Privacy notice

You can manage Pilates bookings and passes directly through Bloom. We use your email address to identify your account and keep the name and phone number you provide, any assigned account discount, and records of your bookings, passes and studio payments. We also store the billing name, address and company tax number you provide, together with references to issued invoices.

You can sign in with your email and password or, when available, your Google or Facebook account. We email you to confirm registration and to set or reset your password. Social sign-in uses the basic profile details and email address received from Google or Facebook. Google sign-in does not give access to your Gmail messages, calendar or files. We may fill an empty profile with the name received; you can change it later.

Supabase provides sign-in and data storage, Vercel operates the website, and Resend delivers sign-in and service emails. Contact info@bloombydori.hu about the handling of your account and booking data.

With Marketing consent, we may report ticket or pass selection, the start of a booking, a successful reservation, an unpaid pass request and a completed payment to Meta. We may share the product identifier and category, HUF amount, quantity and an event identifier. We do not report a pass request as a payment. With Analytics consent, we may also report a successful reservation and the number of places to Google Analytics.

When Meta purchase measurement is enabled, we may share a newly recorded payment received in full even after you close your browser. This requires your own Marketing consent both when you pay and when the information is shared. The information includes the payment time and channel, full HUF amount, product identifier and quantity. We do not report historical, unpaid, free or partial purchases as completed payments. A refund does not withdraw purchase information already sent to Meta.

To match purchases with Meta’s records, we may use protected identifiers derived from your email address and Bloom account identifier, together with permitted browser and ad-click identifiers. These are not anonymous: Meta can match them with its own records. The purchase report does not include your readable email address, name, phone number, address, IP address, browser software details, staff details or class title and time. The website’s Meta Pixel may separately share browser and page information.

We use Supabase to store Marketing consent confirmed while signed in, when it was given and expires, and permitted matching identifiers. Permission lasts 180 days from the original cookie choice. Turning Marketing off stops purchase information that has not yet been sent for your current account and accounts linked in the same browser. Cookie settings cannot withdraw information already received by Meta; contact info@bloombydori.hu with a data-processing request.

You can separately choose to connect Google Calendar from My calendar. You do not need to use Google sign-in for your Bloom account, and a calendar connection is not required to book. When you authorize the connection, Bloom creates a separate “bloom by Dóri” calendar in your selected Google account. Access is limited to calendars created by the Bloom app and their events; it does not grant access to your other calendars.

For future confirmed bookings, Google receives the class title and times, studio location, a link to the booking-management page and identifying information needed to link the event to your booking. We do not send attendee lists, payment or billing data. Bloom updates the linked event when the class changes and removes it after cancellation. Editing or deleting a Google Calendar event does not change or cancel your Bloom booking.

To operate the connection, we securely store the access granted by Google, linked calendar and event identifiers, and information about updates and errors. This allows updates to continue after you close your browser. Information received from Google is used to operate the calendar connection and resolve problems, not for advertising. Google also handles calendar-service information under its own privacy policy. Bloom uses Vercel and Supabase to operate its side of the connection.

You can disconnect from My calendar and keep or remove events linked to Bloom. Kept events stop receiving Bloom updates. Removal leaves the calendar itself and separately added events intact; an error may delay deletion. We remove the stored access when you disconnect or when requested deletion finishes, and attempt to revoke Google’s permission. You can stop pending deletion and keep the events, or revoke permission in your Google account settings. Connection and event identifiers and status records remain for reconnection and resolving problems. Your Bloom bookings are unchanged. Contact info@bloombydori.hu with a data-processing or deletion request.

The form asks for your name, email address and selected class. A phone number and message are optional. Limited technical log data — such as an IP address, timestamp and request data — may also be generated by the hosting service to operate the site securely.

To limit abuse and repeated messages, we use Supabase to store protected identifiers derived from the IP address or network, email address and form content, plus the submission identifier and time. These are not anonymous data; this security record does not contain the original IP address, email address or message. Only entries from the previous 24 hours count toward limits, and older entries are deleted at the next valid submission attempt. Our legitimate interest is to protect the form, recipients and email service.

We use Supabase to keep separate delivery records to prevent duplicate emails and resolve delivery problems. They contain protected identifiers for the submission, content and sending settings, delivery attempts, status and times, and the provider’s message identifier. These are not anonymous, but the records do not contain the original form text, email address or IP address. Delivery records currently have no automatic expiry; the security record’s 24-hour cleanup does not apply to them.

We process the data to send an automated acknowledgement of receipt, respond to the enquiry, discuss availability and participation, and take steps at your request before a possible service agreement. For a general question not aimed at entering an agreement, the controller’s legitimate interest is to answer and manage the correspondence.

Your name, email address and selected class are needed to identify and answer the enquiry. The form cannot be submitted without them.

An enquiry about a children’s class must be submitted by the child’s parent or another adult legal guardian. Please do not include health information or other special-category or sensitive personal data in the message. If such information later becomes strictly necessary for participation, it will be discussed separately with appropriate information.

We use technical service providers only to the extent necessary to operate the website and deliver messages. Submissions may be accessed by the controller and the authorised personnel involved in the following services.

With Analytics consent, Vercel Web Analytics aggregates public page views, successful enquiries and bookings. Account, calendar and admin pages are excluded. We remove additional information from shared page addresses; our own measurement events contain no names, email addresses, form text or booking identifiers.

The service may also process browser, device, country and referrer information. This configuration does not create analytics cookies or persistent browser identifiers. Bloom by Dóri and its website technical operator, Levisions, use the aggregates to understand website use. Withdrawing Analytics stops further measurement.

With Analytics consent, Vercel Speed Insights measures loading and interaction speed on public and signed-in customer pages using browser performance metrics. Vercel may receive the page route and URL, browser, device and operating-system type, network speed, country and Web Vital measurements. Vercel says these measurements do not identify an individual visitor or join their page views into a browsing session.

Measurement runs on selected public pages of www.bloombydori.hu and, after sign-in, Account and My calendar. Admin and confirmation pages, and account/calendar screens before sign-in, are excluded. Sign-in controls on public booking and passes pages may be included. We remove additional information from shared page addresses and do not supply booking or purchase identifiers for measurement. Withdrawing Analytics stops further measurement.

The Meta Pixel activates only when the feature is technically enabled and the visitor has consented to the separate Marketing category. It is intended to measure whether ads shown on Facebook or Instagram result in website visits, enquiries, bookings or purchases, and to support campaign attribution, optimisation and the creation of remarketing audiences.

Information shared by Meta Pixel may include the action and its time, visited page names and addresses, referring page addresses, browser and device details, IP address, and browser or ad-click identifiers. We do not supply names, email addresses, telephone numbers, billing details, form messages, class titles or times, or information about an identifiable child for browser measurement. The separate matching information used for purchase measurement is explained in the booking and account section.

The recipient and provider of the Meta Business Tools is Meta Platforms Ireland Limited. Under its own terms and privacy notice, Meta may combine the data with information from other Meta products and may process it outside the European Economic Area. Meta’s current notices describe the applicable transfer safeguards.

When Meta Pixel is used, the website operator is responsible for selecting the technology, obtaining consent, and collecting and transmitting event data to Meta. Meta processes the data it receives further under its own terms; the applicable joint-controller and processing provisions are described in the current Meta Business Tools Terms.

Some technical service providers may process data outside the European Economic Area. Where this occurs, the transfer relies on the applicable GDPR safeguard made available by the provider, such as an adequacy decision or standard contractual clauses.

Google Maps loads only after you allow External services or select “Load map”. From that point, Google’s own terms and privacy notice may also apply.

Where the legal conditions apply, you may request access to, correction or erasure of your personal data, restriction of processing, object to processing based on legitimate interests, and exercise your right to data portability. Send requests to info@bloombydori.hu.

If you believe that the processing infringes your rights, you may lodge a complaint with the Hungarian National Authority for Data Protection and Freedom of Information or seek a judicial remedy.

We may update this notice when services, technical settings or legal requirements change. The current version is always available on this page.