PrivacyHow we handle your data

Who we are

Exhale Performance BV
André Emondstraat 38i, 3012 Leuven, Belgium
Company and VAT number BE 1035.951.684, RPR Leuven
info@exhaleperformance.com · +32 479 53 51 54

We are responsible for the data you give us through this site, the webshop, the app, the front desk and our messages.

What data, and why

Membership and payments

Your name, contact details, date of birth, address, your bank account number for the direct debit and your membership. For a student or emergency services rate, you show your student card or your badge. We use this data for your membership and your payments. Legal basis: our contract with you (Art. 6(1)(b) GDPR). Without this data we cannot set up your membership. Member management and the webshop run on Virtuagym, payments on Mollie.

The app and your coaching

As a member you can use the Virtuagym app, for example for training plans, your progress and messages with your coach. Virtuagym stores what you put in the app on our behalf. We use it to coach you. Legal basis: our contract with you. Your coach and our team only see what they need for this.

Guests and day passes

If you come with a day pass, a 10-visit card or as a guest, we record your name and contact details at the front desk. That way we know who is in the club. Legal basis: our contract with you.

Booking a group class

Your name, email, mobile number and the class you choose. We use them to reserve your spot and to let you know if anything about the class changes. Legal basis: our contract with you (Art. 6(1)(b) GDPR). Bookings are stored with Netlify, on servers in the United States.

Forms and messages

When you ask for an intro or a tour, sign up for an event or the All-in waiting list, or message us by phone, email, WhatsApp or Instagram, we receive your name, your contact details and your question. We use them to answer you and to make an appointment. Legal basis: the steps you ask for (Art. 6(1)(b) GDPR). We answer a general question based on our legitimate interest (Art. 6(1)(f) GDPR). For the All-in waiting list we ask for your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time.

With such a request we also receive which link, ad or advertisement brought you to the site and how you heard about us (if you fill that in). That tells us which advertising works. Legal basis: our legitimate interest in measuring our advertising (Art. 6(1)(f) GDPR).

If you ask for an intro call with a coach, we pass your request on to that coach. Our coaches are self-employed. If you book coaching with them, your coach is responsible for the data needed for that coaching.

Data about your health

Sometimes you tell us something about your health, such as an injury. Or you fill in a health profile or health declaration, or you give us a medical certificate to pause your membership. This is sensitive data. We only use it to let you train safely or to arrange your pause, and only if you explicitly agree (Art. 9(2)(a) GDPR). Only the staff and the coach who need it can see it, and they keep it confidential. You can withdraw your consent at any time.

If an accident happens in the club, we record what happened and what help we gave. We do this so we can handle a claim with our insurer. Legal basis: establishing or defending legal claims (Art. 9(2)(f) GDPR).

Access to the club

Members open the door with a badge. The access system (UniFi Access) records when a badge is used. Legal basis: our legitimate interest in safety and access (Art. 6(1)(f) GDPR).

Cameras in the club

There are cameras in the shared areas of the club. There are none in the changing rooms, showers or toilets. We use the footage to protect members, staff and property and to clear up incidents. Legal basis: our legitimate interest in safety. Only the manager and the staff appointed for this view the footage. If it is needed as evidence of an incident, we only share it with the police or the judicial authorities. Signs at the entrances show where you are filmed. You may request footage in which you appear.

Visiting this site

When you visit the site, our host Netlify processes technical data such as your IP address, your browser and the page you request. This is needed to show and secure the site. Legal basis: our legitimate interest in a secure, working site.

If you choose statistics in the cookie banner, we count your visit with Google Analytics and Cloudflare Web Analytics. This shows us which pages and buttons are used. Google and Cloudflare receive your IP address and details about your browser and device. Google Analytics does not store IP addresses. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it anytime via "Cookie settings" at the bottom of every page.

If you choose advertising in the cookie banner, we load the Meta pixel. This shows us which ads on Facebook and Instagram work, for example whether someone requests a tour or taps "Join now" after seeing an ad. Meta also uses this data to tailor ads to you. Meta receives your IP address, details about your browser and device, which pages you view and whether you request a tour or an intro call with a coach, book a group class (also on the waiting list), sign up to hear when All-in starts, tap "Join now" or tap a button to call, email or contact us via WhatsApp or Instagram. With that we only send which membership, class or channel it is about. We and Meta Platforms Ireland are jointly responsible for collecting and passing on this data. The arrangement is set out in Meta's Controller Addendum: we inform you and ask for your consent, and Meta handles your rights for the data Meta stores afterwards. You can exercise your rights with us and with Meta. What Meta does with the data afterwards is decided by Meta. You can read about it in Meta's privacy policy. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it anytime via "Cookie settings" at the bottom of every page.

Reviews on the site

On the homepage we show a few reviews that customers wrote on Google, with their first name and the first letter of their surname. Legal basis: our legitimate interest in showing what customers say about us. Don't want your review shown here? Email info@exhaleperformance.com and we will remove it.

Marketing

We only send marketing if you choose to receive it, for example by ticking a box yourself. Members receive an occasional member email about the club. Legal basis: our legitimate interest in keeping members informed (Art. 6(1)(f) GDPR). You can stop at any time: reply STOP or email us, and we remove you from all our lists the same day.

How long we keep your data

• Requests, visits with a day pass, a 10-visit card or as a guest, and other contacts: 12 months if you do not become a member.
• Class bookings: 12 months.
• All-in waiting list: until All-in starts, plus 3 months.
• Marketing list: until you unsubscribe.
• Member data and messages with members: as long as you are a member. Invoices and payments are kept as long as accounting law requires (10 years).
• Health data: as long as you are a member. A medical certificate to pause: until your pause ends.
• Accident report: 5 years.
• Badge use at the door: 3 months.
• Camera footage: up to 30 days, longer only as evidence of an incident.
• Statistics in Google Analytics: 2 months.

Who we share data with

Only with the companies that help us, and only for the purposes above: Virtuagym (member management, webshop and the app), Netlify (website, forms and class bookings), Google (email, our lists, statistics and the map on the site), Cloudflare (visitor statistics), Meta (if you contact us via WhatsApp or Instagram, and to measure and tailor ads if you choose it; what Meta then does with that data is decided by Meta), ManyChat (automatic replies on WhatsApp), our accountant, our insurer (after an accident) and our self-employed coaches (intro requests). We never sell your data.

Mollie processes your payments. As a payment institution, Mollie is also a controller in its own right for this (see mollie.com/privacy).

Netlify, Google, Meta, Cloudflare and ManyChat are US companies. Netlify, Google, Meta and Cloudflare participate in the EU-US Data Privacy Framework, for which the European Commission decided that protection is adequate. ManyChat uses that framework or the standard contractual clauses of the European Commission, also for its support team in Armenia. You can request a copy of those clauses at info@exhaleperformance.com. Virtuagym and Mollie are Dutch companies.

Your rights

You may access your data, have it corrected or erased, restrict processing and ask for a copy to take with you. If you gave consent, you can withdraw it at any time. We reply within one month.

Your right to object

When we use your data based on our legitimate interest, such as the badge at the door, the cameras or measuring our ads, you can always object. We then stop, unless we have a compelling reason, such as safety in the club. You can always object to marketing and member emails, without giving a reason.

If you are unhappy with our answer, you can file a complaint with the Belgian Data Protection Authority, Drukpersstraat 35, 1000 Brussels (dataprotectionauthority.be).

Cookies and storage on your device

Below is everything this site stores on or reads from your device. Anything that is not needed to make the site work only happens if you choose it.

What	What for	How long	When
exh_toestemmingExhale	Remembers your cookie choice.	6 months	When you make a choice
lang_enExhale	Sends you straight to the English site if you tapped EN before.	6 months	When you tap EN. Tap NL and we delete it.
exl_mine, exl_meExhale, browser storage	Remembers on /en/lessen which classes you booked and, after a booking, your name, email and mobile number for next time.	Until you clear your browser	When you open /en/lessen or book a class
_ga, _ga_MKS9J17J51Google Analytics	Counts visits and clicks.	6 months	Only if you choose statistics
No cookieCloudflare Web Analytics	Counts pages visited and loading times.	Nothing on your device	Only if you choose statistics
Google cookies such as NIDGoogle Maps	Shows the map on the homepage.	NID: 6 months	Only if you tap "Show map"
_fbp, _fbc and Meta cookies such as frMeta pixel	Measures which ads work and tailors ads.	3 months	Only if you choose advertising

The fonts and images on this site come from our own server. You can change or withdraw your choice anytime via "Cookie settings" at the bottom of every page. More about Google's cookies: policies.google.com/technologies/cookies.

Changes

If we update this statement, the new version and date appear on this page.