Book now
EN

Privacy Policy

This English version is provided for information purposes only. In the event of any discrepancy, the German version prevails.

1. Data protection at a glance

The protection of your personal data is of particular importance to us. We treat your personal data confidentially and in accordance with the statutory data protection regulations (General Data Protection Regulation, GDPR) and this Privacy Policy. As a rule, our website can be used without providing any personal data. Where personal data (e.g. name, telephone number or email address) are collected, this is always done on a voluntary basis.

2. Controller

The controller responsible for data processing on this website is:

Therakura S.à r.l. 4, Rue de Canach L-5368 Schuttrange Luxembourg

Phone: +352 621 75 11 55 Email: info@therakura.lu

Represented by the managing director: Kenneth Roeser

3. Collection of data on our website

When you visit our website, technical information is automatically recorded by the hosting provider, in particular IP address, date and time of the request, browser type, operating system and referrer URL. These data are used for the technical provision and security of the website. The legal basis is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR); Cloudflare only stores these log data for as long as is necessary for these purposes.

4. Website hosting

Our website is hosted by:

Cloudflare, Inc. 101 Townsend St, San Francisco, CA 94107, USA

Content is delivered via Cloudflare’s global network, including data centres in the EU. Cloudflare is certified under the EU-U.S. Data Privacy Framework. Further information: https://www.cloudflare.com/privacypolicy/

5. Contact, application and pre-registration forms

Our website offers three forms:

Your information is transmitted in encrypted form to a server-side function of our website at Cloudflare (see section 4) and forwarded from there by email to the relevant Therakura mailbox — enquiries and pre-registrations to our front desk, applications to the staff responsible for recruitment. Emails are received via Proton Mail (Proton AG, Switzerland — a country recognised by the EU as providing an adequate level of data protection). The information is not stored on the website itself.

We use your information solely to answer your enquiry, review your application or inform you about class times and the start of classes. The legal basis is Art. 6(1)(b) GDPR (steps prior to entering into a treatment, class or employment relationship) and our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR).

Retention period: we delete contact enquiries once your matter has been dealt with and no statutory retention obligations apply, at the latest after 12 months. We delete pre-registrations once you have signed up for a class or withdrawn your interest, at the latest 12 months after receipt. We delete application documents no later than 6 months after the application process has been completed, unless an employment relationship is established or you have agreed to a longer retention period.

Health information: please do not send detailed health information, test results or medical documents via the forms. If you choose to share health-related information with us, we use it solely to deal with your matter and treat it confidentially (Art. 9(2)(h) GDPR).

We do not pass your information on to third parties without your consent, with the exception of the technical service providers named here.

5a. Spam protection (Cloudflare Turnstile)

To protect our forms against automated spam submissions, we use Cloudflare Turnstile (Cloudflare, Inc., see section 4). When you open a page containing a form, your browser loads a script from Cloudflare; your IP address and technical characteristics of your browser are transmitted to Cloudflare to check whether the submission comes from a human. Turnstile is not used for advertising purposes and does not create cross-site profiles. The legal basis is our legitimate interest in the security of our website and protection against misuse (Art. 6(1)(f) GDPR). Further information: https://www.cloudflare.com/turnstile-privacy-policy/

6. Appointment booking (Doctena)

For online appointment booking, we embed the booking calendar of the Doctena service (Doctena S.A., 42, Rue de la Vallée, L-2661 Luxembourg) on our appointment page; on individual team pages, we also display Doctena review modules. We only load this content once you have consented to the “Appointment booking (Doctena)” category or clicked “Load calendar” in place of the calendar; your browser then establishes a connection to Doctena’s servers. Any consent management for cookies takes place directly within the Doctena module. For technical reasons, the Doctena module also loads a program library from Google (Google Analytics); in our check in October 2026, this did not set any cookies on our website or send any usage data to Google, but your IP address is transmitted to Google when the library loads.

Doctena has a dual role: for your Doctena user account and the platform itself, Doctena is an independent controller; Doctena’s privacy policy applies: https://www.doctena.com/en-lu/privacy-policy. The appointment data that reach our practice calendar through your booking (e.g. name, contact details, appointment times) are processed by Doctena on our behalf as a processor; Therakura is the controller for these data. We use the appointment data exclusively for appointment management, treatment and billing and keep them in accordance with the periods set out in section 10.

6a. Class booking (Eversports)

For booking our Pilates classes and purchasing class passes, we embed the timetable and pass shop of our booking partner Eversports (Eversport GmbH, Vienna, Austria) on our training page. When you access this page, your browser establishes a connection to Eversports’ servers in order to display the class dates and products; for technical reasons, your IP address is transmitted in the process. The embedded modules do not set any cookies on our website. When you book a class or purchase a pass, you are redirected to Eversports; there, you create a customer account, and Eversports processes your details (e.g. name, contact details, bookings, payment data) as an independent controller — any consent management for cookies takes place directly at Eversports. Eversports’ privacy policy applies: https://www.eversports.at/h/privacy. We use the booking and attendance data exclusively for organising classes, recording attendance and billing. We keep invoices and accounting records in line with statutory retention obligations (in Luxembourg, generally 10 years); we delete attendance data as soon as they are no longer needed for organisation and billing.

7. Cookies and web analytics

Our website does not set any cookies of its own; Google cookies are only set if you consent to the “Marketing” category (section 7a). On your first visit, we ask you in the “Privacy settings” notice whether you consent to reach measurement (“Statistics”), to loading Doctena content (“Appointment booking”) and to measuring the success of our Google ads (“Marketing”); your choice is stored locally in your browser and can be changed at any time via “Cookie settings” in the footer. Only with your consent do we use Cloudflare Web Analytics to measure reach — a cookieless method that does not create any personal profiles and does not track data about you across websites. The legal basis for statistics and Doctena content is your consent (Art. 6(1)(a) GDPR and Art. 4(3)(e) of the Law of 30 May 2005); you can withdraw your consent at any time with effect for the future.

In addition, we use the Metricool service (Metricool Software, S.L., c/ Téllez 12, 28007 Madrid, Spain) to measure reach, so that we can evaluate visits to our website together with the figures from our social media channels. When you open a page, your browser loads a script from Metricool’s servers and, for technical reasons, transmits your IP address and general information about the page view (e.g. page visited, referring page, time). Metricool does not set cookies, does not store any information on your device and does not store your IP address; no user profiles are created. Metricool acts as our processor (Art. 28 GDPR). The data is processed on servers within the European Union. Metricool is only loaded if you have consented to the “Statistics” category; the legal basis is your consent (Art. 6(1)(a) GDPR). Metricool’s privacy policy applies: https://metricool.com/privacy-policy/

In addition, we count the use of individual functions of our website (e.g. which option was clicked in the orientation navigator) in the form of anonymous, aggregated counts. In doing so, no cookies are set and no personal data, IP addresses or user profiles are stored; the counts cannot be attributed to any individual. Processing takes place within our own infrastructure at Cloudflare (Workers Analytics Engine) and serves exclusively to improve our services. This includes which symptom group was selected in the navigator — without any link to a person. Likewise, we count which route was used to reach a page when the address contains a source identifier (e.g. ?src=flyer for a QR code on a flyer or ?src=gbp for our Google Business Profile). The legal basis is our legitimate interest in improving our services (Art. 6(1)(f) GDPR); the counts are stored for a maximum of three months.

Display preference. When you switch between light and dark mode, your browser saves this choice in its local storage (localStorage) so that it is kept for your next visit. This information does not leave your device, is not transmitted to us and can be deleted at any time via your browser settings.

7a. Google Ads conversion tracking

For our ads in Google Search, we use Google Ads, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Only if you consent to the “Marketing” category in the “Privacy settings” notice does our website load the Google tag (gtag.js). It recognises whether you reached us via one of our ads and counts, as the only action (“conversion”), whether you then click a link to our online appointment booking. For this, Google sets cookies (e.g. “_gcl_au”, stored for up to 90 days) and processes data such as your IP address, information about your device and browser, and the pages visited. We only receive aggregated statistics from Google, no information that would allow us to identify you personally. We do not use personalised advertising (remarketing). Google may also transfer data to Google LLC in the USA; this transfer is based on the European Commission’s adequacy decision for the EU-US Data Privacy Framework, under which Google LLC is certified. The legal basis is your consent (Art. 6(1)(a) GDPR and Art. 4(3)(e) of the Law of 30 May 2005); you can withdraw it at any time with effect for the future via “Cookie settings” in the footer. Further information: https://policies.google.com/privacy

8. Maps and directions

To show our locations, we use static map images without automatically embedding any external services. Only when you actively click on a route-planning link does the map service you have chosen open in a new window or in the corresponding app; the address or coordinates of our location are passed on as the destination. The options are Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), Apple Maps (Apple Distribution International Ltd., Ireland) and Waze (Waze Mobile Ltd., a Google group company). From that point on, the privacy policy of the respective provider applies: https://policies.google.com/privacy · https://www.apple.com/legal/privacy/ · https://www.waze.com/legal/privacy

Our website links to our profiles on Instagram and Facebook (both Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland) and LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland). These are simple links, not embedded plugins: no data is transmitted to these networks when you visit our website. Only when you click on a link are you taken to the respective provider’s page, where its privacy policy applies.

9. Communication by email, telephone and WhatsApp

If you contact us by email or telephone, the information you provide, including the contact details you have given, will be stored for the purpose of processing the enquiry. The legal basis is Art. 6(1)(b) GDPR where your enquiry relates to a treatment or class contract, and otherwise our legitimate interest in responding (Art. 6(1)(f) GDPR). We delete the correspondence as soon as it is no longer needed, at the latest after 12 months, unless statutory retention obligations apply.

WhatsApp. You can also write to us via WhatsApp. The WhatsApp button on our website is a simple link; data is only transmitted when you click on it and WhatsApp opens. WhatsApp is provided by WhatsApp Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland); a transfer of data to the USA cannot be ruled out. Message content is end-to-end encrypted. We use your messages and telephone number solely to deal with your matter. Please do not send us detailed health information or medical documents via WhatsApp. WhatsApp’s privacy information: https://www.whatsapp.com/legal/privacy-policy-eea

9a. Newsletter and information by email (Brevo)

If you subscribe to our newsletter or have allowed us to inform you about a specific offer (for example the start of our Pilates classes in Contern), we process your email address and, if provided, your first name, preferred language, practice location and topics of interest.

The legal basis is your consent (Art. 6(1)(a) GDPR). For the newsletter we use a double opt-in procedure: you only receive it after confirming your subscription via the link in a confirmation email. We store the time of subscription and confirmation so that we can demonstrate your consent.

We use Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France) as our processor for sending emails. The data is stored in data centres within the EU. We do not store any health data there.

Brevo records whether an email was opened and which links were clicked. We use these statistics solely to improve our content.

You can withdraw your consent at any time: via the unsubscribe link in every email or by email to info@therakura.lu. After you unsubscribe, we remove you from the mailing list. Your email address is kept only on a suppression list so that you receive no further emails. We keep proof of your consent for up to three years after you unsubscribe.

10. Processing of health data

In the context of appointment bookings and treatments, health-related data may be collected and processed. These data are subject to special data protection provisions and are treated in strict confidence. Processing takes place exclusively for the purposes of treatment, appointment management and billing with health insurance funds.

The legal basis is Art. 9(2)(h) GDPR (healthcare provided by professionals subject to professional secrecy) in conjunction with Art. 6(1)(b) and (c) GDPR. Recipients are only persons and bodies involved in your treatment and its billing, in particular the CNS and, where applicable, your supplementary insurance, as well as our technical service providers acting as processors. We keep the treatment records (patient file) in accordance with statutory requirements (in Luxembourg, at least 10 years after the last treatment) and then delete them.

11. Your rights

You have the right at any time to access your stored data, and the rights to rectification, erasure, restriction of processing, data portability, withdrawal of consent and to lodge a complaint with the data protection authority.

Competent data protection authority in Luxembourg: CNPD — Commission Nationale pour la Protection des Données, https://cnpd.public.lu

Right to object (Art. 21 GDPR): where we process your data on the basis of our legitimate interest (Art. 6(1)(f) GDPR — e.g. server logs, spam protection, audience measurement, responding to enquiries), you may object to this processing at any time on grounds relating to your particular situation. We will then stop processing the data unless we can demonstrate compelling legitimate grounds. An informal message to info@therakura.lu is sufficient.

12. TLS encryption

For security reasons, this website uses TLS encryption (formerly “SSL”). You can recognise an encrypted connection by “https://” in your browser’s address bar.

Last updated: 18 October 2026