Last updated: 3 July 2026

This Privacy Policy explains how Mariia Sharlai (“we”, “us”, “our”), a Finnish sole trader (toiminimi), Business ID (Y-tunnus) 3554803-3, collects, uses, and protects personal data of people who register for dance classes and workshops through our website.

We are the data controller for the personal data described below.

Contact for privacy matters: mariiasharlai@gmail.com

 

1. What personal data we collect

Depending on how you interact with us, we may collect:

• Name of the person registering and, if different, the name of the student (participant)
• Email address
• Phone number, if provided
• Age or age group / class direction chosen (e.g. K-Pop, Contemporary/Lyrical)
• Parent or guardian name and contact details, for participants under 18
• Payment-related information needed to match a payment to a registration (e.g. payment reference, MobilePay transaction confirmation, invoice details). We do not collect or store card numbers or bank credentials ourselves; these are processed directly by our payment providers (MobilePay, our bank).
• Photos or videos taken during classes or workshops, only if you have given separate consent for this (see section 4)
• Basic technical data generated when you use our website or contact forms (e.g. submission timestamp)

We only collect what is needed to run registrations and communicate with you. We do not collect sensitive data (health information, etc.) unless you voluntarily share something relevant, e.g. an injury note before a class — see section on data minimisation below if you want to add this.

 

2. Why we process your data and on what legal basis

Purpose	Legal basis (GDPR Art. 6)
Registering you for a class, course, or workshop, and communicating practical details (schedule, location, changes)	Performance of a contract / steps prior to entering a contract (Art. 6(1)(b))
Issuing invoices and keeping accounting records	Legal obligation under Finnish accounting law, Kirjanpitolaki (Art. 6(1)(c))
Sending you news about upcoming courses, workshops, or offers by email	Consent (Art. 6(1)(a)) — you can withdraw this at any time
Using photos/videos from classes for social media or promotional purposes	Consent (Art. 6(1)(a)) — separate, specific consent, see section 4
Keeping basic records to run and improve the business (e.g. which groups are full)	Legitimate interest (Art. 6(1)(f)), balanced against your rights

 

3. Children’s data

Some of our classes (K-Pop) are aimed at teenagers. Where a participant is under 18:

• Registration and any data-processing consent must be given by a parent or legal guardian, not the minor.
• Consent for photo/video use of a minor must also be given by a parent or legal guardian, and is always separate from the consent needed simply to register for a class.
• A parent or guardian can withdraw consent, or request deletion of their child’s data, at any time using the contact details above.

 

4. Photos and videos

We may take photos or videos during workshops and classes for use on social media (Instagram, TikTok) and for promotional materials. This only happens with your explicit, separate consent given at registration (or for minors, the consent of a parent/guardian). If you did not tick the photo/video consent box, we will not use images of you or your child publicly. You may withdraw this consent at any time; we will stop future use, though we cannot always retract content already published and shared by third parties.

 

5. Who we share data with (processors)

We use a small number of external service providers to run the business. They process data on our behalf, under their own data processing agreements:

• Hostinger (website hosting, Hostinger Reach for registration forms and email communication) — Hostinger provides a Data Processing Agreement and, where data leaves the EEA, relies on EU Standard Contractual Clauses.
• Holvi — our business banking provider, for payments made by bank transfer.
• MobilePay Business — for payments made via MobilePay.

We do not sell personal data, and we do not share it with third parties for their own marketing purposes.

 

6. How long we keep your data

• Registration and contact data: kept for as long as needed to deliver the class/course/workshop, plus a reasonable follow-up period, generally no longer than 12–24 months after your last class with us, unless you remain subscribed to our newsletter.
• Invoices and payment records: kept for 6 years after the end of the accounting year, as required by Finnish accounting law (Kirjanpitolaki).
• Marketing email list: kept until you unsubscribe or request deletion.
• Photos/videos: kept as long as reasonably used for promotional purposes, or until you withdraw consent, whichever is earlier.

 

7. Your rights

Under GDPR, you (or, for a minor, their parent/guardian) have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data (“right to be forgotten”), subject to our legal obligations (e.g. accounting records)
• Restrict or object to certain processing
• Withdraw consent at any time, without affecting processing done before the withdrawal
• Request a copy of your data in a portable format
• Lodge a complaint with the Office of the Data Protection Ombudsman (Tietosuojavaltuutetun toimisto), tietosuoja.fi, if you believe your data has been mishandled

To exercise any of these rights, contact us at mariiasharlai@gmail.com.

 

8. Security

We take reasonable technical and organisational measures to protect your data, including relying on providers (Hostinger, Holvi, MobilePay) that maintain their own security and compliance standards. Access to registration data is limited to what is needed to run the business.

 

9. Cookies

Our website is built on WordPress with Elementor. By default, this only sets essential technical cookies needed for the site to function (e.g. security, load balancing). As we connect additional tools such as registration forms, website analytics, or social media embeds, these may set additional cookies that require your consent.

Where non-essential cookies are used, you will see a cookie consent banner when you first visit the site, allowing you to accept or decline them. You can change your cookie preferences at any time through the cookie settings link in the site footer.

For the current, up-to-date list of cookies in use, see our [Cookie Policy page link] — this list is automatically kept current as new tools are added to the site.

 

10. Changes to this policy

We may update this policy from time to time, for example if we start using a new tool or service. The “last updated” date at the top will reflect the latest version. Significant changes will be communicated where appropriate.

 

This document is a draft template and does not constitute legal advice. Given that data from minors is processed, we recommend a final review by a legal professional or the Finnish Data Protection Ombudsman’s guidance before publishing.