Privacy Policy – SALSALiege.com

This page is a translation of the French version of our privacy policy; in the event of any difference between the two, the French version prevails, except where mandatory provisions of the law of your country of residence give you greater protection.

Last updated: October 21, 2026

The “In plain language” boxes summarize each section in everyday language. They are there to help you understand: it is the legal text that follows them that prevails.

---

Protecting your personal data is a commitment for us, not a formality. We collect only what is necessary to run our services, and you stay in control, at all times, of what you share.

---

The essentials at a glance

• We collect only what is strictly necessary to run our services, track your progress and secure your payments.
• No non-essential cookie is set until you have made your choice. We use no advertising trackers.
• The personalized version of the Sal assistant (artificial intelligence) is turned off by default: you turn it on and off at any time.
• You can download or erase your data yourself, from your personal area.
• The list of our technical processors, with the GDPR safeguard for each, is in Article 4.

---

Article 1 — Controller

The controller of the personal data collected on SALSALiege.com is:

• Xavier Colina Valdor, self-employed entrepreneur trading under the business name SALSALiege.com
• Belgian company number: BE 0680.589.117
• Address: Rue Léon Troclet 24, 4000 Liège, Belgium
• GDPR contact email: dpo@salsaliege.com

For the full identification of the site’s publisher, the hosting and the credits, see our Legal Notice.

If you are an organizer, DJ or teacher listed in our calendar of parties, a dedicated notice is addressed to you in our Legal Notice, Article 12.

We have not appointed a data protection officer (DPO): the law does not require one for Studio24 (Article 37 GDPR: no systematic activities on a large scale, no special categories of data within the meaning of Article 9). Xavier Colina Valdor is nonetheless personally your point of contact for any question about your data, at the email address above.

---

Article 2 — Why and how we use your data

Below, for each purpose, is what we do with your data and on what legal basis (Article 6 GDPR).

2.1 To create and manage your account

Data used: first name, last name, email, protected password, date of birth, dance level, favorite styles, customizable avatar (emoji).
Legal basis: performance of a contract (Article 6(1)(b) GDPR).

2.2 To track your learning progress

Data used: videos watched, levels completed, experience points (XP), streaks and practice days, including in the rhythm game, favorites, attendance recorded at Studio24 classes or at parties (Puerto Rico Nights).
Legal basis: performance of a contract (Article 6(1)(b)).

2.3 To personalize your recommendations and the tone of our communications

Data used: a learning profile calculated automatically from your activity (progress, participation in the community, technical indicators).
Legal basis: legitimate interest (Article 6(1)(f) GDPR). You can object to this processing at any time (right to object, Article 21), with a single tap from your personal area → Profile → Settings → Privacy → “My profile analysis”.
If you object, we erase your calculated profile.
We also erase the activity counters that were used to calculate it.
After that, we no longer calculate one.
We also place your account in a group according to your purchases and your activity.
This group is used to tailor our messages.
If you object, we erase it too.

Good to know: this calculation is done by our own systems, without artificial intelligence. The site manager may then review some results with the help of an AI, under a pseudonym (Article 10.10). No automated legal decision within the meaning of Article 22 GDPR is made. Some indicators are used only for internal monitoring of the quality of the service and are not shown to you. A data protection impact assessment (DPIA) has been started; it will be available on request at dpo@salsaliege.com once it is finalized.

2.4 To provide the Sal assistant (artificial intelligence, optional)

Data used: your conversations with the Sal assistant, the text of your goals and a factual learning profile (summary of your progress) in which your identity is replaced by a pseudonym (see 4.4).
Legal basis: your explicit consent (Article 6(1)(a) GDPR).
Deactivation: at any time from your personal area → Profile → Settings → AI personalization.

2.5 To secure your payments and issue your invoices

Data used: amount, date, payment method (the card number is never stored on our servers — Stripe handles it).
Legal bases: performance of a contract (Article 6(1)(b)) and legal obligation to keep accounts (Article 6(1)(c) — Belgian Code of Economic Law, 7 years).

2.6 To send you useful communications

Data used: email, communication preferences.
Legal bases, depending on the message:

• your consent (Article 6(1)(a) GDPR): voluntary newsletter sign-up, or turning on a category of emails in Settings → Notifications (unchecked by default);
• the box “I also want to receive Studio24 offers by email”, offered when you enter your date of birth: optional, with no effect on your birthday gift, and can be withdrawn at any time (Article 6(1)(a) GDPR);
• performance of a contract (Article 6(1)(b)): the messages that help you discover the service you are paying for;
• our legitimate interest towards our existing customers for a similar service (Article 6(1)(f) GDPR, combined with the “existing customer, similar service” exception provided for by the Royal Decree of April 4, 2003, adopted in implementation of Article XII.13 of the Belgian Code of Economic Law, which transposes Article 13(2) of the ePrivacy Directive 2002/58/EC); the option to object is offered to you as soon as your order is confirmed.

The full list of automated messages, grouped by family with the legal basis for each and how to stop it, is in Article 16 of our General Terms and Conditions of Sale. In every case, you can unsubscribe with 1 click from the footer of each of these emails, and a single unsubscribe is enough: unsubscribing from the newsletter also turns off the weekend recap and the studio’s offers, and vice versa.

Special case — the discovery journey: when your access opens, a series of emails guides you through getting started with the service you signed up for; some are sent depending on your progress. These emails are strictly informational and contain no promotional content. Legal basis: performance of a contract (Article 6(1)(b) GDPR). You can stop them at any time: 1-click unsubscribe link in each email, or Settings → Notifications → “Welcome emails” (the email linked to referrals is turned off separately, in the “My progress” category).

Special case — resuming a sign-up: if you enter your email address to sign up without finishing the creation of your account, we send you a single resume email, with no reminders. Legal basis: pre-contractual steps taken at your request (Article 6(1)(b) GDPR). If you do not follow up, this address is erased from our systems within 30 days.

2.7 To secure the site and prevent fraud

Data used: IP address, technical login identifiers, audit log of sensitive actions.
Legal basis: legitimate interest (Article 6(1)(f) GDPR), on account of our obligation to ensure the security of processing (Article 32).

2.8 Screen visits — to tailor the app’s discovery invitations

Purpose: to tailor the app’s discovery invitations.
Data: a simple opening counter for a few screens only. No date, order of visit, duration or origin is recorded.
Legal basis: legitimate interest (Article 6(1)(f) GDPR).
Storage and retention: on our servers, until the account is deleted (it is erased automatically along with it).
Recipients: none.

2.9 Push notifications — to alert you in real time

Purpose: to alert you in real time to an event that concerns you (for example an unlocked badge or the reminder of a party or of a goal), according to the categories you choose.
Data: the technical information of your notification subscription (provided by your browser), the device type and the date of last use. No mobile app identifier is used: this channel was withdrawn on June 30, 2026.
Legal basis: your consent (Article 6(1)(a) GDPR). Your browser first asks you for permission, then you choose, category by category, what you receive from your personal area → Profile → Settings → Notifications.
Storage: your subscription, on our servers. The content of each notification is encrypted: your browser’s notification service merely forwards it, without being able to read it.
Retention: the notification, 30 days after it is sent (automatic deletion); your subscription, until it expires or after 90 days without use.
Deactivation: at any time, by withdrawing the permission in your browser settings and/or by turning off each category from your personal area → Profile → Settings → Notifications.
Recipients: your browser’s notification service (Google, Apple or Mozilla depending on the browser used, see 4.3.2), which forwards the encrypted message without ever accessing its content.

2.10 To check that the app is being updated

Data used: the version of the app you are using.
Legal basis: our legitimate interest (Article 6(1)(f) GDPR) in ensuring the proper functioning of the service and in helping you if there is a problem.

2.11 To prepare and send a gift voucher

Data used: the first name and last name of the person or people to whom you are giving the voucher, the name entered in “From”, your message and, if you ask us to send the voucher, the email address of the person receiving it and the sending date.
Legal basis: performance of your order (Article 6(1)(b) GDPR); for the person receiving the voucher, our legitimate interest (Article 6(1)(f)) in delivering to them the gift you are giving. Their address is used only for this sending: we do not add it to any list and we erase it as soon as it is sent. The first email they receive tells them who we are, why we have their address and where to read this policy (Article 14 GDPR).

Our commitment: none of these purposes involves sharing your data with third parties for advertising purposes, and no behavioral advertising is served based on your data.

---

Article 3 — Recipients of the data

Your personal data is accessible only to:

• Xavier Colina Valdor (controller) and the technical staff of Studio24, for strictly operational needs.
• Our processors, whose full list is in Article 4, who act on written instructions and in accordance with the GDPR.
• The authorities, on a valid court order, within the strict limits provided for by law.

We never sell your personal data to third parties.

---

Article 4 — Processors, independent controller and third-party services

4.1 Processors (Article 28 GDPR)

Most are bound by a data processing agreement (Data Processing Agreement, DPA) that guarantees compliance with the GDPR; the table specifies each one’s safeguard. “DPF” means the Data Privacy Framework, the framework governing transfers of data from the European Union to certified US companies.

A copy of the applicable transfer safeguards (Data Privacy Framework certifications, Standard Contractual Clauses) can be obtained on request at dpo@salsaliege.com (Article 13(1)(f) GDPR).

4.2 Independent controller

Vimeo Inc. (United States) hosts and delivers the Studio Live teaching videos as an independent controller: it alone determines the ancillary purposes of its processing (fraud prevention, improvement of its platform).

Safeguards: EU-US DPF certification, supplemented by the European Commission’s Standard Contractual Clauses signed with Vimeo. All the Vimeo videos embedded in SALSALiege.com are set to “Do Not Track” mode, which turns off Vimeo’s advanced behavioral tracking and the third-party measurement tools (notably Google Analytics) that the player would otherwise load.

4.3 Third-party services

4.3.1 Embedded in the pages of the site

Your IP address is passed to these services only if you voluntarily click the map, the video or the player: simply reading the page sends nothing.

4.3.2 Push notifications — technical recipients (see 2.9)

Your browser’s notification service is not a processor within the meaning of Article 28 GDPR: it only receives an encrypted message that it can never read and merely forwards it. We name it for transparency about the technical recipients of your data; it comes into play only if you turn on notifications (Settings → Notifications).

4.3.3 Preview of your video (Stage field)

If you submit the link to a video of yourself dancing, hosted on YouTube or TikTok, we retrieve a preview thumbnail for our moderation team. Only the address of the video you chose to share is passed to the platform.

Private video-conference classes: if you choose a remote private class, it takes place with Zoom (Zoom Video Communications, Inc., United States — EU-US DPF) or WhatsApp (Meta Platforms Ireland Ltd., Ireland), by mutual agreement with you. These tools are not loaded on any page of the site and are used only to hold the class.

4.4 Minimization and pseudonymization

Before anything is sent to Mistral AI, your first name, last name and email are replaced by a pseudonym (data minimization principle, Article 5(1)(c) GDPR). What you write yourself in your messages may nevertheless be about you: avoid including sensitive information. You can turn off this processing at any time from your personal area → Profile → Settings.

---

Article 5 — Retention periods

In accordance with Article 5(1)(e) GDPR (storage limitation), we keep your data only for as long as necessary for the stated purposes, or to meet a legal obligation.

• Your account and your preferences: kept as long as your account remains active (inactive accounts: see “Inactive accounts” below).
• Your invoices and transactions: 7 years, in accordance with our Belgian accounting obligations.
• Gift vouchers: the email address of the person receiving the voucher is erased as soon as it is sent, or when the voucher is canceled; the names and the message are erased when the voucher expires.
• Your progress, your attendance and your experience points: as long as your account is active. Everything is erased within 24 hours of the account’s deletion.
• Your login remembered on a device: up to 365 days; you can end it at any time by signing out (see “Login sessions” below).
• Your cookie choices: 365 days, renewed each time you change your choice.
• Your notifications received: 30 days, automatic deletion.
• Your conversations with the Sal assistant: 90 days, then automatic erasure of the content of the exchanges: your messages and the technical data that goes with them (IP address and browser in coded form, the page you wrote from). A line with no content at all remains (date of the conversation, volume processed, cost), still linked to your account, which we use to track the volume and cost of the service; it does not allow a message to be reconstructed and it is deleted with your account.
• The duel with Sal (rhythm game): Sal’s lines during the duel are not kept. If they were ever written by artificial intelligence and recorded, they would be kept for 90 days, like your conversations with Sal. Your records and progress in the game are kept as long as your account is active: only your best result is kept, along with the days you played. If you appear in a public weekly ranking, your line for the week remains visible until your account is deleted.
• Contact details left with the Sal assistant (first name, email, goal): 24 months, then automatic erasure.
• Sal coach memory (information retained from your exchanges, if you have turned it on): 180 days after its last update (each new observation of the same fact extends this period), then automatic erasure.
• Audit log (security): 90 days, then automatic deletion.
• The version of the app you are using, kept for 14 days, to check that updates reach you and to help you if there is a problem.
• Proof of your unsubscribe or of your erasure request with our email-sending tool: 30 days, then automatic deletion; deleted immediately if you erase your account.
• Record of your privacy choices: when you turn the coach memory on or off, we keep for 3 years a dated record of your choice (date, choice made, version of the policy, browser used and your IP address in non-reversible coded form — never the address itself), so that we can demonstrate your choice (Article 7(1) GDPR). If you delete your account, this record is made anonymous. Your other choices (such as AI personalization) also leave a dated record, which disappears entirely with your account.

Inactive accounts: if you stop using your account for 35 consecutive months (no login, no class taken, no attendance at the studio, no purchase), we send you a notice email. If you do not respond within 30 days — simply logging back in is enough to keep your account —, it is handled automatically, that is 36 months in total after your last activity:

• Account with a purchase history: anonymized. Your personal data (email, name, progress, activity history, login identifiers) is erased and your identifier is neutralized. The account is kept in anonymous form, for the sole purpose of linking your invoices to our accounting obligations (kept 7 years). You are then no longer identifiable.
• Account with no purchase history at all: deleted.

Active subscribers are never affected by this processing. You can request the immediate deletion of your account at any time (see below), without waiting for this period.

Deletion of your account: all of your data is erased within 24 hours of your request, except invoices, which are kept 7 years (Belgian accounting obligation). The audit log is anonymized (IP address, browser and content erased), but its lines remain for 90 days for legal traceability. Only the number of your former account, without your name or your address, is kept there, and is included in the internal report received by the site manager, so that the erasure can be redone if a backup were ever put back into service.

Your data in our backups: our host (Automattic, see Article 4) automatically backs up the platform so that it can be brought back up after an outage, an error or an attack. Data we have just erased therefore remains temporarily in these safety copies, which go back up to 365 days. They are used only for disaster recovery: never consulted to find information about a person, nor used for any other purpose. If a restoration were to bring back data that had already been erased, we undertake to redo the erasure as soon as we become aware of it. This is the only limit on the 24-hour promise above.

Login sessions: your session stays open as long as you keep coming back, so that you do not have to log in again at every visit, and it is closed after 90 days of inactivity. Your access is personal: it can be open on a limited number of devices; beyond that, a new login signs out the oldest device. You can view your active sessions and close them at any time from your personal area (“My sessions” / “Sign out everywhere”). The associated technical data (device identifier, country of login, IP address in coded form) is deleted no later than 30 days after the session ends or is revoked.

---

Article 6 — Cookies and local storage

The preferences window offers you two categories: the Essential ones, always on because the site does not work without them (login, cart, referrals), and Performance measurement, which stays off until you accept it. No advertising cookie is set, in any case. AI personalization (Mistral) is not a cookie: it is set in Settings → Privacy → AI personalization.

6.1 Essential (no consent required)

These cookies are essential for the site to work. They are set by our site, serve no advertising and are exempt from your consent (Belgian law: Act of July 30, 2018 on the protection of natural persons with regard to the processing of personal data (LCPDF), Art. 10/2, para. 2; GDPR: basis 6(1)(b), performance of the service you request):

• Staying logged in to your personal area without identifying yourself at every visit (sl_access, 15 minutes; sl_refresh, sl_recovery, sl_recovery_hint and sl_session_hint, 365 days each).
• Login to the shop and the pages of the site (wordpress_logged_in, 14 days): keeps you recognized in the shop without having to identify yourself again.
• Access to the site’s administration (wordpress_sec, 14 days): set with the login, it is used only by the studio’s staff.
• Protecting your account (sl_device_id, 400 days; sl_magic_req, 15 minutes): the first recognizes your device from one login to the next, even after signing out; the second secures login by email, by link or by code.
• On a shared device (sl_session_owner, 365 days): helps prevent one person from ending up in another’s personal area. It contains no readable information about you and is passed to no third party.
• Login information (sl_session_plafond, 60 seconds): lets us display a message when the number of devices allowed on your account is reached.
• Going to payment (sl_bridge and sl_bridge_confirm, a few minutes): secure the move from your personal area to payment. They are passed to no third party.
• Referrals (sl_ref, 30 days at most): set only if you arrive through an invitation link, it remembers who invited you so that the referral can be credited when you sign up. It is passed to no third party and the “Reject all” button in the preferences window erases it immediately.
• Cart (WooCommerce session cookies): remember your purchases in progress.
• Interface preferences: remember your language and your display mode.
• Fallback messages of the Sal chat (displayed in non-personalized mode): kept temporarily on your device.

6.2 Error measurement and performance measurement — Sentry

To keep the service reliable, the measurement of the app’s errors and crashes is active by default. It neither sets nor reads any cookie or tracker in your browser (the prior-consent requirement of the Belgian LCPDF, Art. 10/2, therefore does not apply), and the data is cleaned of any personal identifier before sending. Performance measurement, however, remains subject to your consent.

• Purpose: to spot errors and crashes in order to fix defects and maintain the quality and security of the service.
• Legal basis: our legitimate interest (Article 6(1)(f) GDPR) in ensuring the proper functioning of the service; a balancing assessment is available on request.
• Processor: Functional Software Inc. (Sentry) — European data processed in Germany, with the United States as a fallback. The transfer is guaranteed by the EU-US Data Privacy Framework (adequacy decision, Article 45 GDPR) and a data processing agreement (DPA).
• Data: technical information about the incident (where it occurred, the page, your last actions before the incident), with no personal data.
• Retention: 30 days at Sentry.
• Right to object (Article 21): at any time, in a single tap, from Settings → Privacy → “Anonymous error reports”. This choice applies to the device you are using: if you have several, do it on each one.
• Rejecting cookies also turns off error measurement. If you answer “Reject all” in the preferences window, error measurement is also turned off on that device: a refusal is a refusal. You can turn it back on from Settings → Privacy → “Anonymous error reports”.

Performance measurement, on the other hand, starts only if you accept it. It is the “Performance measurement” box in the preferences window, unchecked by default. It measures the speed of the app and sends anonymized measurements to Sentry, solely to make it smoother. Legal basis: your consent (Article 6(1)(a) GDPR). Withdrawal: at any time from Settings → Privacy → “Cookies”, which reopens that same window. Refusing removes no feature.

6.3 Third-party services loaded by the site

Some third-party services are loaded without waiting for your consent, because the site relies on them (hosting, images, payment, video). None sets an advertising cookie:

• Our host (WordPress.com): adds a tool that measures how fast the site displays, which we cannot turn off (see Article 4). Basis: legitimate interest / hosting contract.
• ShortPixel (spcdn.shortpixel.ai; ID SCOUT SRL (ShortPixel), Romania, EU): optimizes and delivers the site’s images, and sees your IP address for that purpose. Basis: operation of the service.
• Stripe (js.stripe.com; Stripe Payments Europe Ltd., Ireland): protects payments against fraud with two cookies, __stripe_mid and __stripe_sid, never advertising ones and never used to track you from one site to another. They are set only on the plan pages, in the cart and during a payment. Basis: operation of the service / performance of the payment contract (6(1)(b)).
• Vimeo (player.vimeo.com): hosts our videos and their preview images. On the pages of the site, a video loads only after your click; in the course app, it is streamed from Vimeo when you start playback, without an embedded Vimeo player. When a Vimeo player is displayed, “Do Not Track” mode turns off behavioral tracking. Vimeo is an independent controller for its own purposes (see Article 4.2).
• Cloudflare Turnstile (challenges.cloudflare.com; Cloudflare Inc., see Article 4): anti-bot check loaded when you use the Sal assistant, to prevent automated abuse; no advertising tracking. Basis: legitimate interest (security of the service).

6.4 Information kept on your device (local storage)

Your personal area keeps some information directly on your device. None of it is an advertising tracker and none of it is shared with a third party. It falls into two categories.

Where a duration is stated below, it is the time during which the information is of use: after that, it is no longer used and it is erased the next time the app is opened.

a) What never leaves your device — our servers do not receive this information:

• Your display preferences (party mode, theme) and what you have already seen or dismissed (welcome guides, banners, warnings), so as not to show it to you again.
• Your video playback settings, where you left off in a video and whether you have already given your feedback on a lesson.
• Your rhythm-game preferences and markers (except the style and music chosen: see below), and the sound setting specific to your device (valid 6 months at most). We also keep a few results here: the number of perfect games per exercise and the number of times a boss has beaten you; they are erased from the device when you sign out. Nothing kept here is sent to our servers; your games, your progress and your records, on the other hand, are saved to your account (see Article 2).
• To save you time: a preview of your progress, the image of your check-in QR and your latest searches. They are erased from the device when you sign out.
• Your check-in QR codes for the next 12 hours, to show them straight away at reception. They are erased from the device when you sign out.
• The draft of the orientation quiz filled in before you signed up, valid for 24 hours at most.
• Your opt-out, if any, from error measurement, which you can change at any time from your personal area SALSALiege.com → Profile → Settings → Privacy.
• The installation status of the app, and a simple marker indicating that this device has already been used to log in, to spare you a needless login screen.
• A setting for measuring the app’s startup time, only if you turn it on yourself.
• We keep on your device the number of times you open each screen, and the date of your first opening of the app. This is used to prepare first the screens you use most, and to offer you, at most once a week, a short tour of a screen you have not yet opened. This information stays on your device and is erased when you sign out.
• A few markers of the app’s proper operation on this device (for example the date of an update). They are used only for the proper operation of the app and do not leave your device.

b) What is kept on your device and known to our servers:

• What the rhythm game could not send for lack of a connection: a finished game (exercise, level, tempo, taps, duration and regularity) and the hearts lost, including when the game stops for lack of hearts or you abandon it. It is sent to our servers as soon as the connection returns, then erased; whatever could not be sent within 24 hours is erased. If you sign out before then, it is erased without being transmitted.
• Actions taken without a connection (for example a favorite or a star): they are sent to our servers as soon as the connection returns, then erased. Those that could not be sent within 24 hours are erased. They are also erased if you sign out or if another person logs in on this device.
• The code of a gift voucher opened from its QR while you were not logged in: kept in the open tab for 30 minutes at most, while you log in, then sent once only to our servers to activate the voucher, and erased immediately.
• The style and music you chose in the rhythm game: kept on your device so you find them again next time. When you play or open a ranking, they are used to ask our servers for the corresponding music or ranking. They are not saved to your account and are erased from the device when you sign out.
• An identifier of your device: it contains neither your name nor your address and is not used on any other site. It is transmitted to our servers at each login by email (by link or by code), to tie your login to this device: this is what makes it possible to limit the number of devices open on your account and to show your sessions in “My sessions”. It disappears if you clear your browser’s data.
• Your cookie choices: kept on your device so as not to ask you again, and kept by our servers in pseudonymized form (date, banner version, choice made and a coded form of your IP address and your browser, never your IP address in plain form). The law requires us to be able to prove your consent (Article 7(1) GDPR): this proof is kept 3 years, then deleted. You can change your mind at any time via the “Manage my cookies” link at the bottom of the page.
• A copy of the last screens you viewed, so that the app opens faster when you return. It contains nothing more than what our servers have already sent you, apart from the actions taken without a connection described above. It is shown only to you. It is erased when you sign out, if another person logs in on this device, and after 30 days at the latest.

---

Article 7 — Your rights

Articles 12 to 22 GDPR give you rights over your personal data. They are exercised free of charge. We reply within a maximum of one month, which can be extended by two months for a complex request (Article 12(3) GDPR).

7.1 How to exercise your rights — from your account

Log in, then open your personal area SALSALiege.com → Profile → Settings:

• My data (My account section): download your data.
• Show my first name: hide your first name in public rankings.
• AI personalization and Sal Coach memory: turn the personalized Sal assistant and its memory on or off. What Sal knows about me (My account section) lets you view or erase what the coach has retained about you.
• My profile analysis and Anonymous error reports: object to these processing operations (Article 21; see Articles 2.3 and 6.2).
• Cookies: change your choices, including performance measurement.
• Delete my account (My account section): your data is erased within 24 hours (you are asked for your password to confirm).

You can also write to dpo@salsaliege.com.

7.2 Details of GDPR rights

7.3 Right to lodge a complaint with the supervisory authorities

If you consider that your rights are not being respected, you can lodge a complaint with the competent supervisory authority (Article 77 GDPR). Depending on where you live:

• Belgium: Data Protection Authority (APD) — Rue de la Presse 35, 1000 Bruxelles — +32 2 274 48 00 — contact@apd-gba.be
• France: CNIL
• Switzerland: Federal Data Protection and Information Commissioner (FDPIC)
• Québec: Commission d’accès à l’information du Québec (CAI)
• Other European Union countries: your national data protection authority (AEPD in Spain, Garante in Italy, AP in the Netherlands, etc.).

---

Article 8 — Security

In accordance with Article 32 GDPR, we protect your data with technical and organizational measures appropriate to the risk:

• The connection to the entire site is secured.
• Your passwords are protected: we never see them in plain text.
• Before anything is sent to our artificial intelligence or error-tracking providers, your identifiers are removed or replaced by a pseudonym (see Article 4).
• Our site undergoes regular security audits.
• In the event of an incident affecting your data, we notify the competent supervisory authorities without delay, as the law requires.

Account sharing. Studio Live subscriptions are individual. To protect your account and prevent fraud (legitimate interest, Article 6(1)(f) GDPR), we may analyze technical login information: the devices used recently and the country of login, inferred from your IP address (never kept in plain form, only in pseudonymized form). In the case of abnormal use, the account’s sessions may be signed out and a new login requested. No suspension is decided automatically: any follow-up is reviewed by a person.

This information is deleted along with the sessions concerned, no later than 30 days after they expire. You can exercise your rights, in particular your right to object, under the conditions described in Article 7.

The details of our security measures are documented internally and may be communicated to the supervisory authorities on a reasoned request.

---

Article 9 — Minors and minimum age

Registration on SALSALiege.com is reserved for people aged at least 16, whatever their country of residence. This single age of 16 is the default age set by the GDPR (Article 8(1)). We apply it voluntarily everywhere, even where the legal age of digital consent is lower: France, 15 years (Article 45 of the Informatique et Libertés Act); Belgium, 13 years (Act of July 30, 2018); Québec, 14 years (Law 25). Below the age of 16, creating an account is not possible, even with the agreement of a person holding parental authority.

For the sensitive features of the Sal assistant (the coach’s memory and the in-depth personalization of the profile), Studio24 additionally requires you to be 18, as a precaution. Sal’s generic assistance remains available from age 16.

---

Article 10 — Artificial intelligence (Sal assistant)

Studio24 uses the artificial intelligence of Mistral AI (France, EU) for:

• the Sal conversational assistant (Articles 10.2 and 10.3);
• the coach memory, which retains from your exchanges a few facts useful for your follow-up (Article 10.2);
• Sal’s comments in the rhythm game (Article 10.8);
• the categorization of your goals (Article 10.2);
• the checking of team names (Article 10.9);
• help with running the school, reserved for the site manager (Article 10.10).

The first four uses require your consent and stay off until you have given it. The only exception: Sal’s generic assistance for visitors without an account (Article 10.3). The checking of team names and the help with running the school do not depend on this consent.

10.1 Transparency (AI Act — EU Regulation 2024/1689, Art. 50)

In accordance with Article 50 of Regulation (EU) 2024/1689 (AI Act), we inform you that Sal is an artificial intelligence: you are talking to an AI, not a human. In the chat, the title permanently carries the label “Sal AI” and a banner tells you so before your first message. Everywhere Sal speaks to you, the screen tells you so, from the first interaction and throughout the exchange, including in any future feature.

The AI-written texts you can read are Sal’s answers and, in the rhythm game, its comments after a duel when they are generated by the AI. Each one is labeled as such, in a machine-readable way (Article 50(2) of the Regulation), and flagged on screen by a ✨ marker next to the message. The lines during the duel are written in advance by the team. Only one other text is written by the AI: the summary of your question that Sal prepares when you choose to continue on WhatsApp. You read it before sending it. All the other texts in the app are written by the team or produced by our own tools, without AI.

The rhythm game’s music is composed with a music-generation AI, then chosen one track at a time by the team. It is the only thing you hear that comes from an AI: the other sounds and Sal’s voice are produced by your device.

10.2 Sal Coach — logged-in users (explicit consent)

Personalization by Mistral AI is off by default: you turn it on yourself from your personal area SALSALiege.com → Profile → Settings → AI personalization.

• Legal basis: your explicit consent (Article 6(1)(a) GDPR).
• Data: your conversations with Sal, the text of your goals and a factual learning profile. Your name and your email are replaced by a pseudonym before being sent to Mistral. What you write yourself in your messages may be about you: avoid including sensitive information.
• Conversations: kept 90 days, then erased automatically.
• Talking to someone: if you ask Sal to talk to someone, or if you click “Contact by email”, your conversation is sent by email to Xavier Colina Valdor, so that he can reply to you.
• Coach memory (if you turn it on separately): the facts retained from your exchanges are kept 180 days after their last update (the period starts again with each update), then erased automatically. You can view and erase them at any time, fact by fact or all at once: Settings → My account → “What Sal knows about me”.
• Deactivation: at any time from Settings → AI personalization. Nothing is then sent to Mistral for these uses.

10.3 Sal — anonymous visitor (legitimate interest + information)

If you visit the site without creating an account, the Sal assistant may offer you generic assistance (questions about classes, discovering our offer). This processing is distinct from Sal Coach (Art. 10.2) and rests on a different legal basis.

• Legal basis: legitimate interest (Article 6(1)(f) GDPR) — helping the visitor and easing the load on human support — and/or pre-contractual steps at your request (Article 6(1)(b)) when you send a question about our offers. A legitimate interest assessment (LIA) documents the balance of interests. No prior consent is required under these bases.
• Mandatory information (AI Act, Article 50(1); GDPR, Article 13): as everywhere else (see 10.1), a banner tells you before your first message that you are talking to an AI.
• Data: your message, sent to Mistral after automatic removal of your emails and phone numbers. No IP address in plain form, no advertising tracker. Only a coded (pseudonymized) form of your IP address is used to prevent abuse; it is erased with the session. An anti-bot check from Cloudflare (Turnstile) is used (see Article 6.3). We keep only what is necessary (Article 5(1)(c) GDPR).
• Improvement: each week, a few visitor conversations, without their contact details, may be analyzed by the AI to spot the questions that Sal answers poorly.
• Retention: 90 days at most (Article 5), then automatic erasure. No memory from one visit to the next.
• Refusal or sensitive subject: if you prefer not to talk to an AI, or for a sensitive subject, write to Xavier Colina Valdor on WhatsApp (contact details in the Legal Notice).
• If you want personalization or the coach memory: create an account; your consent is then tied to your account (Article 10.2).
• Processor: Mistral AI SAS (France, EU), hosted by Microsoft Azure in Sweden and Norway. No transfer outside the European Economic Area.

10.4 Impact assessment (Sal Coach DPIA)

In accordance with Article 35 GDPR, we have voluntarily started data protection impact assessments for the analysis of your learning profile (without artificial intelligence, Article 2.3) and for the Sal Coach assistant (with Mistral’s AI, on explicit consent). They confirm that no automated legal decision (Article 22 GDPR) is made from these processing operations: the profiles are used only for learning suggestions and advice, which you can ignore at any time.

The detailed assessments will be available on request at dpo@salsaliege.com once they are finalized.

10.5 Mistral as processor

For details on the processor Mistral AI (country, safeguards, protection of your identity), see Article 4.

10.6 Review of conversations to correct Sal’s errors

Sal is an AI: it sometimes makes mistakes. To correct these errors, pseudonymized conversations may be reviewed, after automatic removal of whatever makes it possible to tell who wrote them (limits below).

• Legal basis: legitimate interest (Article 6(1)(f) GDPR) — ensuring the accuracy of the answers of an assistant in service. A legitimate interest assessment (LIA) documents the balance of interests, and this review remains compatible with the purpose for which your exchanges were collected (Article 5(1)(b)).
• What is reviewed: a small number of conversations per week, selected automatically because they seem to contain an error by Sal.
• What is removed before review: your contact details (email, phone, bank details), your account and conversation identifiers, the precise address of the page you wrote from (only the section is kept) and your name when we can recognize it. However, a name mentioned freely during the conversation may remain: no automatic process recognizes them all, and we prefer to tell you so rather than promise the impossible.
• Who reviews: the site manager, with the occasional help of an AI tool from Anthropic (Ireland / United States, see Article 4) which receives only that pseudonymized extract (with the limit stated above), never the database, and deletes it immediately afterwards. The review remains confidential: the person reviewing reads an exchange, not a person.
• Retention: none. The extract is reviewed, then deleted. Your conversations keep their own lifespan only: 90 days (Article 5).
• What this does not do: no decision concerning you results from it (no pricing, no access, no contact), no profile is built, and nothing is used to train an artificial intelligence.
• Your right to object: you can object to this review at any time by writing to dpo@salsaliege.com (Article 21 GDPR).

---

10.7 Matching between dancers: no AI

Suggestions of people — Practice partner, tandems, duels and crews — are calculated without artificial intelligence, from a few elements of your dance profile (styles, role, activity). No profile data is passed to an AI provider for these suggestions, and the mathematical data calculated by a former system has been deleted.

“Practice partner” is off by default: you turn it on and off at any time in Settings → Privacy. It connects you with other compatible members to practice at Studio24. They see only your first name (or “Anonymous” if you have hidden it), your rank, your role and your dance styles. This feature is reserved for adult members (18 or older), based on the date of birth declared in your profile. You can block or report any member from their card (“Safety”): a blocked member no longer sees you and is no longer suggested to you.

10.8 The duel with Sal (rhythm game)

In the rhythm game, you face “Sal”, the same assistant in a character role. The duel lines are written in advance by the team, never by the AI. A comment generated by the AI after the game carries the ✨ marker (see Article 10.1).

• What may be passed to Mistral (only if you have turned on AI personalization, which is off by default — Article 10.2): the dance style in progress, a summary of your records and your progress in the game.
• What is NEVER passed on: neither your first name, nor your last name, nor your email address, nor any identifier. The detail of your taps never goes to Mistral: only a technical summary accompanies your records so that their authenticity can be checked, and it never leaves our servers (see Article 5).
• Without your agreement, you still play: Sal answers with lines written in advance by the team, with no call to Mistral and without any data leaving. The game, the rewards and the progress are identical.
• No effect on your subscription: your scores have no effect on access to classes, the level assigned, the price or the subscription (see also Article 17 of the General Terms and Conditions).

10.9 Team names

When you create or rename a team, Mistral AI’s AI checks the name chosen, because it will be visible to all members. Only that name is sent.

• Legal basis: legitimate interest (Article 6(1)(f) GDPR): avoiding offensive names or names that impersonate someone else.
• If the name is rejected, you choose another. This rejection has no effect on your account or on your subscription.
• Your right to object: write to dpo@salsaliege.com (Article 21 GDPR).

10.10 Help with running the school

The site manager may ask Mistral AI’s AI questions to keep track of life at the school: sign-ups, pending requests, members who are coming less often, or a member’s record to sort out a problem.

• Data: your points, your streak, your progress, your latest attendance, your plan, whether you have read your latest notifications, and your recent activity (for example how many days since you last came). Your name, your email and your phone number are replaced by a pseudonym before being sent.
• The AI only reads: it changes nothing and makes no decision concerning you.
• Legal basis: legitimate interest (Article 6(1)(f) GDPR): running the school well and helping its members.
• Your right to object: write to dpo@salsaliege.com (Article 21 GDPR).

Article 11 — Changes to this policy

This policy may change (changes in law, technical changes, new features of the site). The date of the last update is shown at the top of the page.

In the event of a significant change (new processor, new purpose, new rights):

• The cookie banner will be displayed again automatically to obtain your informed consent anew.
• An information email will be sent to users who have turned on service emails.

---

Article 12 — Contact

For a question about your data, to exercise your rights or to report an incident:

• GDPR email: dpo@salsaliege.com
• Response time: 1 month at most (Article 12(3) GDPR), extendable by 2 months for complex requests.
• Postal mail: Xavier Colina Valdor, Rue Léon Troclet 24, 4000 Liège, Belgium.

---

Article 13 — Visitors residing in Québec (Law 25)

If you reside in Québec, the Act respecting the protection of personal information in the private sector (chapter P-39.1), as amended by Law 25, also guarantees your rights.

13.1 Person in charge of the protection of personal information

In accordance with Law 25, Studio24 designates Xavier Colina Valdor as the Person in Charge of the Protection of Personal Information. Contact: dpo@salsaliege.com.

13.2 Privacy impact assessment (PIA)

Before any transfer of personal information outside Québec (notably to our processors Sentry, Cloudflare, Automattic and Stripe, and to Vimeo, an independent controller for the purposes it determines alone), Studio24 carries out a privacy impact assessment, in accordance with Article 17 of Law 25. This assessment is documented and can be consulted on request by Québec residents.

13.3 Right to lodge a complaint

You can lodge a complaint with the Commission d’accès à l’information du Québec (CAI).

---

Article 14 — Visitors residing in Switzerland (nFADP)

If you reside in Switzerland, the Federal Act on Data Protection (nFADP, SR 235.1, in force since September 1, 2023) also guarantees your rights. This Act is compatible with the GDPR (the European Commission’s adequacy decision is valid).

Main points:

• Incident notification: Studio24 notifies the Federal Data Protection and Information Commissioner (FDPIC) “as soon as possible” (Article 24 of the nFADP). Our internal 72-hour procedure, aligned with the GDPR, is stricter and covers this requirement.
• Personal sanctions: the nFADP provides for personal criminal sanctions of up to CHF 250,000 in the event of intentional breach by the controller (Article 60 et seq.).
• Supervisory authority: Federal Data Protection and Information Commissioner (FDPIC).