We use necessary cookies to make the site work, for example to keep you signed in. These do not need your permission.
If you accept, we also use Google Analytics and Google Ads cookies to understand how the site is used and whether our ads work.
If you reject, the site works just the same. You can change your mind at any time by clearing your browser cookies. Privacy policy
Last updated: 2 October 2026
This policy explains how Orlo Ltd (“Orlo”, “we”, “us”) collects and uses personal data, and what rights you have. We’ve tried to keep it readable. If anything is unclear, email steve@orlo.es.
Orlo Ltd, a company registered in England and Wales (company number 16715372)
Registered office: 124 City Road, London, EC1V 2NX, United Kingdom
Contact: steve@orlo.es
EU representative (Article 27 GDPR): Stephen Brewer, Carrer de Batllori 14, 08901 Barcelona, Spain
Because we are a UK company serving businesses in Spain and the EU, both the UK GDPR and the EU GDPR apply, together with Spain’s Organic Law 3/2018 (LOPDGDD) and the LSSI-CE.
If you book classes, buy memberships or use an app through a gym or studio that runs on Orlo, the gym is responsible for your data, not Orlo. The gym is the “controller”; we are its “processor”, meaning we store and process your data on the gym’s behalf and under its instructions, under a data processing agreement.
The gym’s own privacy policy explains what it does with your data. To access, correct or delete your data, contact your gym first. If you contact us, we’ll pass your request to the gym and help them answer it.
If your gym advertises its website on Google Ads through Orlo and you accept advertising cookies on its website, Orlo, on the gym's behalf, sends Google your email address and phone number turned into an irreversible code (a hash), never in plain text, when you sign up, make a first payment or write to the gym, so Google can tell whether you came from one of its ads. Without your consent nothing is sent.
The rest of this policy covers data where Orlo is the controller.
What: name, email, phone, business name and address, tax details, login details, role and permissions, billing history, support messages, and how you use the Platform.
Why: to provide your account and the Platform, take payment for your plan, support you, keep the Platform secure, and tell you about service changes.
Legal basis: performance of our contract with your business; legitimate interests (security, improving the Platform); legal obligation (tax and accounting records).
What: whatever you send us through forms, email or WhatsApp — typically name, business, contact details and your message.
Why: to reply and, if you’re interested, to set up an account.
Legal basis: steps taken at your request before a contract; legitimate interests.
We research fitness businesses that might benefit from Orlo, using publicly available sources such as Google Maps listings and the businesses’ own websites. This is business information, but it can include personal data where a business is run by a named individual or lists a named contact.
What: business name, public contact details, website, public reviews and ratings, and technical information about the website (such as which booking software it uses and search-engine checks).
Why: to decide who might benefit from Orlo and to contact them about it.
Legal basis: legitimate interests. We only send commercial emails where the law allows it, and every message includes an easy way to opt out. If you ask us not to contact you, we’ll keep a minimal record of your details solely to make sure we don’t contact you again.
If you take part in our boutique studio survey or report, we use your answers to produce aggregated, anonymised findings.
What: your answers and any contact details you choose to give.
Legal basis: consent, which you can withdraw at any time. Published results never identify individual respondents or studios without permission.
What: technical data such as IP address, browser, device, pages viewed and referral source, collected through cookies and similar technologies (see section 8).
Why: to run the site, keep it secure and understand how it’s used.
Legal basis: legitimate interests for strictly necessary cookies; consent for analytics and advertising cookies.
We may send product news and offers to people who have signed up to Orlo or asked to hear from us. You can unsubscribe at any time through the link in any email, or by emailing steve@orlo.es.
Orlo uses third-party AI providers to power features such as the assistant, AI-assisted setup, and reading marketplace booking emails. Data sent to these providers is used only to provide the feature. We only use providers whose terms do not allow them to train their models on the data we send them. We don’t use AI to make decisions about you that have legal or similarly significant effects.
We may combine usage data across the Platform and anonymise it so that it no longer identifies any person or gym. We use this to improve Orlo and to publish industry benchmarks. Anonymised data is not personal data.
We don’t sell personal data. We share it only with:
| Provider | What they do | Location |
|---|---|---|
| Railway | Application hosting | EU (Netherlands) |
| Amazon Web Services (S3) | File and image storage | EU |
| Cloudflare | Security, DNS and content delivery | Global |
| Stripe | Payments and billing | EU / US |
| Google (Analytics, Search Console, Ads, Business Profile, Maps) | Website analytics, search insights, advertising, business data | EU / US |
| Sentry | Error monitoring | US |
| Anthropic | AI features | US |
| Postmark | Sending emails | US |
| Meta (WhatsApp Business) | WhatsApp messages | EU / US |
We’ll update this list when it changes, and give gyms advance notice under our Terms & Conditions.
We use:
If you accept and then sign up on orlo.es, we send Google Ads your email address turned into an irreversible code (a hash), never in plain text, to tell whether you came from one of our ads.
Analytics and advertising cookies are only set if you accept them in the cookie banner. You can change your choice at any time by clearing cookies in your browser; we’ll ask you again on your next visit.
Some of our providers process data outside the UK and European Economic Area, including in the United States. Where they do, we rely on adequacy decisions (such as the EU–US Data Privacy Framework and the UK Extension) or standard contractual clauses, together with any additional safeguards that are needed.
| Data | How long |
|---|---|
| Customer account data | For as long as the account is active, then deleted within 90 days (except as below) |
| Invoices and accounting records | 6 years after the end of the financial year, as UK law requires |
| Gym member data (processed for gyms) | Returned or deleted 30 days after the gym’s subscription ends |
| Enquiries and support messages | 2 years after the last contact |
| Prospect data | 12 months after collection unless you become a customer; “do not contact” records are kept for as long as needed |
| Survey responses | Raw responses deleted within 12 months of the report being published |
| Analytics data | 14 months |
We use encryption in transit, access controls, and error and security monitoring. Payment card details are handled by Stripe and are never stored by Orlo. No system is perfectly secure, but if a breach affects your data we’ll notify you and the relevant authorities as the law requires.
You have the right to:
Email steve@orlo.es. We’ll reply within one month. We may need to confirm your identity first.
If you’re unhappy with how we’ve handled your data, you can complain to the Spanish Data Protection Agency (aepd.es), the data protection authority in your own EU country, or the UK Information Commissioner’s Office (ico.org.uk). We’d appreciate the chance to put things right first.
Orlo isn’t aimed at children, and we don’t knowingly collect children’s data as a controller. Gyms that offer classes to under-18s are responsible for obtaining any parental consent the law requires for the data they hold on the Platform.
We’ll update this page when our practices change and revise the date at the top. If a change materially affects how we use your data, we’ll tell customers by email or in the Platform.