PRIVACY POLICY

Last updated: 14 October 2026

Who we are

This website, oa.mt, is run by OA Fitness, a fitness, nutrition and wellness studio at Triq id-Daghbien, Mġarr, Malta. OA Fitness decides how the personal data described on this page is used, which makes us the data controller under the EU General Data Protection Regulation (GDPR) and Malta's Data Protection Act (Cap. 586).

If you have any question about this policy or your data, email us at team@oa.mt.

What we collect and why

Newsletter sign-ups. If you enter your email address in our newsletter form, we keep it so we can send you news about OA, such as class launches, events and OA Nutrition. We do this with your consent, which you can withdraw at any time by emailing us or by using the unsubscribe link in any email we send.

Bookings, memberships and payments. Classes, events, subscriptions and packs are booked and paid for through Momence, our booking platform. When you book, Momence collects the details it needs, such as your name, email address, phone number and payment details, and shares the booking details with us so we can run your booking or membership. We use this data to fulfil our agreement with you and to meet our legal obligations, such as keeping accounting records. Card payments are handled by Momence and its payment provider, and we never see your full card number. Momence's own privacy policy also applies: momence.com/privacy-policy.

Messages. If you email us or message us on Instagram, we use what you send us to reply and keep the conversation for as long as we need it to help you.

Website analytics. If you accept analytics cookies in our cookie banner, we use Google Analytics to count visits and see which pages people view and how they found our website. Google Analytics collects data such as the pages you view, your approximate location, your device and browser, and how you arrived at the site, and links your visits with a random identifier stored in a cookie. We only use it with your consent, and we use the reports in aggregate, not to identify you. You can withdraw your consent at any time with the "Cookie settings" link at the bottom of every page.

Technical data. When you visit our website, our hosting provider automatically processes technical data such as your IP address, browser type and the pages you request, so that the site can be delivered quickly and securely. We rely on our legitimate interest in running a secure, working website.

Cookies

We use a small number of cookies. Strictly necessary cookies are always on; analytics cookies are only set if you accept them in our cookie banner. We do not use advertising cookies or social media pixels.

• cc_cookie (strictly necessary, 6 months): remembers your cookie choice so we do not ask you again on every page.
• _cfuvid (strictly necessary, session): set by our hosting provider's network to help protect the site from abuse.
• _ga (analytics, 2 years): set by Google Analytics to tell visitors apart.
• _ga_<id> (analytics, 2 years): set by Google Analytics to keep the state of your visit; the end of its name is our Google Analytics property ID.

You can change or withdraw your choice at any time with the "Cookie settings" link at the bottom of every page. If you withdraw consent, we stop using Google Analytics and remove its cookies.

The class calendar on our website is provided by Momence and loads from Momence's servers. It may store small amounts of information in your browser that it needs to work. Our website fonts are loaded from Google Fonts, which means your browser connects to Google's servers and shares your IP address with Google.

Who we share your data with

We do not sell your personal data. We only share it with service providers who help us run OA, and only as far as they need it to provide their service:

• Webflow, Inc., which hosts our website and stores newsletter sign-ups
• Momence, which runs our bookings, memberships, payments and class calendar
• Google, which provides our website fonts and our business email, and, if you accept analytics cookies, Google Analytics

Some of these providers are based in, or store data in, the United States. Where personal data is transferred outside the European Economic Area, it is protected by appropriate safeguards, such as the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.

We may also share personal data where the law requires us to, for example with the tax authorities.

How long we keep it

• Newsletter email addresses: until you unsubscribe or ask us to delete them.
• Booking, membership and payment records: while you are a client, and afterwards for as long as Maltese tax and accounting law requires.
• Messages: for as long as we need them to deal with your enquiry.

Your rights

You have the right to ask for a copy of your personal data, to have it corrected or deleted, to restrict or object to how we use it, and to receive it in a portable format. Where we rely on your consent, you can withdraw it at any time. To use any of these rights, email team@oa.mt and we will reply within one month.

If you are unhappy with how we handle your data, you can complain to Malta's Information and Data Protection Commissioner (IDPC) at idpc.org.mt. We would appreciate the chance to put things right first, so please contact us before you do.

Children

Our website and newsletter are not aimed at children under 16. If you book a class for someone under 18, please make sure you have their parent or guardian's agreement before sharing their details with us.

Changes to this policy

We may update this policy when our services or the law change. The latest version will always be on this page, with the date it was last updated.