Data Protection White Paper

1. Purpose of This Document

This White Paper sets out how IK Pilates in Ukraine, operated by individual entrepreneur Karnaukh Iryna Oleksandrivna, implements the Law of Ukraine "On Personal Data Protection" No. 2297-VI and the related requirements of Ukrainian law across the IK Pilates platform and studio operations.

It is published in the interest of transparency. Our Privacy Policy tells you what we do with your data and what rights you have; this document explains how we govern, secure and evidence that processing. It is written for clients who want detail, for partners carrying out due diligence, and for our own staff.

Where this document and the Privacy Policy differ in emphasis, the Privacy Policy governs the description of processing towards data subjects.

2. Relationship to the General Data Protection Regulation

Our Bulgarian studio is operated by a separate legal person, IK Pilates Studio EOOD, which is an independent controller under Regulation (EU) 2016/679. The two operations are not joint controllers: each determines the purposes and means of its own processing, maintains its own records and answers its own requests.

If you are located in the European Economic Area, the Bulgarian documents and the standard of the Regulation apply to you.

For our Ukrainian operation, Ukrainian law governs. As a matter of practice, however, we have chosen to build the platform to a single technical standard across both countries. The encryption, consent granularity, retention automation, session control and erasure mechanisms described below are identical in Ukraine and in Bulgaria. Ukrainian clients therefore benefit from those measures whether or not the law requires them.

Ukraine is a party to Convention 108 of the Council of Europe. Draft Law No. 8153 "On Personal Data Protection", which would align Ukrainian law with the Regulation, introduce data protection officers, breach notification duties and a framework for cross-border transfers, and establish an independent supervisory authority, passed its first reading in the Verkhovna Rada on 20 November 2024 and is being prepared for a second reading. We monitor its progress and expect the measures described in this document to satisfy its requirements substantially on adoption.

3. Owner of the Personal Data File and Responsible Person

Owner of the personal data file: Individual entrepreneur Karnaukh Iryna Oleksandrivna Taxpayer registration number: 3029410706 Address: prov. Otakara Yarosha 12a, Kharkiv, 61045, Ukraine Contact for data protection matters: privacy@ikpilates.com

Article 24 of the Law requires the owner of a personal data file that processes special categories of personal data to designate a person responsible for organising the work relating to the protection of personal data, and to notify the Ukrainian Parliament Commissioner for Human Rights of that designation. Because we process data concerning health, this requirement applies to us.

The responsible person is designated by internal order and is accountable for maintaining the list of processing operations, handling requests from data subjects, instructing staff, keeping the record of disclosures required by Article 14, and coordinating the response to any security incident. The designation is recorded in our internal documentation and is disclosed to the Ukrainian Parliament Commissioner for Human Rights on request.

4. Principles Applied in Practice

Lawfulness and defined purpose. Every processing operation is mapped to a ground under Article 11 of the Law before it is implemented, and its purpose is stated in the Privacy Policy in plain language, in six languages.

Purpose limitation. Data collected to deliver Sessions is not repurposed for marketing or analytics. Data concerning health is used solely for safe instruction and for features the client has explicitly enabled.

Data minimisation. Onboarding was consolidated so that clients answer a single medical checklist rather than a series of separate medical screens; fields that were not used operationally were removed. IP addresses are stored only as keyed hashes rather than in plain form.

Accuracy. Clients may view and correct their profile, preferences and contact details at any time. Prefilled onboarding data is presented for reconfirmation rather than silently reused.

Storage limitation. Automated retention jobs run on a schedule and delete records whose retention period has elapsed, as set out in Section 8.

Security. The technical and organisational measures in Section 9 implement Article 24 of the Law.

Transparency and accountability. This document, the list of processing operations, the provider register, the retention schedule and the incident log together constitute our accountability file.

5. Processing Operations

We maintain an internal list of processing operations. The principal operations are summarised below, with the ground relied on under Article 11 of the Law.

Client account management - identity, contact and authentication data - performance of a transaction Booking and attendance - booking, attendance and waiting-list data - performance of a transaction Health screening for safe practice - data concerning health - consent under Articles 7 and 11 Mobile health and fitness integration - data concerning health - per-category consent under Articles 7 and 11 Transactional communications - contact data and delivery logs - performance of a transaction Marketing communications - contact data - consent Payments, invoicing and accounting - billing and payment data - permission granted by law Platform security, audit and abuse prevention - hashed IP, session and audit data - legitimate interests of the owner Website performance measurement - aggregate, cookieless counts - legitimate interests of the owner Waiting list and prospective client enquiries - contact and preference data - consent and pre-contractual steps Instructor and staff administration - engagement data - performance of a transaction and permission granted by law On-demand classes and watch history - account, watch history and technical playback data - performance of a transaction Playback security logs - hashed IP address, platform and application version - legitimate interests of the owner AI movement tracking - session results and event logs - performance of a transaction Production of class content - recordings of instructors and staff and derived movement data - performance of a transaction and legitimate interests of the owner

6. Special Categories of Data and the Risk Assessment

Article 7 of the Law prohibits the processing of data concerning health save on the grounds listed in that Article. We rely on the unambiguous consent of the data subject, and we have assessed the risks of that processing and the measures required to address them.

The assessment identified the principal risks as unauthorised access to health records by studio staff without an operational need, exposure of health data in the event of a database compromise, drift towards analytics or marketing use, and consent that is not genuinely granular.

The measures implemented are as follows.

Consent is granular and per category, is recorded on the server, and is enforced on every read. Withdrawing consent for one metric category has no effect on any other. A client who declines all health features retains full use of the platform.

Sensitive values are encrypted at rest at column level. The encryption key for a client's medical fields is derived from a master key together with that client's own identifier, so that keys are not shared between clients.

Access is limited by role. Instructors and studio staff see only the information necessary to supervise a Session safely, and every person with access has signed a confidentiality undertaking as required by Article 10 of the Law.

Health data is excluded by design from marketing, advertising, profiling and third-party sharing. No tracking domains are declared in our mobile applications and no advertising framework is embedded.

Erasure is automated. When a client relationship ends, encrypted medical fields are scheduled for purge and are nulled after a thirty-day grace period, with an audit entry recording the purge.

We have separately assessed our on-demand classes and AI movement tracking. The camera image used for tracking is analysed only on the member's device and never reaches us. The analysis estimates body positions and does not identify anyone, so it does not produce biometric data. The stored results describe performance against a class rather than a state of health, are not used to infer anything about health and are not visible to staff, and we therefore do not treat them as data concerning health within the meaning of Article 7 of the Law. The residual risks, namely the inference of health information from results over time, over-retention, and exposure of viewing data to the video provider, are addressed by keeping results separate from health records, by a twelve-month limit on event logs, by keyed hashing of IP addresses in playback logs, and by excluding names, email addresses and account identifiers from everything sent to the video provider. The assessment is reviewed before any material change to these features.

7. Service Providers and Disclosure

Every provider that processes personal data on our behalf does so under a written agreement requiring processing only on our instructions, confidentiality, appropriate security measures, restrictions on further engagement of sub-providers, assistance with requests from data subjects, notification of incidents, and deletion or return of data at the end of the engagement.

Before engaging a provider we assess its security posture, its hosting locations, its transfer position and its incident notification commitments. The register records, for each provider, the purpose, the categories of data and the hosting region. The current list appears in Section 6 of our Privacy Policy and is reviewed at least annually.

Article 14 of the Law permits disclosure of personal data to third parties only with the consent of the data subject or on the grounds provided by law. Each disclosure to a third party is recorded, together with its date, its recipient and its legal ground, and that record is available to the data subject on request.

8. Retention Schedule and Automated Deletion

Retention periods are enforced by scheduled jobs rather than by manual review, so that expiry is the default outcome rather than an exception.

Contact and enquiry records - 730 days Notification delivery logs - 365 days Security and audit records - 730 days Records of revoked sessions - 90 days Inactive accounts - identified after 24 months of inactivity Account deletion grace period - 30 days, during which the request may be cancelled Medical field purge after end of client relationship - 30 days Booking and attendance records - 3 years, corresponding to the general limitation period under the Civil Code of Ukraine Accounting and tax records - for the periods required by the Tax Code of Ukraine and the rules of the State Archival Service Playback logs - 365 days Event logs of AI movement tracking - 12 months Watch history and results of AI movement tracking - for the life of the account

On deletion, purely personal records are hard-deleted. Records that we are legally required to retain, principally booking and accounting entries, are retained in depersonalised form: the identity record is reduced to a tombstone containing no personal data, which removes the identifying link from every record that references it.

9. Technical and Organisational Security Measures

The measures below implement Article 24 of the Law and are reviewed as part of our periodic security review.

Transport security. All traffic between clients, applications and our servers is encrypted using TLS. A content security policy is enforced on our web properties. On-demand classes are delivered through signed playback links that expire, and no analytics or tracking technology is used in the video player.

Authentication. Authentication tokens are signed asymmetrically using ES256 with short lifetimes and strict validation of issuer, audience and expiry. Sessions are enumerable and individually revocable by the client, and a server-side denylist enforces revocation before the token would otherwise expire.

Encryption at rest. Sensitive health fields are encrypted at column level using PGP symmetric encryption, with per-client key derivation. Database storage is encrypted at rest by our hosting provider.

Access control. Row-level security is enforced in the database. Application roles follow least privilege, and privileged operations run through defined security-definer functions rather than through broad grants. A role and permission matrix is maintained and tested.

Depersonalisation. IP addresses are hashed with a secret key before storage. Deleted identities become tombstones that depersonalise retained operational records.

Logging and monitoring. Privileged and security-relevant operations are recorded in an audit log with a defined retention period. Rate limiting protects authentication and booking endpoints, and an anti-abuse challenge protects the public contact form.

Organisational measures. Staff and instructors sign confidentiality undertakings covering personal data, receive instruction on engagement, and are granted access strictly according to role. Access rights are reviewed when a role changes and are withdrawn on departure, including revocation of active sessions.

Resilience. Data is stored with a provider offering redundancy and backup outside the territory affected by hostilities, so that records remain available notwithstanding damage to local infrastructure.

Change management. Database changes are applied through numbered, reviewed migrations. Security reviews are conducted periodically and their findings tracked to closure.

10. Security Incident Procedure

Any member of staff who becomes aware of a suspected incident affecting personal data must report it immediately to the responsible person named in Section 3.

The responsible person contains the incident, assesses the categories and approximate number of data subjects and records affected, the likely consequences and the measures taken, and records the incident in the incident log together with the reasoning.

Where the incident may affect the rights of data subjects, we inform the data subjects concerned and the Ukrainian Parliament Commissioner for Human Rights, without undue delay and in clear language, describing the nature of the incident, its likely consequences, the measures taken and the contact point for further information.

Where a provider becomes aware of an incident affecting our data, its agreement requires it to notify us without undue delay so that we can meet these obligations. We apply a target of 72 hours for our own assessment and notification, matching the standard we apply in Bulgaria, notwithstanding that Ukrainian law does not currently prescribe a fixed period.

11. Requests from Data Subjects

Requests may be submitted through the platform or by writing to privacy@ikpilates.com. Many rights are exercisable directly in the account: viewing and editing the profile, reviewing and revoking sessions and devices, managing consents per category, and requesting deletion with a copy of the data.

Every request is logged on receipt. We verify identity proportionately, using the account itself where possible rather than requesting additional identity documents. We respond within thirty calendar days, as required by Article 16 of the Law.

Where we refuse a request in whole or in part, we state the reason and the legal ground, and inform the requester of the right to complain to the Ukrainian Parliament Commissioner for Human Rights and to apply to a court.

Requests are handled free of charge.

12. Cross-Border Transfer

Article 29 of the Law permits transfer to a foreign party where the receiving state provides adequate protection. Member States of the European Economic Area and states party to Convention 108 are deemed by law to provide adequate protection.

Our principal data stores are located in the European Union, which satisfies that condition. Where a limited transfer occurs to a provider outside the European Economic Area, principally for push notification and email delivery, we rely on the safeguards offered by that provider, including the Standard Contractual Clauses of the European Commission, together with encryption in transit and at rest and minimisation of the data transferred.

Our on-demand class videos are hosted and streamed by Mux, Inc. in the United States. That transfer is necessary to deliver the class the client has chosen to watch, and it is protected by Mux's data processing agreement, which incorporates the Standard Contractual Clauses of the European Commission, and by Mux's participation in the EU-U.S. Data Privacy Framework. Names, email addresses and account identifiers are not sent to Mux.

13. Marketing and Electronic Communications

Transactional messages relating to a booking, a change to a booking, an account security event or a legal notice are sent on the basis of the contract and cannot be unsubscribed from while the account is active.

Marketing messages are sent only with prior consent. Every marketing message contains a functioning unsubscribe mechanism, and consent may be withdrawn at any time in the account settings. Consent records include the time, the channel and the wording presented.

Push notifications require operating system permission in addition to consent recorded in the platform, and may be disabled per category. Operational notifications to staff, such as confirmation that an uploaded class is ready, are sent on the basis of the working relationship.

14. Review Cycle

This White Paper, the list of processing operations, the provider register, the retention schedule and the designation of the responsible person are reviewed at least annually.

An additional review is triggered by any of the following: introduction of a new category of personal data; engagement of a new provider or a change of hosting region; a security incident; the adoption of Draft Law No. 8153 or other material change in Ukrainian law; guidance issued by the Ukrainian Parliament Commissioner for Human Rights; or a complaint that reveals a gap.

15. Contact and Complaints

Individual entrepreneur Karnaukh Iryna Oleksandrivna Taxpayer registration number: 3029410706 Address: prov. Otakara Yarosha 12a, Kharkiv, 61045, Ukraine Data protection enquiries: privacy@ikpilates.com General enquiries: studio@ikpilates.com Telephone: +380 67 508 4343

You may lodge a complaint at any time with the control body for personal data protection in Ukraine.

Ukrainian Parliament Commissioner for Human Rights Address: vul. Instytutska 21/8, Kyiv, 01008, Ukraine Hotline: 0 800 50 17 20 Email: hotline@ombudsman.gov.ua Website: www.ombudsman.gov.ua

You also have the right to apply to a court for the protection of your rights and for compensation for material and moral damage caused by a breach of personal data protection legislation.