What we know about you, and why

Who is responsible for your information

Rita Deaibes Feghali, trading as Kala, Viale XII Giugno 15, int. 13, 40124 Bologna (BO), Italy — VAT number 04261931200 — is the data controller. That means Rita decides what is collected and why, and is the person to write to about any of it, at rita@kalastudio.it.

What we collect, and why

Everything below is either something you typed in yourself or a record of a booking you made.

• Your name, email address and phone number — so we know who is coming and can reach you if a session changes. Held on the basis of the booking agreement between us.
• Your bookings, cancellations and attendance — the studio's own record of who came to what. Same basis.
• A record of each payment: the amount, the method, and Stripe's reference for it. Kept because Italian tax law requires it.
• A six-digit sign-in code, sent to your email and valid for a few minutes, and a session cookie that keeps you signed in afterwards.
• Whether you agreed to hear from us by email. Only if you ticked the box, and you can untick it at any time in your account.
• Nothing else. There is no analytics, no advertising pixel, and no third-party tracker anywhere on this site.

Health information

Some of what happens at Kala touches on health — an injury you mention before a yoga class, something you tell Rita during a health coaching session. Information like that is treated as a special category under the GDPR and is only ever recorded with your explicit consent, kept separately from the booking system, and used for nothing except giving you a safe and appropriate session.

You are never obliged to tell us anything about your health. If you would rather it was not written down at all, say so and it won't be.

Your card details never reach us

Card payments are handled entirely by Stripe. The card form on this site is Stripe's own, your card number goes straight to them, and Kala never sees or stores it. What we keep is Stripe's reference for the payment and the amount.

When you book and pay by card, the amount is authorised — held — on your card rather than taken immediately, and only charged once the free-cancellation window closes. If you cancel in time, the hold is released and nothing is taken.

Who else handles your information

A studio this size runs on a handful of services. Each of them acts on Kala's instructions under a data processing agreement, and none of them may use your information for their own purposes.

• Stripe — payments.
• Brevo — the confirmation, reminder and sign-in emails.
• Supabase — the database the bookings live in.
• Render — the hosting this website runs on.

Information leaving Europe

Some of these providers are based outside the European Economic Area or operate infrastructure there. Where that happens, the transfer is covered by the European Commission's Standard Contractual Clauses. If you would like to know exactly where your information sits, ask and we will tell you.

How long we keep it

• Payment and invoicing records: ten years, because Italian tax law requires it.
• Your account and booking history: for as long as you have an account. Ask us to close it and we will delete what the law does not oblige us to keep.
• Marketing consent: until you withdraw it.
• Sign-in codes: minutes. They are deleted or overwritten as soon as they are used or expire.

Cookies

Kala uses two cookies, both strictly necessary: one that keeps you signed in to your account, and one that keeps Rita signed in to the studio dashboard. Neither is used to track you, and because they are strictly necessary they do not require a consent banner.

Stripe may set its own cookies on the payment step to detect fraud. Clearing cookies in your browser signs you out; nothing else is affected.

What you can ask for

You have the right to ask for a copy of what we hold about you, to have it corrected, to have it deleted, to restrict or object to how it is used, to receive it in a portable form, and to withdraw any consent you have given. Write to rita@kalastudio.it and you will have an answer within thirty days.

If you think your information has been mishandled and we have not put it right, you can complain to the Garante per la protezione dei dati personali, the Italian data protection authority, at garanteprivacy.it.

Changes to this notice

This notice was last updated on 25 September 2026. If it changes in a way that affects you, we will say so rather than quietly reposting it.