ANITA HORRY ACADEMY

PRIVACY POLICY

Anita Horry Academy respects your privacy and is committed to protecting personal data and handling it lawfully, fairly, transparently and securely.

This Privacy Policy explains how we collect, use, store, disclose and protect personal information when you visit our Website, contact us, create an account, purchase a product or service, enrol in an educational programme, participate in Teacher Training, attend a workshop or retreat, receive coaching or mentoring, subscribe to our communications, or otherwise interact with Anita Horry Academy.

This Privacy Policy should be read together with our Terms & Conditions, Cookie Policy and, where applicable, programme-specific information such as the AHA Student Guide, Enrolment Agreement or event documentation.

1. Who We Are

For the purposes of applicable data-protection law, the data controller is:

Anita Horry
Sole trader, trading as Anita Horry Academy

Business address:
Triq l-Ilma
Swieqi, Malta

Email: [email protected]
Website: www.anitahorryacademy.com

In this Privacy Policy, “AHA”, “we”, “us” and “our” refer to Anita Horry trading as Anita Horry Academy.

AHA is established in Malta and processes personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the Maltese Data Protection Act and other applicable data-protection legislation.

2. Who This Privacy Policy Applies To

This Policy may apply to:

• Website visitors;
• prospective students and applicants;
• current and former AHA students;
• AHA graduates;
• purchasers of digital products and online education;
• workshop and continuing-education participants;
• retreat participants;
• coaching and mentoring clients;
• Pilates Business Academy participants;
• business owners and professionals using AHA services;
• newsletter subscribers;
• people who create Website or learning accounts;
• people who contact AHA with an enquiry;
• people appearing in authorised recordings, photographs or testimonials;
• host-studio representatives, venues, educators and contractors; and
• other individuals who communicate or do business with AHA.

The information we collect depends on the nature of your relationship with us.

3. Personal Data We May Collect

We may collect and process the following categories of personal data.

Identity and Contact Information

This may include:

• first and last name;
• username;
• email address;
• telephone number;
• postal or billing address;
• country of residence;
• professional title or occupation; and
• other contact details you provide to us.

Account and Learning Information

Where you create an AHA Website or learning-platform account, we may process:

• account and login information;
• course enrolments;
• learning progress;
• completed learning activities;
• assessment information;
• account status;
• access information; and
• other information necessary to administer your online education.

Technical and Website Information

When you use our Website, we may process information such as:

• IP address;
• browser type;
• device information;
• operating system;
• pages viewed;
• Website interactions;
• referral source;
• approximate location derived from technical information;
• security information; and
• information collected through cookies and similar technologies.

Purchase and Transaction Information

We may process:

• products or programmes purchased;
• price;
• payment status;
• billing information;
• instalment information;
• transaction references;
• invoices;
• refunds;
• credits;
• payment disputes; and
• other financial-administration information.

Communications

We may retain communications between you and AHA, including:

• emails;
• Website contact forms;
• applications;
• messages;
• consultation enquiries;
• programme correspondence;
• feedback;
• complaints;
• coaching or mentoring communications; and
• other correspondence relating to an AHA service.

4. Teacher Training and Student Records

Where you apply for, enrol in or participate in an AHA Teacher Training or certification programme, AHA may process additional information necessary to administer your education and maintain appropriate academic and certification records.

This may include:

• applications and admissions information;
• previous Pilates education and experience;
• prerequisite qualifications;
• anatomy and other educational qualifications;
• attendance records;
• logged training hours;
• observation hours;
• self-practice records;
• practice-teaching records;
• assignments;
• case studies;
• written and practical assessments;
• examination results;
• assessment feedback;
• course progress;
• resits;
• certification status;
• certificates issued;
• insurance or professional documentation where required;
• approved leave of absence;
• extensions;
• academic correspondence;
• conduct or disciplinary records where applicable;
• withdrawal or termination records; and
• other information reasonably necessary to administer the programme.

We may use these records for purposes including:

• administering enrolment;
• providing education;
• monitoring academic progression;
• verifying completion of required hours;
• conducting assessments and examinations;
• determining whether certification requirements have been satisfied;
• maintaining accurate certification records;
• verifying qualifications or graduate status;
• quality assurance;
• protecting the integrity of AHA’s academic and certification processes;
• administering student policies;
• resolving complaints or disputes; and
• establishing, exercising or defending legal claims.

Retention of Student and Certification Records

AHA has a legitimate interest in maintaining accurate records of the qualifications and certifications it awards.

Core academic and certification records may therefore be retained for an extended period where reasonably necessary to verify:

• whether an individual completed an AHA programme;
• what programme they completed;
• the date and status of certification;
• assessment or examination outcomes where relevant; and
• other information reasonably necessary to establish or verify AHA certification.

A request for erasure does not automatically require AHA to destroy student, academic, certification, contractual, financial or other information that AHA has a lawful basis or legitimate need to retain.

5. Health and Special-Category Personal Data

Certain AHA services involve physical activity.

In limited circumstances, AHA may process information concerning a participant’s health where this is reasonably relevant to matters such as:

• safe participation;
• an injury or physical limitation;
• pregnancy;
• medication where relevant to safe participation;
• reasonable programme arrangements;
• a request for leave or extension;
• an incident arising during training;
• accessibility or participation requirements; or
• establishing, exercising or defending a legal claim.

Health information is classified as special-category personal data under GDPR and is subject to additional protection.

Where AHA processes health or other special-category data, we will rely on an appropriate lawful basis under Article 6 GDPR together with an applicable condition under Article 9 GDPR.

Depending on the circumstances, this may include explicit consent or another lawful condition permitted by data-protection legislation.

We seek to collect only the information reasonably necessary for the relevant purpose and restrict access to people who reasonably require it.

Please do not send unnecessary medical information to AHA.

Where evidence of a medical or physical circumstance is required, we may ask for information sufficient to establish the relevant matter rather than a complete medical history.

6. Business Coaching, Mentoring and Professional Information

Where you participate in AHA business education, coaching or mentoring, you may voluntarily provide information about your professional or commercial activities.

This may include:

• business name;
• business structure;
• pricing;
• turnover or financial information;
• client numbers;
• business plans;
• staffing;
• marketing activity;
• business challenges;
• professional objectives;
• documents submitted for review; and
• other information relevant to the service you have purchased.

We use this information primarily to provide the coaching, mentoring or educational service requested.

If information you provide contains personal data relating to another individual — such as a client, employee or contractor — you are responsible for ensuring that you have an appropriate basis for providing that information to us.

Where possible, client or third-party information should be anonymised before being supplied to AHA for educational or coaching purposes.

7. Contact Forms, Applications and Enquiries

When you contact AHA by Website form, email, telephone, social media or another communication channel, we may use the information you provide to:

• respond to your enquiry;
• provide requested information;
• arrange a consultation;
• process an application;
• assess whether a programme may be appropriate;
• take steps requested by you before entering into a contract;
• provide customer or student support; and
• maintain an appropriate record of our correspondence.

Please avoid including unnecessary health, financial or other sensitive information in general Website contact forms.

8. Purchases and Payments

AHA processes purchase and payment-related information where necessary to:

• administer your purchase;
• enrol you in a programme;
• provide a product or service;
• administer payment plans;
• issue invoices and receipts;
• process refunds or credits;
• deal with failed or disputed payments;
• maintain financial and accounting records;
• prevent or investigate suspected fraud; and
• comply with applicable legal and tax obligations.

Stripe

AHA uses Stripe to process certain online payments.

When you make a payment through Stripe, Stripe may process information necessary to complete and secure the transaction, including payment-card and billing information.

Complete payment-card details entered through Stripe are generally processed directly by Stripe rather than received or stored by AHA.

AHA may receive transaction information such as:

• your name;
• email address;
• billing information;
• amount paid;
• currency;
• payment status;
• payment-method type;
• transaction reference;
• refund information; and
• information relating to payment disputes or chargebacks.

Stripe processes personal data in accordance with its own privacy and data-protection obligations.

9. Online Learning and Member Accounts

AHA provides online education and member functionality through its Website and learning systems.

When you create an account, we may process information including:

• your name;
• email address;
• username;
• course enrolments;
• course access;
• learning progress;
• assessments;
• completion information; and
• other activity necessary to administer your education.

Where an account relates to certification, AHA may require your genuine name so that academic and certification records can be accurately maintained.

Your learning account is associated with your personal educational record and should not be shared with another individual.

10. Online Classes, Video Conferencing and Recordings

Certain AHA classes, Teacher Training sessions, workshops, coaching sessions and other educational activities may be delivered using video-conferencing or online-learning platforms.

Where AHA records a session, participants will be informed where appropriate.

A recording may contain:

• your name;
• image;
• voice;
• questions;
• comments;
• demonstrations; and
• other contributions made during the session.

AHA may use recordings for legitimate programme purposes, including making teaching available to authorised participants who were entitled to attend or review the relevant session.

Access to recordings may be restricted to authorised programme participants.

Educational Recordings and Marketing

A recording made for educational purposes is not automatically treated as permission for AHA to use your image, voice or contributions for unrelated advertising or promotional purposes.

Where AHA wishes to use identifiable material for a separate marketing purpose, an appropriate legal basis will be used and separate permission will be obtained where required.

Recordings will be retained only for the access period communicated for the relevant programme or for as long as reasonably necessary for the purpose for which they were created, subject to any other lawful reason for retention.

11. Photographs, Videos, Testimonials and Success Stories

AHA may invite students, graduates, clients or participants to provide:

• testimonials;
• reviews;
• photographs;
• videos;
• biographies;
• professional stories;
• case studies; or
• other promotional content.

Where identifiable personal information is used for promotional purposes, AHA will rely on an appropriate lawful basis and obtain permission where required.

Where processing is based on consent, you may withdraw that consent for future use by contacting us.

Withdrawal of consent does not affect processing that was lawful before consent was withdrawn.

Where content has already been lawfully incorporated into printed material, previously published material or another format that cannot reasonably be recalled, this will be taken into account when responding to a withdrawal request.

12. Email Marketing and MailerLite

AHA uses MailerLite to manage certain newsletters, mailing lists and marketing communications.

Where you:

• subscribe to our newsletter;
• sign up for updates;
• request a free resource in connection with joining a mailing list; or
• otherwise agree to receive marketing communications,

information such as your name, email address, subscription status and interactions with our emails may be processed through MailerLite.

Depending on the services and settings used, AHA may receive information concerning whether an email was:

• delivered;
• opened;
• clicked; or
• otherwise interacted with.

We may use this information to administer our mailing list, understand the effectiveness of our communications and improve the relevance of our marketing.

Where consent is required by law, we will request consent before sending marketing communications.

You may unsubscribe at any time by using the unsubscribe link contained in a marketing email or by contacting [email protected].

Service Communications

Unsubscribing from marketing communications does not prevent AHA from sending communications reasonably necessary in connection with:

• a programme in which you are enrolled;
• a purchase;
• payment;
• timetable;
• account;
• assessment;
• certification;
• event;
• contractual relationship; or
• another service you have requested.

After you unsubscribe, we may retain limited information on a suppression list so that we can record and respect your request not to receive future marketing.

MailerLite processes personal information in accordance with its own privacy and data-protection obligations.

13. Cookies and Google Analytics

AHA uses cookies and similar technologies on its Website.

These technologies may be used for purposes including:

• essential Website functionality;
• Website security;
• login and member functionality;
• remembering preferences;
• Website performance;
• analytics; and
• understanding how visitors interact with the Website.

Google Analytics

AHA uses Google Analytics to help us understand Website usage and performance.

Depending on the configuration and consent provided, Google Analytics may collect or generate information relating to:

• pages visited;
• Website interactions;
• approximate location;
• browser and device information;
• referral source;
• session information; and
• technical information associated with your Website visit.

We use this information to:

• understand how visitors use the Website;
• identify popular or useful content;
• identify Website-performance issues;
• understand how visitors reach the Website; and
• improve our Website and services.

Google Analytics and other non-essential analytics technologies are used subject to applicable cookie-consent requirements.

You may manage your choices through AHA’s cookie-consent controls.

Further information about the specific cookies used, their purpose and duration is provided in our Cookie Policy.

14. Social Media and Embedded Content

The Website may include links to or embedded content from social-media, video, mapping or other external platforms.

Third-party content can behave in the same way as if you visited the relevant third-party service directly and that provider may collect information according to its own privacy practices.

AHA also operates social-media accounts.

When you interact with AHA through a third-party social-media platform, the platform may process information independently from AHA under its own terms and privacy policy.

A link to a third-party platform does not mean that AHA controls that provider’s processing activities.

15. Why We Process Personal Data

AHA processes personal data only where an appropriate lawful basis applies.

Depending on the circumstances, we may rely on the following.

Performance of a Contract

Processing may be necessary to enter into or perform a contract with you.

This may include:

• providing a purchased course;
• administering Teacher Training;
• managing your student account;
• providing coaching;
• processing your enrolment;
• administering a payment plan; and
• communicating with you about the service purchased.

Steps Before Entering Into a Contract

We may process information where necessary to respond to a request you make before entering into a contract, such as:

• responding to a programme enquiry;
• considering an application; or
• discussing whether a service is appropriate.

Legal Obligation

We may process or retain information where necessary to comply with legal obligations, including:

• accounting;
• tax;
• regulatory obligations;
• lawful orders; and
• other record-keeping requirements.

Legitimate Interests

Where appropriate, we may process information where this is necessary for AHA’s legitimate interests and those interests are not overridden by your rights and freedoms.

Our legitimate interests may include:

• operating and improving AHA;
• administering educational programmes;
• providing effective student and customer support;
• maintaining appropriate academic and certification records;
• verifying certificates and qualifications;
• protecting the integrity of AHA certification;
• maintaining Website and information security;
• preventing fraud;
• protecting AHA’s intellectual property and confidential information;
• maintaining appropriate business records;
• resolving disputes;
• handling complaints; and
• establishing, exercising or defending legal claims.

Consent

We may rely on consent where appropriate, including for certain:

• marketing communications;
• photographs;
• testimonials;
• promotional uses; or
• processing of special-category data.

Where processing is based on consent, consent may be withdrawn at any time.

Withdrawal does not affect the lawfulness of processing that occurred before withdrawal.

16. Who We May Share Personal Data With

AHA does not disclose personal data more widely than reasonably necessary for legitimate business, educational, contractual or legal purposes.

Depending on your relationship with AHA, information may be shared with:

• Stripe, for payment processing;
• MailerLite, for newsletter and marketing administration;
• Google, in connection with Google Analytics and other Google services used by AHA;
• Website-hosting and technical providers;
• Website and learning-management service providers;
• video-conferencing providers;
• cloud-storage and document-management providers;
• security and IT providers;
• accountants and bookkeepers;
• legal advisers;
• insurers;
• independent AHA educators or contractors who reasonably require information to provide the relevant service;
• host studios and venues;
• retreat or accommodation providers where necessary;
• professional or certification bodies where appropriate;
• governmental, tax, regulatory or law-enforcement authorities where disclosure is legally required; and
• a purchaser or successor in the event of a lawful sale or transfer of AHA’s business or relevant business assets.

Where an organisation processes personal data on AHA’s behalf, AHA will use appropriate processing arrangements where required by data-protection law.

17. Host Studios, Venues and International Programmes

AHA provides education internationally and may work with independent host studios, venues, educators and programme partners.

Where reasonably necessary to deliver a programme, limited participant information may be shared with the relevant host or provider.

This may include information such as:

• name;
• contact details;
• attendance information;
• timetable information;
• venue-access information; and
• information reasonably necessary for safe programme administration.

We aim to limit shared information to what is reasonably required for the particular purpose.

Independent Hosts

An independent host studio or venue may also collect information directly from you for its own purposes.

Where that business independently decides why and how the information is used, it may be a separate data controller responsible for its own data-protection obligations.

AHA’s relationship with a host studio does not, by itself, authorise the host to use AHA student information for unrelated marketing purposes.

18. International Transfers

AHA is established in Malta but provides services internationally and uses technology providers operating across multiple jurisdictions.

Providers such as Stripe, MailerLite, Google and other technology or cloud-service providers may, depending on their infrastructure and services, process or allow access to personal data outside Malta or outside the European Economic Area (“EEA”).

Where GDPR requires safeguards for an international transfer, AHA will rely upon or require an appropriate lawful transfer mechanism.

Depending on the circumstances, this may include:

• a European Commission adequacy decision;
• European Commission Standard Contractual Clauses;
• another approved contractual safeguard; or
• another lawful transfer mechanism recognised under Chapter V GDPR.

Where required, we also expect service providers processing information on our behalf to implement appropriate contractual, security and data-protection safeguards.

You may contact us if you require further information about safeguards applicable to a particular transfer.

19. How Long We Keep Personal Data

AHA does not apply one single retention period to every type of personal data.

We retain information only for as long as reasonably necessary for the purpose for which it was collected and for legitimate related purposes.

These may include:

• performing contracts;
• providing ongoing services;
• maintaining educational and certification records;
• complying with tax and accounting requirements;
• resolving complaints;
• handling disputes;
• preventing fraud or misuse;
• satisfying insurance requirements;
• protecting AHA’s intellectual property; and
• establishing, exercising or defending legal claims.

When determining an appropriate retention period, we consider:

• the purpose of processing;
• the nature and sensitivity of the data;
• applicable legal obligations;
• contractual requirements;
• educational and certification-record requirements;
• limitation periods;
• insurance considerations; and
• whether the information may reasonably be required to demonstrate what occurred.

Student and Certification Records

Core academic and certification records may be retained long-term where reasonably necessary to verify academic history, certification and the integrity of AHA qualifications.

Financial Records

Financial and transaction information will be retained for the period required by applicable accounting, tax and other legal requirements.

Marketing Information

Marketing information may generally be retained while you remain subscribed.

Where you unsubscribe, limited information may be retained to record and respect your marketing preference.

Enquiries

Enquiry records may be retained for a reasonable period after the enquiry has ended, taking into account whether a contractual relationship arose and whether the correspondence may reasonably need to be referenced.

Programme Recordings

Programme recordings will generally be retained for the access period communicated for the relevant programme or for as long as reasonably necessary for their educational purpose.

Health Information

Health-related information will not be retained longer than reasonably necessary for its relevant purpose unless a longer period is justified by another lawful requirement, such as establishing or defending a legal claim.

20. How We Protect Personal Data

AHA takes reasonable and proportionate technical and organisational measures designed to protect personal information against:

• unauthorised access;
• unlawful disclosure;
• accidental loss;
• misuse;
• alteration; and
• destruction.

These measures may include:

• access controls;
• passwords and authentication;
• secure connections;
• appropriate account permissions;
• backups;
• reputable service providers;
• limiting access to individuals who reasonably require the information; and
• appropriate contractual arrangements with service providers.

No electronic system can be guaranteed to be completely secure.

You are also responsible for keeping passwords and account credentials confidential and for notifying AHA promptly if you believe your account has been compromised.

21. Personal Data Breaches

AHA maintains procedures for identifying and responding to suspected personal-data breaches.

Where a personal-data breach is likely to result in a risk to individuals’ rights and freedoms, AHA will notify the competent supervisory authority where required by applicable law.

Where a breach is likely to result in a high risk to an affected individual, AHA will also communicate the breach to that person where required.

22. Artificial Intelligence and Technology-Assisted Tools

AHA may use artificial-intelligence or technology-assisted tools to support legitimate administrative, educational, research, content-development or business functions.

Where personal data is processed using such tools, AHA will seek to:

• limit the personal information used to what is reasonably necessary;
• take account of confidentiality and security;
• avoid unnecessary disclosure of sensitive information; and
• use information in accordance with applicable data-protection obligations.

AHA does not intentionally submit confidential student health information, examination records or similarly sensitive personal data to public generative-AI systems for unrelated purposes.

Automated Decision-Making

AHA does not currently use personal data to make solely automated decisions that produce legal effects or similarly significantly affect individuals.

In particular, academic, certification or disciplinary decisions concerning AHA Teacher Training students are not intended to be made solely by an automated system.

If this changes, AHA will provide any additional information required under applicable data-protection law.

23. Your Data-Protection Rights

Depending on the circumstances and applicable law, you may have rights including the right to:

Be Informed

To receive clear information about how your personal data is processed.

Access

To request confirmation of whether we process your personal data and obtain a copy of information to which you are legally entitled.

Rectification

To ask us to correct inaccurate or incomplete personal data.

Erasure

To request deletion of personal data in circumstances where the legal requirements for erasure are satisfied.

Restriction

To request restriction of processing in certain circumstances.

Object

To object to certain processing, including processing based on legitimate interests and processing for direct marketing.

Data Portability

To receive certain personal data in a structured, commonly used and machine-readable format and, where applicable, have it transmitted to another controller.

Withdraw Consent

Where processing is based on consent, you may withdraw your consent at any time.

Rights Relating to Automated Decision-Making

You may have rights in relation to qualifying solely automated decisions producing legal or similarly significant effects.

These Rights Are Not Absolute

Data-protection rights are subject to the conditions and exceptions contained in applicable law.

For example, the right to erasure does not necessarily require AHA to delete information that AHA has a lawful reason to retain, including information needed to:

• comply with a legal obligation;
• maintain appropriate academic or certification records;
• demonstrate contractual performance;
• maintain financial records; or
• establish, exercise or defend legal claims.

24. Exercising Your Rights

To exercise a data-protection right, please contact:

[email protected]

Please explain which right you wish to exercise and provide enough information for us to identify the relevant records.

Where we have reasonable doubts regarding the identity of the person making a request, we may ask for additional information reasonably necessary to verify identity.

AHA will respond within the period required by applicable data-protection law.

There is normally no charge for exercising a GDPR right.

Where a request is manifestly unfounded or excessive, applicable law may permit AHA to charge a reasonable fee or refuse to act on the request, subject to the conditions imposed by GDPR.

25. Complaints

If you are concerned about how AHA has processed your personal data, please contact us at:

[email protected]

We would welcome the opportunity to investigate and address your concern.

You also have the right to lodge a complaint with the competent data-protection supervisory authority.

For AHA in Malta, this is the:

Office of the Information and Data Protection Commissioner (IDPC), Malta

Your right to complain to a supervisory authority is not affected by any AHA internal complaints procedure.

26. Children

AHA’s Teacher Training, professional education and business programmes are generally intended for adults.

AHA does not knowingly seek to collect unnecessary personal information relating to children through its general Website services.

Where AHA expressly agrees to provide a service involving a minor, appropriate arrangements concerning parental or guardian involvement, legal capacity, consent and data protection will be made where required.

If you believe that a child has submitted personal information to AHA inappropriately, please contact us.

27. Personal Data Received From Other Sources

Most personal information processed by AHA is obtained directly from the person concerned.

In some circumstances, we may receive limited personal data from another source, such as:

• a host studio;
• payment provider;
• educator;
• booking provider;
• technology provider;
• professional contact;
• employer or studio purchasing education on someone’s behalf; or
• another person authorised to communicate with us.

Where we receive personal data indirectly and GDPR requires AHA to provide additional information about that processing, we will do so within the applicable period unless a legal exception applies.

28. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect:

• changes in law;
• changes in our services;
• changes in technology;
• changes to service providers;
• new processing activities; or
• improvements to our privacy practices.

The Last updated date at the top of this Policy identifies the current version.

Where a change materially affects how existing personal data is processed, AHA will take appropriate steps to communicate the change directly where required by law.

29. Contact Us

For privacy questions, data-protection requests or concerns about your personal information, please contact:

Anita Horry
Sole trader, trading as Anita Horry Academy

Triq l-Ilma
Swieqi, Malta

Email: [email protected]
Website: www.anitahorryacademy.com