Privacy policy

A. If you are a client of a studio

Who decides. The studio you book with is the controller of your data: it decides what data it needs and why. Livva is the processor: it processes the data on the studio's behalf, only to run bookings and payments, under the contract between Livva and the studio (art. 28 GDPR).

What data. Your name, phone number and email; your bookings, attendance, packages, memberships and payments (amount, date, confirmation); the log of actions in your account and your IP address when you sign in. Email is required: it's where you get your sign-in code, confirmations and class updates. Card details are processed only by Stripe; they never reach Livva or the studio. We don't ask for health data.

Why and on what legal basis. So you can book, pay and get what you bought (performing your relationship with the studio, art. 6(1)(b) GDPR); so the studio can keep the payment records the law requires (art. 6(1)(c)); for account security and preventing abuse (legitimate interest, art. 6(1)(f)). You only get news and offers if you tick a separate box saying you want them (consent, art. 6(1)(a)), and you can withdraw that consent anytime.

Who sees it. Your studio; Livva, as far as needed to run the platform; the providers that help us (hosting of the app and database in Frankfurt, sending emails from the EU). Card payments are processed by Stripe, on the studio's own account, or by the studio's payment provider if you pay through its link. The providers are listed in Annex 2 of the Livva contract for studios.

Where it's stored. Data is hosted in the European Union. Some providers are based in the US; the European Commission's standard contractual clauses apply to them.

How long. As long as you're a client of the studio. If the studio leaves Livva, its clients' data is deleted within 90 days (or sooner, at the studio's request). Your payment records are kept by the studio, for its accounting obligations: while it uses Livva they stay here; when it leaves, it receives them in the data export and they are deleted from Livva along with everything else. Technical logs, at most 3 years.

Your rights. You can ask for access to your data, correction or deletion, restriction of processing, portability, and you can object to processing. Write to your studio, which is the controller; if you write to us at contact@livva.app, we pass your request on and help the studio reply within 30 days.

B. If you represent a studio using Livva

Here Livva is the controller of the data.

What data. Company details (name, tax or VAT number, address, country), the name and contact details of the person representing the studio, the history of the subscription and payments (card details only at Stripe), proof of contract acceptance (version, date and time, IP address, person), help requests sent from the dashboard (including screenshots), the log of actions in the dashboard and the IP address when signing in.

Why and on what legal basis. To provide the service and communicate about it (performing the contract, art. 6(1)(b)); to issue and report invoices, keep accounts and check VAT numbers in the European Commission's VIES system (legal obligation, art. 6(1)(c)); to prove contract acceptance, protect the platform and recover amounts due (legitimate interest, art. 6(1)(f)). We don't send marketing messages without the studio's separate consent.

Who sees it. Stripe (subscription payments), SmartBill and, for studios in Romania, the Romanian tax authority through RO e-Factura (invoices), the European Commission through VIES (VAT number checks), hosting and email providers and Livva's accountant.

How long. For the duration of the contract; proof of contract acceptance, for 3 more years after it ends; invoices, 5 years, under accounting law; technical logs, at most 3 years.

C. If you visit livva.app

The contact form. If you leave us your studio's name, your name, city and a phone number or email, we use them only to contact you about Livva, at your request (steps before a contract, art. 6(1)(b)). We keep them for at most 2 years from the last contact, or until you ask us to delete them.

Your country. On the home page we work out from your IP address which country you're visiting from, so we can ask whether you want the site in English; we don't keep the IP address. If you answer, we remember your answer in a cookie (only the country).

Security. We keep the IP address of people who submit forms in the technical log, for at most 3 years, to stop spam and abuse (legitimate interest, art. 6(1)(f)).

Cookies

We use two cookies, both necessary: one keeps you signed in so you don't have to sign in on every visit, and one remembers your answer to the country question on the home page. We don't use tracking or advertising cookies.

Your rights and complaints

For the data Livva processes as controller (parts B and C), you have the right of access, rectification, erasure, restriction, portability and objection, and you can withdraw any consent you gave at any time. Write to us at contact@livva.app; we reply within 30 days. We don't make automated decisions with legal effects on you.

You can complain to the data protection authority in your country; in Romania, ANSPDCP (dataprotection.ro).

Changes

When we change this policy, we publish the new version here, with its date. Studios are told by email about important changes.