Club Pilates Düsseldorf / JULISTIK GmbH Status: April 2026 Controller JULISTIK GmbH Address Grafenberger Allee 157, 40237 Düsseldorf, Germany Data protection contact datenschutz@clubpilates.com.de Website Club Pilates / local studio website or booking and information pages Notice This privacy policy is tailored to the website of Club Pilates Düsseldorf to the services specified by you. It explicitly covers newsletter, Google Maps, Instagram, WhatsApp and appointment bookings via Glofox as well as other standard services requested by you. If individual services are not yet technically active on every subpage, the respective sections apply only in the event of their actual integration or use.

I. Name and address of the controller Controller within the meaning of the General Data Protection Regulation (GDPR), other data protection laws applicable in the Member States of the European Union and other provisions of data protection law is: JULISTIK GmbH Grafenberger Allee 157 40237 Düsseldorf Germany Email: datenschutz@clubpilates.com.de Website: the online presence of Club Pilates Düsseldorf operated by JULISTIK GmbH II. Data protection contact If you have any questions about data protection, you can contact us at any time at: datenschutz@clubpilates.com.de III. General information on data processing 1. Scope of the processing of personal data We process personal data of our users only insofar as this is necessary to provide a functional website as well as our content and services. If consent is required for processing, we obtain it in advance via our consent management tool.

2. Legal bases of processing The processing of personal data is carried out in particular on the basis of Art. 6 para. 1 lit. a GDPR (consent), Art. 6 para. 1 lit. b GDPR (contract or pre-contractual measures), Art. 6 para. 1 lit. c GDPR (legal obligation) and Art. 6 para. 1 lit. f GDPR (legitimate interests). If consent is required for storing information on end devices or accessing it, this is carried out in accordance with Section 25 TDDDG. 3. Data deletion and storage duration Personal data is deleted as soon as the purpose of storage no longer applies and no statutory retention obligations or legitimate reasons for longer storage exist. If statutory retention obligations exist, processing is restricted to this purpose. IV. Use of our website / server log files Each time our website is accessed, our system automatically collects data and information from the computer system of the accessing end device. In particular, the following may be processed: browser type and browser version, operating system used, referrer URL, IP address, date and time of access, accessed pages and files, amount of data transferred, access status and information about the end device used. The data is stored in log files. Processing is carried out to ensure the functionality of the website, to ensure the security of our information technology systems and to clarify misuse. Legal basis is Art. 6 para. 1 lit. f GDPR. Data stored in log files is generally deleted or anonymized after seven days at the latest, unless longer storage is required for evidentiary purposes.

V. Cookies and consent management Our website uses cookies and comparable technologies. Technically necessary technologies are used on the basis of Section 25 para. 2 TDDDG and Art. 6 para. 1 lit. f GDPR. All non-essential technologies, in particular analysis, marketing and convenience services, are only activated after your consent in accordance with Section 25 para. 1 TDDDG and Art. 6 para. 1 lit. a GDPR. For the management and documentation of your consents, we may use Usercentrics, Usercentrics GmbH, Rosental 4, 80331 Munich. Consent data, log data, consent ID, time of decision, device information and, if applicable, browser information are processed. Legal basis is Art. 6 para. 1 lit. c GDPR in conjunction with our obligation to provide evidence as well as Art. 6 para. 1 lit. f GDPR. The storage duration is based on the statutory proof and limitation periods. You can adjust or withdraw your selection at any time via the “cookie settings” link. VI. Contact via email, contact form and telephone If you contact us by email, contact form or telephone, we process the data you provide (e.g. name, email address, telephone number, message, appointment requests) in order to process your request. Legal basis is Art. 6 para. 1 lit. b GDPR, insofar as your request is aimed at concluding or performing a contract, otherwise Art. 6 para. 1 lit. f GDPR. If we use a contact form with mandatory fields, additional technical data collected serves to prevent misuse and ensure system security. The data will be deleted as soon as your request has been finally processed and no statutory retention obligations prevent deletion. VII. Newsletter If you subscribe to our newsletter, we process your email address and, if applicable, other data voluntarily provided by you in order to send you information about offers, promotions, studio news and events. Registration generally takes place using the double opt-in procedure. We store the time of registration, the time of confirmation and the technical verification data used in order to be able to document the registration in a legally secure manner. Legal basis is Art. 6 para. 1 lit. a GDPR. You can withdraw your consent at any time with effect for the future, e.g. via the unsubscribe link in the newsletter or by email to datenschutz@clubpilates.com.de

VIII. Appointment booking, membership management and lead management via Glofox For appointment bookings, course registrations, waiting lists, membership management, check-in processes, communication in connection with bookings as well as, if applicable, payment processing and management of interested parties, we may use services from Glofox. In particular, master data, contact data, booking data, contract data, communication data and usage-related data may be processed. Legal basis is Art. 6 para. 1 lit. b GDPR, insofar as the processing is necessary for bookings, memberships or pre-contractual measures; additionally Art. 6 para. 1 lit. f GDPR for efficient studio and appointment organization. If Glofox acts on our behalf, processing is carried out on the basis of a data processing agreement. Please add in the final website version the exact company name and address of the Glofox provider actually used in accordance with your contract.

IX. WhatsApp communication If we offer contact or service communication via WhatsApp, your telephone number, communication content, metadata of the communication as well as any information voluntarily transmitted by you may be processed. Legal basis is Art. 6 para. 1 lit. b GDPR in the case of contract-related inquiries, otherwise Art. 6 para. 1 lit. a or lit. f GDPR, depending on the occasion of the communication. Please note that when using WhatsApp, it cannot be ruled out that Meta companies may also process personal data for their own purposes. We recommend not transmitting sensitive health data or other confidential information via WhatsApp. For data protection-sensitive matters, please use email or telephone. X. Google Maps Maps from the Google Maps service may be integrated on our website. Provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When displaying the maps or accessing corresponding subpages, personal data, in particular your IP address and usage data, may be transmitted to Google. If the integration is not purely technically necessary, this is only carried out after your consent on the basis of Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TDDDG. XI. Instagram Content or links from Instagram may be integrated on our website. Provider for users in Europe is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. In the case of active integration, data may already be transmitted to Meta when the corresponding content is loaded. If cookies or similar technologies are used for this purpose, this is only done after your consent in accordance with Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TDDDG. XII. Google Analytics 4 If you have given your consent, Google Analytics 4 may be used on this website. Provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics enables us to evaluate the use of our website and to create reports on website activities. In particular, pseudonymous usage data, interactions, technical information about the browser and end device as well as approximate location data may be processed. According to Google, IP addresses of users from the EU are discarded before logging and are not stored. Legal basis is your consent in accordance with Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TDDDG. The storage duration depends on the retention period configured in Google Analytics. We have no influence on any further processing by Google. XIII. Meta Pixel / conversion tracking If you have given your consent, the Meta Pixel may be used on our website. Provider is Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. With the help of the Meta Pixel, we can track the behavior of users after they have clicked on a Meta advertisement or interacted with our website. This enables us to measure the effectiveness of our advertising measures and to create target groups for future campaigns. Legal basis is Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TDDDG. XIV. Integration of YouTube videos We may integrate YouTube videos into our website. Provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Where possible, we use the extended data protection mode. Only when the video is started or – depending on the integration – already when the corresponding component is loaded, data may be transmitted to Google or YouTube. Legal basis is your consent in accordance with Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TDDDG. XV. Vimeo We may integrate videos from the Vimeo service. Provider is Vimeo.com, Inc., 555 West 18th Street, New York, New York 10011, USA. When using or integrating, in particular IP address, device information and usage data may be transmitted to Vimeo. Legal basis is your consent in accordance with Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TDDDG. XVI. New Relic If we use New Relic, this serves the technical monitoring, error analysis and performance measurement of our website. Provider is New Relic, Inc., 188 Spear Street, Suite 1000, San Francisco, CA 94105, USA. Technical usage data, log data, IP address and diagnostic data may be processed. Legal basis is Art. 6 para. 1 lit. f GDPR with regard to technically necessary monitoring; if cookies or similar technologies are used or consent-based measurements take place, your consent is additionally required in accordance with Art. 6 para. 1 lit. a GDPR and Section 25 para. 1 TDDDG. XVII. Payment processing with Stripe If payments are enabled on our website, we may use the payment service provider Stripe. Provider in Europe is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin 2, Ireland. As part of payment processing, inventory data, payment data, invoice data and transaction-related information are transmitted to Stripe insofar as this is necessary for carrying out the payment. Legal basis is Art. 6 para. 1 lit. b GDPR. XVIII. Recipients, processors and third country transfers We use external service providers, in particular in the areas of hosting, website operation, marketing, communication, newsletter, video integration, appointment booking and payment processing. If these service providers act as processors, we have concluded the contracts required under Art. 28 GDPR. For some services, a transfer of personal data to third countries, in particular to the USA, cannot be ruled out. If a provider is certified under the EU-US Data Privacy Framework, the transfer may be based on the adequacy decision of the European Commission. Otherwise, we base transfers – if necessary – on standard contractual clauses or other appropriate safeguards. XIX. Rights of data subjects Within the scope of the legal requirements, you have the right to access, rectification, erasure, restriction of processing, data portability as well as objection to certain processing activities. Consents granted can be withdrawn at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority if you are of the opinion that the processing of your personal data is unlawful. XX. Objection to advertising If we process personal data on the basis of legitimate interests, you have the right to object to this processing at any time for reasons arising from your particular situation. If personal data is processed for direct marketing purposes, you have the right to object to the processing for such advertising at any time. XXI. External links Our website may contain links to external websites and services of third parties. The operators of these external providers are solely responsible for their content and data protection practices. XXII. Updating this privacy policy We reserve the right to adapt this privacy policy so that it always complies with current legal requirements or to implement changes to our services and offerings. The respective current version applies to your renewed visit. This privacy policy applies to the current online presence of Club Pilates Düsseldorf operated by JULISTIK GmbH. It is structured in such a way that the services mentioned – insofar as they are actually used on the website or individual subpages – are covered under data protection law.