Terms of Service

These Terms of Service (the "Terms") govern the use of the Plenimo platform (the "Platform" or "Service") between the Pilates studios that subscribe to it (the "Studio" or "Subscriber") and the Provider.

Provider: [PLENIMO OPERATOR NÉV / NAME], [székhely / registered seat], [adószám / tax no.], email: privacy@flownerve.com.

The Platform is a software-as-a-service (SaaS) solution for running Pilates studios: schedule and booking management, client and pass records, equipment management, a public studio website (storefront), and related administrative and financial features. By using the Platform, the Subscriber accepts these Terms as binding.

The Service is offered on a subscription basis, on one of the Starter, Pro or Growth plans. The contents and current prices of the plans are set out on the Platform's pricing page. Subscription fees are stated in euros (EUR).

New Subscribers are entitled to a 14-day free trial without providing a payment card. After the trial ends, unless agreed otherwise, use of the Service is conditional on payment of the fee for the chosen plan.

Payment is made through the Stripe payment provider, according to the chosen billing cycle (monthly or annual). The subscription fee is paid by the Studio to the Provider; the Studio's own clients owe no fee to the Provider. Payments between the Studio and its clients (e.g. pass purchases) are made via Stripe Connect, on behalf of the Studio as merchant of record.

If a fee is not paid, the Provider may limit or suspend access to the Service.

The Subscriber may use the Service only for lawful purposes and within the framework of applicable law and these Terms.

In particular, the following are prohibited: any activity aimed at disrupting the Service, circumventing its security measures, or gaining unauthorised access to other subscribers' data; uploading unlawful, deceptive or rights-infringing content; unauthorised resale of the Platform; and excessive, disproportionately burdensome automated use of the Service without the Provider's prior consent.

The Subscriber is responsible for the lawfulness of the data it uploads to the Platform, and for ensuring that it has the necessary legal basis and has provided the necessary notice in respect of the data it processes about its clients.

The Provider strives to keep the Platform continuously and highly available; however, the Service is provided "as is" and the Provider does not warrant that it will at all times be uninterrupted or entirely error-free.

The Provider may carry out planned maintenance, of which it will where possible give advance notice. The Provider is not liable for downtime or data loss caused by matters outside its control (e.g. failure of a sub-processor, force majeure).

The subscription is entered into for the period corresponding to the chosen billing cycle and, unless agreed otherwise, renews automatically.

The Subscriber may terminate its subscription at any time; termination takes effect at the end of the current billing cycle, and fees already paid are non-refundable unless the law provides otherwise.

In the event of a serious or repeated breach of these Terms, the Provider may terminate the contract with immediate effect and discontinue access. On termination, the handling of data is governed by the Data Processing Addendum (in particular its "Return and deletion of data" section).

To the fullest extent permitted by law, the Provider's liability is limited to the amount of the subscription fees actually paid by the Subscriber in the twelve (12) months preceding the event giving rise to the claim.

The Provider is not liable for indirect, consequential or special damages, including in particular lost profit, loss of business opportunity, or damage to goodwill. This section does not limit liability where the law does not permit its limitation or exclusion (e.g. damage caused intentionally, or damage to human life, bodily integrity or health).

These Terms and the legal relationship between the parties are governed by Hungarian law. Matters not regulated by these Terms are governed by Act V of 2013 on the Civil Code and other relevant Hungarian legislation.

The parties will first seek to resolve any dispute by negotiation; failing that, the Hungarian courts have jurisdiction to hear the dispute.

This Data Processing Addendum (the "DPA") governs the processor relationship between the parties with the mandatory content required by GDPR Art. 28(3), and forms an inseparable part of the Terms.

Subject matter of processing: the Provider's processing, as necessary to provide the Service, of the personal data managed by the Studio on the Platform. The duration of processing follows the duration of the subscription relationship, subject to the provisions on return and deletion of data.

Nature and purpose of processing: providing the Platform's features — schedule and booking management, client and pass records, attendance recording, financial and administrative functions, and the associated storage, transmission and display.

Categories of personal data: client identity data (e.g. name), contact data (e.g. email address, phone number), booking and attendance data, pass and membership data, payment metadata, invoice buyer details, messages sent through the Platform, instructor ratings, system notifications, waitlist entries, consent log records, staff-authored client progress notes, and churn/no-show indicators derived from attendance history. Categories of data subjects: the Studio's clients and instructors.

Health notes (special-category data). As a per-studio feature that is switched OFF by default, the Platform allows short notes about injury, post-operative status or movement limitations to be recorded. Such notes are special-category personal data under GDPR Art. 9. Enabling the feature constitutes the Studio's documented instruction (GDPR Art. 28(3)(a)); the Studio, as controller, is responsible for the legal basis — the data subject's explicit consent under GDPR Art. 9(2)(a) — and for being able to demonstrate it. In respect of this data the Provider applies additional safeguards: writing a health note is conditioned at the database level on both the studio-level switch and the data subject's live consent; note content is hidden from studio staff by default and each disclosure is logged; on withdrawal of consent the data subject's health notes are deleted in the same transaction; and they are deleted automatically after 24 months. The data protection impact assessment is available in the document docs/compliance/dpia-health-notes.md.

In respect of the personal data it manages, the Studio is the controller and the Provider is the processor.

The Provider processes personal data only on the Studio's documented instructions. The parties record that the intended use of the Platform — including configuring and using the Platform's features — constitutes the Studio's documented instruction. Any further instruction may be given by the Studio in writing (including by email).

The Provider will inform the Studio without delay if, in its opinion, an instruction infringes the GDPR or other data-protection provisions. The Provider will transfer personal data to a third country or an international organisation only on the Studio's instruction or under a legal obligation; in the latter case, unless the law prohibits it, the Provider will inform the Studio in advance.

The Provider ensures that persons authorised to process the personal data (employees, contributors) have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality. The confidentiality obligation survives the termination of the relationship.

The Provider ensures that access to personal data is limited to those persons for whom it is strictly necessary in order to provide the Service (need-to-know principle).

The Provider applies technical and organisational measures (TOMs) that comply with GDPR Art. 32. A summary of these is available in the document docs/compliance/toms.md and includes, among others:

Logical separation between tenants (studios) at the database level using Row-Level Security, ensuring that one studio cannot access another studio's data.

Encryption of data in transit (TLS) and at rest.

Role-based access and separation of privileges (role separation), applying the principle of least privilege.

Audit logging of security-relevant operations.

The Studio grants the Provider general written authorisation to engage sub-processors. The current list of sub-processors engaged is available at /subprocessors.

The Provider will notify the Studio by email of any intended change to the list of sub-processors (adding a new sub-processor or replacing an existing one) at least 30 days before the change takes effect. The Studio may object to a notified change, on reasonable grounds, in the manner indicated in the notice. If the objection is not resolved within 30 days of the notice, the Studio may terminate the affected subscription and is entitled to a pro-rata refund of prepaid unused fees.

The Provider imposes on sub-processors data-protection obligations that are in substance the same as those set out in this DPA; the Provider remains liable for the acts of a sub-processor as if it had performed the processing itself.

By means of tools built into the Platform — self-service data export for data subjects and an administrator deletion tool — the Provider assists the Studio in fulfilling its obligations arising from data-subject requests (access, rectification, erasure, restriction, portability, objection).

Taking into account the nature of the processing and the information available to it, the Provider assists the Studio in complying with its obligations under GDPR Arts. 32–36 (security, handling of personal-data breaches, impact assessment, prior consultation).

On becoming aware of a personal-data breach, the Provider will notify the Studio without undue delay and share the relevant information available to it, so that the Studio can fulfil its own notification obligations.

On termination of the subscription relationship, the Studio may request an export (return) of the data it manages through the Platform's export features.

After termination and after any export has been provided, the Provider will, at the Studio's choice, delete or return the personal data and then delete existing copies, unless Union or Member State law requires further storage of the data. Data subject to such a legally based retention obligation (e.g. accounting retention) may not be deleted until that obligation expires; it will be deleted once the retention period ends.

The Provider makes available to the Studio all information necessary to demonstrate compliance with the obligations set out in GDPR Art. 28.

The Studio — or an auditor mandated by it and bound to confidentiality — is entitled to verify and audit compliance with the obligations under this DPA. Except where required by law, such an audit may take place no more than once per calendar year, on prior written notice given a reasonable time in advance (at least 30 days), and without unreasonably disrupting the Provider's ordinary course of business. The costs of the audit are borne by the Studio. The Provider shall allow for and contribute to such inspections and audits (GDPR Art. 28(3)(h)); at the Studio's request, and in order to avoid the need for an on-site audit, it will supply a completed security questionnaire and its technical and organisational measures document.