Privacy Policy

Well Mom Fitness Privacy Policy Last Updated: 11 February 2026 This Privacy Policy explains how Well Mom Fitness ("we", "us", or "our"), operated by a sole trader based in Lisbon, Portugal, collects, uses, stores, and protects the personal data of users ("you" or "your") who visit our website and purchase our fitness video courses. We are committed to protecting your privacy and complying with the EU General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679), the Portuguese data protection legislation (Law No. 58/2019), and all other applicable data protection laws. 1. Data Controller The data controller responsible for your personal data is: Well Mom Fitness Lisbon, Portugal Email: [email protected] Website: https://impact.me/toralwellmomfitness As we are based in Portugal, an EU Member State, the competent supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD), Rua de São Bento 148-3°, 1200-821 Lisbon, Portugal (www.cnpd.pt). 2. What Personal Data We Collect 2.1 Account and Purchase Data When you create an account or make a purchase, we collect: Full name Email address Billing address (including country) Payment information (processed securely by Stripe — we do not store your card details) Purchase history and transaction records Account login credentials (username and password, stored in encrypted form) 2.2 Marketing Data If you subscribe to our newsletter or marketing communications, we collect: Email address Name (optional) Your consent record and the date it was given 2.3 Technical and Usage Data When you visit our website, we automatically collect: IP address Browser type and version Device type and operating system Pages visited and time spent on them Referring URLs Cookies and similar tracking technologies (see Section 7) 3. Legal Basis for Processing We process your personal data on the following legal bases under Article 6 of the GDPR: Performance of a Contract (Art. 6(1)(b)): To process your purchase, set up your account, deliver your course content (streaming and/or download), and provide customer support. Legitimate Interests (Art. 6(1)(f)): To operate and improve our website, prevent fraud, and maintain the security of our systems. Consent (Art. 6(1)(a)): To send you marketing emails and newsletters. You may withdraw your consent at any time by clicking "unsubscribe" in any email or by contacting us at [email protected]. Legal Obligation (Art. 6(1)(c)): To comply with applicable tax, accounting, and legal obligations. 4. How We Use Your Personal Data We use your personal data to: Create and manage your customer account Process payments via Stripe and fulfil your course purchases Provide access to course content via streaming and/or download Send purchase confirmation and receipt emails Send newsletters and promotional communications (only with your consent) Respond to your enquiries and provide customer support Analyse website usage via Google Analytics to improve our services Comply with legal and tax obligations under Portuguese and EU law Detect and prevent fraud or unauthorised access 5. Sharing Your Personal Data We do not sell, rent, or trade your personal data. We share your data only with the following third-party service providers who process it on our behalf, strictly for the purposes described above. All providers are required to process your data only in accordance with our instructions and in compliance with the GDPR. Stripe, Inc. — Payment Processing Purpose: Secure processing of customer payments Location: United States of America Safeguard: EU Standard Contractual Clauses (SCCs) Google LLC — Website Analytics Purpose: Website usage analytics via Google Analytics Location: United States of America Safeguard: EU Standard Contractual Clauses (SCCs) Email / Newsletter Provider Purpose: Sending marketing emails and newsletters to subscribers Location: To be confirmed on setup Safeguard: To be verified based on provider selected Website Hosting Provider Purpose: Hosting our website and storing associated data Location: To be confirmed on setup Safeguard: To be verified based on provider selected Where data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including EU Standard Contractual Clauses (SCCs) as approved by the European Commission. 6. Data Retention We retain your personal data for as long as necessary to fulfil the purposes outlined in this Policy or as required by law: Account and purchase data: Retained for the duration of your account and for 7 years thereafter to comply with Portuguese tax and accounting law (Código do IVA and Código do IRC). Marketing data: Retained until you withdraw your consent or unsubscribe. Technical/usage data (Google Analytics): Typically retained for 26 months (Google Analytics default). You may adjust this via our cookie consent settings. Customer support records: Retained for 3 years from the date of last contact. 7. Cookies Our website uses cookies and similar technologies. We use: Essential Cookies: Necessary for the website to function (e.g., session management, login state). These cannot be disabled. Analytics Cookies (Google Analytics): Help us understand how visitors use our website. These are only placed with your consent. Marketing/Preference Cookies: Used to remember your preferences and, if applicable, deliver relevant content. When you first visit our website, a cookie consent banner will be shown. You may accept all cookies, reject non-essential cookies, or manage your preferences at any time via the cookie settings link in the website footer. For more information about how Google processes this data, please see Google's Privacy Policy at policies.google.com/privacy. 8. Your Rights Under the GDPR As a data subject, you have the following rights under the GDPR: Right of Access (Art. 15): You may request a copy of the personal data we hold about you. Right to Rectification (Art. 16): You may request that we correct inaccurate or incomplete data. Right to Erasure (Art. 17): You may request that we delete your personal data, subject to legal retention obligations. Right to Restriction of Processing (Art. 18): You may request that we restrict how we use your data in certain circumstances. Right to Data Portability (Art. 20): You may request a copy of your data in a structured, machine-readable format. Right to Object (Art. 21): You may object to processing based on legitimate interests or for direct marketing purposes. Right to Withdraw Consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing. Right to Lodge a Complaint: You have the right to lodge a complaint with the CNPD (www.cnpd.pt) or the supervisory authority in your country of residence. To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days. We may need to verify your identity before processing your request. 9. Data Security We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include: SSL/TLS encryption for all data transmitted through our website Secure, encrypted password storage Access controls limiting who can view your personal data Payment data processed exclusively by Stripe, which is PCI-DSS certified In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the CNPD within 72 hours and, where required, inform affected individuals without undue delay. 10. Children's Privacy Our website and services are not directed at children under the age of 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us immediately at [email protected] and we will take steps to delete such data. 11. International Transfers We are based in Portugal (EU). Some of our third-party providers (including Stripe and Google) are based in the United States. When we transfer personal data outside the EEA, we do so only where: The European Commission has issued an adequacy decision for that country; or Appropriate safeguards are in place, such as EU Standard Contractual Clauses (SCCs); or Another lawful transfer mechanism applies under Chapter V of the GDPR. 12. Changes to This Privacy Policy We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last Updated" date. Where changes are material, we will notify you by email or via a prominent notice on our website. We encourage you to review this Policy periodically. 13. Contact Us If you have any questions, concerns, or requests regarding this Privacy Policy or how we handle your personal data, please contact us: Well Mom Fitness Lisbon, Portugal Email: [email protected]