Privacy policy

This page says what happens to your details on this site, in plain words. Nothing here is sold, shared for advertising, or used to profile you.

Who holds your data

Charitini Anastasia Taktikou, 49th Street 26, 4152 Kato Polemidia, Limassol, Cyprus, is the data controller. For anything on this page, write to chartakt@gmail.com.

What is collected, why, and on what basis

• Your account — first name, last name, email address, the date you created it. Needed to give you an account at all and to show you your own bookings and classes. Basis: performing our contract with you.
• Signing in — a six-digit code is emailed to you. What is kept here is never the code itself: only a one-way fingerprint of it, the number of wrong attempts, and when it expires (fifteen minutes). It is deleted once used. Basis: performing our contract, and our legitimate interest in keeping accounts from being broken into.
• Booking a lesson — your name and email from your account, the date and time, whether it is online or at the studio, how you chose to pay, the payment reference, the amount, and anything you write in the note box. Used to hold the hour, to teach you well, and to contact you about it. Basis: performing our contract with you.
• What you write in that note box. If you mention an injury, a pregnancy or a medical condition, that is health data, which the law protects more strictly. It is used for one thing — teaching you safely — and it is kept with your booking. Write it only if you want Haritini to know it; if you would rather not have it written down, tell her in person instead. Basis: your explicit consent, given by choosing to write it.
• Filmed classes — what you bought or which package you are on, what you paid, the dates it runs between, and which classes you have opened in the current period. That last one exists because a package allows a number of different classes per period and the count has to be honest — it is not watched to profile you. Basis: performing our contract with you.
• The newsletter — first name, last name, email, only if you ask for it on the home page. Basis: your consent, which you can withdraw whenever you like.
• Emails we send you — confirmations, sign-in codes, and messages about a membership or a class you have been given. Basis: performing our contract, and legal obligation for anything that is a receipt.
• Records of what was sold — kept because tax law requires it. Basis: legal obligation.

What is not collected

No advertising trackers, no analytics, no profiling, no automated decisions about you. No card numbers ever reach this site — there is no card payment on it yet, and when there is, the card details will go straight to the payment provider and never through here. Passwords exist only for the teacher’s own admin account, and only as an unreadable hash.

Who else sees it

These companies process data on our instructions, under a contract, and for nothing else:

• Netlify — runs the site. Sees the technical logs any web server sees, including your IP address. United States.
• Supabase — the database and the photographs, stored in Ireland (eu-west-1).
• Cloudflare — the domain, and the video player. When you watch a class, Cloudflare sees the request and your IP address. United States.
• Resend — sends the emails, and therefore sees your address and what the message says. United States.

Where a company is outside the EEA, the transfer rests either on the European Commission’s adequacy decision for the EU–US Data Privacy Framework or on the standard contractual clauses in the contract with that company. Nobody else is given your details — there is no sharing with advertisers, and no selling of anything to anyone. Data is handed to an authority only where the law demands it.

How long it is kept

• Your account — until you ask for it to be deleted, or after three years with no booking, no class watched and no sign-in.
• Bookings and sales — six years after the end of the tax year they belong to, because Cyprus tax law requires records to be kept that long. This applies whether or not VAT is charged.
• The note on a booking — deleted with the booking, or sooner if you ask.
• Sign-in codes — fifteen minutes, then gone.
• Newsletter — until you unsubscribe.

Your rights

You can ask for a copy of what is held about you, have it corrected, have it deleted, ask for its use to be restricted, take it elsewhere in a portable file, or object to it being used. Where something rests on your consent — the newsletter, the note you wrote — you can withdraw that consent at any time, and doing so does not undo what was lawful before.

Write to chartakt@gmail.com and you will hear back within one month. Asking costs nothing.

If you are not satisfied

You can complain to the supervisory authority in Cyprus: Office of the Commissioner for Personal Data Protection, Kypranoros 15, 1061 Nicosia (P.O. Box 23378, 1682 Nicosia), telephone +357 22 818 456, commissioner@dataprotection.gov.cy. If you live elsewhere in the EU you may complain to your own national authority instead.

Cookies

Two, both of them necessary for the site to work, and neither used to watch you:

• haritini_session — keeps you signed in. Lasts eight hours, then you sign in again. It holds no more than your account number and a signature.
• haritini_signin — lives for a few minutes while you type your sign-in code, and ties that code to the browser that asked for it. Deleted the moment it has done its job.

Because both are strictly necessary for a service you asked for, no consent banner is required. There are no analytics, advertising or third-party cookies. If any are ever added, this page changes and a proper consent banner appears first.

Children

Accounts are for people aged 14 and over. A younger dancer is very welcome — a parent books and holds the account.

Changes to this page

If what is collected changes, this page changes with it, and the date below moves. See also the terms and booking conditions.

Last updated: 1 September 2026