no longer needs the data but you require it for the establishment, exercise, or defence of legal claims.

e) Right to data portability (Art. 20 GDPR)

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller.

f) Right to object (Art. 21 GDPR)

You have the right to object to the processing of your personal data based on the legitimate interests of the Controller (Art. 6(1)(f) GDPR).

g) Right to lodge a complaint

You have the right to lodge a complaint with the supervisory authority:

President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO)
ul. Stawki 2, 00-193 Warszawa
Phone: (22) 531-03-00
Website: uodo.gov.pl

8. Exercising Your Rights

To exercise your rights, please contact the Controller:

The Controller will process your request without undue delay, and no later than within 30 days of receiving the request. For complex requests, this period may be extended by a further 60 days, of which the User will be informed.

9. Obligation to Provide Data

Providing personal data is voluntary but necessary for using the Platform's services. Failure to provide contact data (phone number or e-mail) will prevent Account registration and the use of Class booking features.

10. Automated Decision-Making

The Controller does not make decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect the User.