Privacy notice and cookies
What the studio keeps, each on its own hook
Reading this site puts nothing about you in the studio’s store; only a page-speed measurement, set out below, travels with a page view. A member account keeps only what you type into it, for the reasons below, and you can delete all of it yourself.
EXTREME PILATES LTD gives this notice under the UK GDPR, read with the Data Protection Act 2018. Each line was checked against the Worker code that stores the entries it describes. Last changed 13 November 2026.
Who holds it
The controller is EXTREME PILATES LTD, a private limited company registered in Scotland, company number SC901077, registered office 142 Crownpoint Road GLASGOW, G40 2AE United Kingdom. Questions about this notice, and every request below, go to classes@extremepilates.live, ideally with “Privacy” in the subject.
There is no data protection officer, as a studio of this size is not required to name one: the people who run the studio read that address themselves.
What is kept, item by item
Five kinds of entry in the studio’s store on Cloudflare, and nothing else about people.
| Entry | What is in it | Kept until |
|---|---|---|
| Your account |
| You delete the account, or ask the studio to |
| Address finder | Your email, one-way hashed, linked to your account number: it lets sign-in find you while the address itself is kept only once. | The account is deleted |
| Founding list | For each person on it, the time they joined and their account’s internal number. Your place is your position in it, counted as it stands. | You leave the list, or delete the account |
| Signed-in session | Your account’s internal number and when you signed in, stored under a one-way hash of the key in your cookie. | You sign out, change your password, or fourteen days pass, whichever comes first |
| Password reset link | Your account’s internal number, stored under a one-way hash of the link. The link itself goes only to the studio’s mailbox, and from there only to your signed-up address, in reply to a message from it. | It is used, or seven days pass |
The store also holds one key the site uses to sign its forms, which is about no one. Nothing is kept about attempts. To slow down guessing, Cloudflare’s rate limiter counts form sends for one minute: sign-in, sign-up and reset attempts against your connection’s IP address and a one-way hash of the email typed, every other form against the IP address alone. The studio never sees or keeps those counts.
No health data is collected online. No form asks about health, injuries, your body or fitness, and none has anywhere to put it. Anything that changes how a machine is set for you is talked through in person at the studio, and it is not part of this website.
Why, and on what lawful basis
- Steps you ask for, before any contract
- The account itself, signing in, your Foundation-block application, your intro-session request and your saved chart pairs: they exist because you asked for them. UK GDPR Article 6(1)(b).
- Your consent
- Telling you when the timetable and the Foundation block open, using your founding-list preferences. You gave it with the tick box when you joined; leaving the list or deleting the account withdraws it. Article 6(1)(a).
- Keeping the site safe
- Hashed sessions, signed forms and the one-minute attempt counts protect accounts from guessing and the site from robots. The studio’s legitimate interest in that is weighed against yours; nothing is kept beyond the minute. Article 6(1)(f).
- Answering you
- When you write to the studio, your message and address are used to answer it. About a session, Article 6(1)(b); anything else, 6(1)(f).
There is no profiling and no automated decision about you. The founding-list place is the order people joined in, and nothing follows from it on its own.
How long, and how it goes
The account stays until you delete it or ask the studio to. Sessions end after fourteen days at most and reset links after seven days, by themselves. A deletion takes effect at once on the studio’s side; Cloudflare’s network can take up to a minute to stop serving the old copy everywhere.
An email you send stays in the studio’s mailbox until what you asked is dealt with, and is then deleted. The site itself emails only one place, the studio’s own mailbox: a short note when you apply for the Foundation block, ask for an intro session or ask for a password reset, carrying your name, email and what you chose. It never emails you; the studio answers from classes@extremepilates.live.
Who else touches it
The site runs on Cloudflare, Inc., which acts for the studio as its processor: the pages, the store that holds the entries above, the rate limiter, and the email routing that carries the site’s notes to the studio’s mailbox. Its network spans many countries, so the stored entries can sit on servers outside the UK; Cloudflare’s customer data processing addendum sets out the transfer safeguards it relies on. Cloudflare also handles connection details such as IP addresses to deliver pages and stop abuse, under the same terms. The studio has not switched on any request logging of its own.
An email you send, and each note the site sends the studio, sit in the studio’s mailbox with its email provider. Nobody else receives your details. There is no advertising and no tracking from one site to another, and the only measurement is the page-speed row below; and nothing is sold or shared, unless the law requires the studio to hand something over.
Page-speed measurement
The host adds Cloudflare Web Analytics to the reading pages, not to the account pages. It is a beacon script, loaded from static.cloudflareinsights.com, that sends Cloudflare the address of the page, how long it took to load, the browser and system version, and a random number for that one page view. No cookie comes with it, and your browser keeps nothing from it. Lawful basis: Article 6(1)(f), the studio’s interest in a site that answers fast. If the studio switches it off, this row is removed.
Cookies: one, and only once you sign in
Reading the pages and using the spring colour translator set none.
| Cookie | Its job | Lifetime | Type |
|---|---|---|---|
crg_strap | Keeps you signed in to the member account. It holds a random key; the studio keeps only a one-way hash of it. It is created the moment you open an account or sign in, and belongs to this site alone. | Fourteen days, or until you sign out | Strictly necessary. HttpOnly, Secure, SameSite=Lax |
Nothing else is stored in your browser: no other cookie, no local storage, no advertising tag; the page-speed beacon stores nothing either. The Privacy and Electronic Communications Regulations exempt a cookie that a service you asked for cannot work without, so this one needs no consent and no banner appears. Signing out deletes it, and ends the session on the studio’s side too.
What you can make the studio do
A copy
On request, the full set of entries about you. Signed in, your account pages already show what you entered.
Put it right
Preferences, applications and requests are yours to edit in the account; a wrong name or email is changed when you write.
Erase it
Delete account clears every entry above in one go. Leaving the founding list, or withdrawing a request, clears only that part.
Carry it elsewhere
The same entries, sent to you as a plain JSON file another service can read.
Stop or pause a use
Object to one way your details are used, or have them frozen, untouched, while a question about them is settled.
Take back consent
Leave the founding list, and the studio stops planning to tell you when the timetable opens.
Send any of these from the address on the account, so the studio can tell the request is yours. There is no charge. The answer comes inside one month; a complicated request may need up to two more, and if so you hear why before the first month is out.
The regulator is the Information Commissioner’s Office, and a complaint can go to it whenever you choose: through its website, ico.org.uk/make-a-complaint; its helpline is 0303 123 1113. Hearing from you first gives the studio the chance to mend things, but it is not a condition.
A security problem
Spotted a flaw in the site or the member account? Write with “Security” in the subject and say how to see it. Please test only against an account of your own. The address is also published in this site’s security.txt.