Privacy policy

Last updated: 12 October 2026

Who we are

The corcaorca.ro website and Corca Orca Pole Dance Studio are run by CORCA ORCA S.R.L., registered office Str. Florilor, bl. 25, sc. B, et. 1, ap. 6, Zărnești, jud. Brașov, Romania, Trade Register No. J2024039815008, tax ID (CUI) 50856159. Under Regulation (EU) 2016/679 (the "GDPR"), we are the controller of your personal data.

This policy covers the whole studio, not just the website: it explains what happens to your data when you visit the website, contact us, and sign up and come to classes.

For any question about your data, email us at corcaorcapoleart@gmail.com or call 0749 861 304. The studio is at Str. Făgăraș nr. 34, Sector 1, București.

In short

• This website sets no cookies, has no ads and contains no forms. Traffic statistics (Cloudflare Web Analytics) do not load at all for visitors in the European Union.
• The Google map only loads if you click "Show map".
• We use your data only to reply to you, run your classes and comply with the law. We never sell it or use it for advertising.

What data we process, why, and on what legal basis

When you visit the website

The website is hosted by Cloudflare. As with any website, its servers automatically receive your IP address, browser and device type, the page requested and the time of the visit. This data is used only to show you the website and protect it from attacks and abuse.

For traffic statistics we use Cloudflare Web Analytics, but only for visitors outside the European Union: if you visit from the EU, the statistics script does not load at all. For other visitors, it uses no cookies, stores nothing in your browser and does not identify you individually: we only see totals, such as the number of visits, the pages read, and visitors' country, device type and browser and the websites they came from.

Cloudflare processes this data on our behalf, as our processor.

Legal basis: our legitimate interest in a secure, working website and in understanding how it is used so we can improve it (Art. 6(1)(f) GDPR).

How long we keep it: Cloudflare keeps server logs only as long as needed to run and secure its service, under its own policy: cloudflare.com/privacypolicy Web Analytics statistics are kept in detail for 7 days, then only in aggregate form, for 6 months.

The Google map

The map in the Contact section does not load automatically. Only if you click "Show map" does your browser connect to Google, which receives your IP address and may set cookies. The same happens if you open the "Open in Maps" link. From then on, Google processes the data as an independent controller, under its own privacy policy: policies.google.com/privacy

When you contact us

If you call us or write to us by email, WhatsApp, Instagram or Facebook, we process your name, contact details and what you tell us, to reply and help you find the right class.

Legal basis: steps taken at your request before you sign up (Art. 6(1)(b) GDPR) and our legitimate interest in answering messages (Art. 6(1)(f)).

How long we keep it: 5 years at most.

Messages sent on WhatsApp, Instagram or Facebook are also processed by Meta, under its own policies: whatsapp.com/legal/privacy-policy-eea and facebook.com/privacy/policy

Bookings and passes

Bookings and payments are made on the Bookwhen platform (bookwhen.com). We process your name, address (to issue invoices), phone number, email, the classes you book and the passes you buy. We do not ask for anything else, such as your date of birth.

Card payments are processed by Stripe; we never see your full card details. Billing details are also passed to our accountants.

Legal basis: performing our contract with you (Art. 6(1)(b) GDPR) and our legal tax and accounting obligations (Art. 6(1)(c)).

How long we keep it: booking data, 5 years at most. Invoices and other accounting records are kept for the period required by Romanian Accounting Law no. 82/1991.

Children

Our students start at age 4. Students under 18 are signed up by a parent or guardian. We collect no data beyond the contact and billing details described above, and the parent consents to the child taking part by signing a declaration on their own responsibility.

Photos and videos

At classes, shows and competitions we sometimes take photos and videos, which we may publish on our website, Instagram and Facebook. We only publish them with your consent, which you give us on a form, or a parent's consent for minors.

Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time: after that we do not use the images in new material and we remove them from our channels.

Competitions

We do not pass your data to competition organisers: each competitor registers in person.

Promotional messages

We do not send you newsletters, promotional emails or text messages.

Who we share data with

We work with a few providers, who process data only on our behalf or, where stated, as independent controllers:

• Cloudflare, to host the website and for traffic statistics;
• Bookwhen, for bookings, and Stripe, for card payments;
• Google, only if you load the map or open the Google Maps link;
• Meta (WhatsApp, Instagram, Facebook), only if you message us there;
• DAF Account & HR SRL, our accounting firm, which receives billing details;
• public authorities, only when the law requires it.

Some of these providers process data outside the European Economic Area, for example in the US or the UK. In those cases data is transferred only with the safeguards the GDPR requires: a European Commission adequacy decision (including the EU-US Data Privacy Framework) or standard contractual clauses.

Cookies

Our website sets no cookies and stores nothing in your browser (Cloudflare Web Analytics uses no cookies either), which is why we do not ask for consent with a banner. The one exception is the Google map: if you choose to load it, Google may set its own cookies.

Links to Instagram, Facebook, Bookwhen and Google take you to their websites, which have their own privacy and cookie policies.

Your rights

Under the GDPR, you have the right to:

• find out what data we hold about you and get a copy of it;
• have incorrect or incomplete data corrected;
• have your data erased when we no longer have a legal reason to keep it;
• restrict how we process it;
• receive your data in a structured format or have it sent to another controller (portability);
• object to processing based on our legitimate interest;
• withdraw your consent at any time, without affecting processing done before.

We do not make decisions based solely on automated processing. To exercise any of these rights, email us at corcaorcapoleart@gmail.com. We reply within one month.

If you are not satisfied with our answer, you can complain to the Romanian data protection authority, ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal), B-dul G-ral. Gheorghe Magheru nr. 28-30, Sector 1, Bucharest: dataprotection.ro

How we protect your data

The website only uses encrypted connections (HTTPS). Only the sole director of CORCA ORCA S.R.L. has access to students' data, and our accounting firm, DAF Account & HR SRL, to billing details.

Changes

We may update this policy when the way we handle data changes. The current version is always on this page, with the date of the last update shown at the top.