Privacy Policy
1. Controller
The controller responsible for processing personal data within the meaning of the General Data Protection Regulation (GDPR) is:
Body Atelier – Jana Charline Bielefeld
Owner: Jana Charline Bielefeld
Westerstraße 46
27793 Wildeshausen
Germany
Phone: 0152 33910556
Email: moin@bodyatelier.de
2. General information on data processing
Protecting your personal data is important to us. We process personal data exclusively in accordance with the applicable data protection regulations, in particular the General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
Personal data means any information relating to an identified or identifiable natural person. This includes, for example, names, contact details, IP addresses, and booking and payment data.
Personal data is processed only insofar as this is necessary to provide our website and services, communicate with you, process bookings and contracts, handle payments, fulfil legal obligations, or where another legal basis applies.
3. Hosting and provision of this website
This website is operated by Nodework IT Solutions.
Hosting is provided by the following company:
netcup GmbH
Emmy-Noether-Straße 10
D-76131 Karlsruhe
Germany
When you access our website, technically necessary data may be processed. This can include, in particular, your IP address, the date and time of access, the requested page or file, browser type and version, operating system, and referrer URL.
Processing is carried out to provide our website securely and without technical errors. The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in the secure, reliable and functional provision of our website.
Where the hosting provider processes personal data on our behalf, this is done on the basis of a data processing agreement pursuant to Art. 28 GDPR.
4. Contacting us
You can contact us in particular by phone or email.
When you contact us, we process the data you provide only to the extent necessary to handle your enquiry.
If your enquiry relates to an existing contract or is intended to initiate a contract, processing is based on Art. 6(1)(b) GDPR. In other cases, processing may be based on our legitimate interest in handling and responding to enquiries pursuant to Art. 6(1)(f) GDPR.
The data will be deleted as soon as it is no longer required for the respective purpose, provided that no statutory retention obligations prevent deletion.
We currently do not offer a contact form on our website.
5. Bookings and customer management via Eversports
We use Eversports services to display, book and manage our classes and to manage customers, bookings, passes, memberships and payments.
The provider is:
Eversports GmbH
Jakov-Lind-Straße 13 / Door 6 / 5th floor
1020 Vienna
Austria
The Eversports booking system is integrated into our website.
In connection with its use, the following data in particular may be processed:
Names, contact details, email addresses, phone numbers where applicable, booking data, booked classes and products, participation information, memberships or passes, and payment and transaction information.
Where processing is necessary for booking and providing our services, it is based on Art. 6(1)(b) GDPR. Where we are required to retain data due to statutory obligations, in particular under commercial or tax law, processing is based on Art. 6(1)(c) GDPR.
Through Eversports Manager, Eversports provides the technical infrastructure for managing our studio and customers. Where Eversports processes personal data on our behalf, this is done on the basis of an agreement pursuant to Art. 28 GDPR.
In addition, Eversports may process personal data under its own responsibility when providing its own platform services. In particular, Eversports is responsible for the Eversports user account. The specific data protection role therefore depends on the respective processing activity.
Further information about data processing by Eversports can be found in the Eversports privacy policy:
Eversports Privacy Policy
Eversports states that sports providers may act as independent controllers for bookings, while Eversports frequently acts as a processor for studio management functions.
6. Payment processing via Eversports
For online bookings, the payment methods offered by Eversports may be used.
The payment and transaction data required to process the payment is processed and may be transmitted to the payment service providers involved.
Processing is carried out to perform the contract concluded with you and is based on Art. 6(1)(b) GDPR and, where statutory retention and documentation obligations apply, Art. 6(1)(c) GDPR.
The payment service provider used in a particular case depends on the payment method selected within Eversports. For certain aspects of payment processing, the respective payment service providers may act as independent controllers. Eversports also states that payment service providers may act as independent controllers for transactions.
7. Card payments in the studio – VR Payment / VR PayMe
We use VR PayMe from VR Payment for on-site card payments.
The provider is:
VR Payment GmbH
Platz der Republik
60325 Frankfurt am Main
Germany
When you make a card payment, the payment and transaction data required to process the payment is processed. This may include, in particular, the payment amount, date and time, information about the payment method used, and transaction data.
Processing is carried out to handle your payment and therefore to perform the contract pursuant to Art. 6(1)(b) GDPR. Statutory retention and documentation obligations pursuant to Art. 6(1)(c) GDPR may also apply.
As a payment service provider, VR Payment supplies, among other things, the technical infrastructure for processing payments between merchants and customers and may act as an independent controller in this context.
Further information:
VR Payment Privacy Information
8. PayPal and Wero
If you use PayPal or Wero for a payment, the data required for the respective payment is transmitted to or processed by the payment service providers involved.
This may include, in particular, your name, the payment amount, transaction data, and other information required for authentication and payment processing.
Processing is carried out to provide the payment method you have selected and is based on Art. 6(1)(b) GDPR. The payment service providers process certain data under their own data protection responsibility.
The specific data processed depends on the payment service selected and its applicable privacy policy.
9. EGYM Wellpass
We are an EGYM Wellpass partner. Wellpass members can use our studio under the Wellpass terms applicable to Body Atelier.
To use the service, members check in on site using the designated QR code.
In connection with the check-in, data required to verify and bill participation may be processed. Processing serves in particular to verify eligibility, document the check-in and invoice our services.
Where processing is necessary to provide the service you use, it is based on Art. 6(1)(b) GDPR.
EGYM Wellpass processes data in connection with its own services in accordance with its applicable privacy policy.
10. Accounting and tax-related processing
To fulfil our obligations under commercial and tax law, we process invoice, booking, payment and business data as part of our accounting activities.
For this purpose, we use Agenda and the DATEV interface in particular. Where necessary, data may also be transmitted to persons commissioned by us in the fields of accounting and tax consultancy.
The legal basis is, in particular, Art. 6(1)(c) GDPR in conjunction with the retention and documentation obligations under commercial and tax law that apply to us.
Where service providers process personal data on our behalf, processing is carried out in accordance with the statutory requirements of Art. 28 GDPR.
11. Instagram
Our website contains a link to our Instagram account.
This is solely an external link. Merely accessing our website does not establish a connection to Instagram through this link. Only when you click the corresponding link do you leave our website and get redirected to Instagram.
From that point onwards, the privacy policy of the relevant platform operator applies.
No Instagram feed is currently embedded on our website, and we do not use the Meta Pixel to track website visitors.
12. Route planning via Google
Through the “Get directions” function on our website, we offer you the option of opening our studio location in an external Google mapping service.
Under our current website setup, Google Maps is not directly embedded as a map on the website. You are redirected to Google's external service only after clicking the corresponding link.
Google may process personal data, in particular your IP address and, where applicable, location data. The respective provider is responsible for this processing in accordance with its privacy policy.
13. Video surveillance of the entrance area
To protect our premises and property and to prevent and investigate criminal offences, the entrance area of Body Atelier may be subject to video surveillance outside opening or operating hours.
Video surveillance does not take place during regular studio operations.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in particular in protecting the premises and the property located there and in preventing and, where necessary, investigating criminal offences.
Video recordings are stored only for the shortest period required to achieve these purposes and are subsequently deleted, unless they are required to preserve evidence relating to a specific incident. In the event of a relevant incident, the recordings concerned may be retained until the matter has been conclusively resolved or legal claims have been asserted or defended and may, where necessary, be disclosed to the competent authorities.
Access to the recordings is restricted to authorised persons.
Separate notice of the video surveillance is provided in the entrance area.
14. Photo and video recordings during classes and events
Photos or videos may occasionally be taken during individual classes or events for Body Atelier's public relations activities.
Where participants are recognisable in such recordings, we obtain separate consent before the recording or publication where required. The relevant consent form provides further details, in particular about the intended publication channels and the option to withdraw consent.
Participation in our regular classes does not depend on consenting to the use of photographs or video recordings for promotional purposes.
15. Cookies and similar technologies
As a general principle, our website is intended to use only technical functions that are necessary to provide the service.
Where only technically necessary cookies or similar storage technologies are used, they are used in accordance with the applicable statutory provisions.
If analytics, marketing or other technologies requiring consent are used in the future, they will be activated only after the relevant consent has been obtained.
Important: Because the Eversports booking system is embedded directly into the website, we will conduct a technical review before publication to determine whether the integration sets cookies, uses local storage or other technologies, or establishes third-party connections that require prior consent. If this is the case, an appropriate consent management system will be used.
16. Retention period
We store personal data only for as long as necessary to fulfil the respective processing purpose or for as long as statutory retention obligations apply.
If the respective processing purpose no longer applies and there are no statutory retention obligations or other legal grounds for continued storage, the data concerned will be deleted.
Statutory retention periods, in particular those arising from commercial and tax law, remain unaffected.
17. Recipients of personal data
Personal data is disclosed to third parties only where there is a legal basis for doing so.
Recipients may include, in particular, IT and hosting service providers used by us, Eversports, payment service providers, EGYM Wellpass, accounting and tax service providers, and, where required by law, authorities or other public bodies.
Where service providers process personal data on our behalf, the statutory requirements for commissioned processing pursuant to Art. 28 GDPR are observed.
18. Your rights
Subject to the applicable statutory requirements, you have in particular the right to:
Access the personal data we process pursuant to Art. 15 GDPR,
rectification of inaccurate data pursuant to Art. 16 GDPR,
erasure of your data pursuant to Art. 17 GDPR,
restriction of processing pursuant to Art. 18 GDPR,
data portability pursuant to Art. 20 GDPR, and
object to certain processing pursuant to Art. 21 GDPR.
Where processing is based on your consent, you may withdraw that consent at any time with effect for the future pursuant to Art. 7(3) GDPR. This does not affect the lawfulness of processing carried out before the withdrawal.
To exercise your rights, you can contact us at any time at moin@bodyatelier.de.
19. Objection to processing based on legitimate interests
Where we process personal data on the basis of Art. 6(1)(f) GDPR, you have the right pursuant to Art. 21 GDPR to object to such processing on grounds relating to your particular situation.
20. Right to lodge a complaint with a supervisory authority
Pursuant to Art. 77 GDPR, you have the right to lodge a complaint with a data protection supervisory authority if you believe that the processing of your personal data infringes data protection legislation.
The data protection supervisory authority of the State of Lower Saxony is generally responsible for us.
21. Current version of this Privacy Policy
We reserve the right to amend this Privacy Policy if our website, the services we use or the legal requirements change.
Last updated: September 2026