Privacy Policy
Who is responsible
Mandy's Jump & Smile operates this website and its booking system and determines the purposes and means of processing your personal data. Contact details can be found on the Contact page and in the Legal Notice.
When you book a class
First and last name — so I know who is using each trampoline.
Email address — I send a one-time code to confirm that the booking is yours, followed by your booking confirmation, reminder, and any changes or cancellations.
Mobile number — so I can contact you on the day if the class has to be moved or cancelled at short notice.
The class and trampoline you have chosen, as well as the names of any other people you are booking for.
Your language and the consents you have given (Terms and Conditions, and marketing if you have opted in).
Legal basis: performance of the booking contract you request (Article 6(1)(b) GDPR).
Waiting list and private event enquiries
The same contact details are collected, along with the information you provide in your enquiry (date, group size, location and message).
Legal basis: your request and steps taken prior to entering into a contract (Article 6(1)(b) GDPR).
Automatically, whenever you visit
Technical request logs, including a shortened and hashed version of your IP address, used solely to limit abuse of the “code” and “booking” entry points.
Cookies: only those necessary for the website to function — your language preference and, if you log in as a team member, a session cookie. If you tick "Remember me on this device" when booking, a cookie keeps you recognised in that browser for 30 days, so your details are filled in and no code is needed; "Not you?" deletes it at once. No advertising, tracking or analytics cookies are used, and there are no third-party trackers.
Legal basis: our legitimate interest in keeping the system available and protected against abuse (Article 6(1)(f) GDPR).
If you opt in to marketing
Your email address is used to inform you about new classes and events.
Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw your consent at any time — every message contains an unsubscribe link, and you can also contact me directly.
What I never do
I do not sell or rent your data.
I do not create advertising profiles or use advertising pixels.
I do not publish your name, photo or review without asking you first.
Who else sees your data
Only the service providers necessary to operate the booking system, and only the minimum information required:
Website hosting — alwaysdata SARL (Paris, France) runs this website on servers located in France.
Booking database — Supabase stores booking data on servers located in Frankfurt am Main, Germany.
Email — Infomaniak Network SA (Geneva, Switzerland) hosts my mailbox at info@mandysjumpandsmile.lu and receives the messages you send me. Automated messages from the booking system — your one-time code, confirmation and reminder — are sent through the same Infomaniak mail service.
SMS — no SMS provider is currently enabled; the booking system uses email. If I enable SMS in the future, this policy will identify the provider beforehand.
Online payments — for classes that can be paid online, payment is handled by Stripe Payments Europe, Limited (Dublin, Ireland). Your card details go directly to Stripe; I never see or store them. I only receive confirmation that the payment succeeded, the amount, and the booking it belongs to.
Digital wallets — if you choose to pay with Apple Pay or Google Pay, the wallet provider — Apple Distribution International Ltd. (Cork, Ireland) or Google Ireland Limited (Dublin, Ireland) — also processes the data needed to complete that payment, under its own privacy policy. Which wallets are offered depends on your device; paying by card is always possible instead.
Pass partner at a venue — where the class passes for a venue are sold by a partner practice (Aspelt: Kinésithérapie Marc Peters), the booking form asks whether you want to buy a single class or a pass from them. Only if you choose to do so do I pass your name, email address, mobile number, postal address if you give one, and the date and choice of class to that partner, so they can arrange and invoice your pass. Nothing at all is shared if you do not choose to buy from them.
Where your data is stored
The website runs on servers located in Paris, France, and the booking database is stored in Frankfurt am Main, Germany — both within the European Union.
My mailbox is hosted in Switzerland, which the European Commission recognises as providing an adequate level of data protection, meaning your data benefits from equivalent safeguards there. Online payments are processed by Stripe in Ireland, inside the European Union. Stripe may transfer payment data to the United States under the European Commission’s Standard Contractual Clauses.
Retention periods
Bookings and customer records: 36 months after your last class, after which they are anonymised. Accounting records are retained for longer where required by tax law.
Message logs (codes, confirmations and reminders): 90 days.
Anonymous statistics (such as class occupancy rates): retained without personal data.
These retention periods are configured in the club's system and may be shortened.
Your rights
Under the GDPR, you have the right to request:
a copy of the personal data held about you;
correction of inaccurate data;
deletion of your data (immediately, unless an existing booking or accounting obligations prevent this);
restriction of or objection to the processing of your data;
portability of your data;
withdrawal of your marketing consent at any time, without affecting messages already sent.
Contact me via the Contact page — I will respond within one month. You can also manage or cancel a booking yourself using the link in your confirmation email, without having to contact anyone.
If you believe your personal data is being processed unlawfully, you may lodge a complaint with the Luxembourg data protection authority:
Commission nationale pour la protection des données (CNPD)15, boulevard du JazzL-4370 BelvauxLuxembourgcnpd.public.lu
Minors
Classes for minors are booked by a parent or legal guardian, who provides the contact details and gives the necessary consents. I do not knowingly collect personal data directly from children.
Photos and videos
I take photos and videos during some sessions for use on the website and Instagram. Please let me know if you prefer not to appear — either before or after the class — and I will not use those images, or I will remove them. Any content created or edited using AI is identified as such in the gallery.
Changes
If this policy is amended, the new version will be published on this page with an updated date. Substantial changes affecting bookings will be communicated by email.
Version 8 · 2026-09-14