Privacy Policy

We collect the following categories of personal data:

• Identification and contact data: name, email address, country.
• Payment data: processed by Stripe on our behalf. We do not store full card numbers. We see only the last four digits, card brand, expiry, and the billing country.
• Account and usage data: when you sign up for a course, coaching session, or membership, we record the products you have purchased and your interaction with them.
• Communications data: emails you send us and your responses to our newsletter.
• Technical data: IP address, browser type, device type, pages visited, referring URL, basic interaction logs collected via cookies. See our Cookie Policy.

We do not knowingly collect special categories of personal data (racial origin, political opinions, health, etc.). Please do not share such information with us.

We collect data directly from you when you fill in a form on our site, sign up for our newsletter, purchase a product, or contact us by email. We also collect technical data automatically when you visit our site, via cookies and server logs.

We process your personal data only when we have a lawful basis under Article 6 of the GDPR:

• Performance of a contract (Art. 6(1)(b)): to provide you with the service you purchased, process your payments, and respond to your support requests.
• Legitimate interest (Art. 6(1)(f)): to communicate with you about service updates, security incidents, and changes to our terms. To prevent fraud and abuse. To improve our services based on aggregate, non-personal usage data.
• Consent (Art. 6(1)(a)): for marketing communications, such as our newsletter and product announcements. You can withdraw your consent at any time by clicking the unsubscribe link in any of our emails or by emailing us.
• Legal obligation (Art. 6(1)(c)): to comply with Portuguese tax law, anti-money-laundering rules, and any lawful order from a Portuguese or EU authority.

We share your data only with carefully selected service providers ("processors"), each of which is bound by a written data processing agreement under Article 28 of the GDPR:

• Stripe Payments Europe, Ltd. (Ireland): payment processing. stripe.com/privacy.
• MailerLite, UAB (Lithuania): email marketing and transactional emails. mailerlite.com/legal/privacy-policy.
• Vercel, Inc. (United States): website hosting. vercel.com/legal/privacy-policy.

We do not sell your personal data to anyone. We do not share your data with advertising networks.

We may also disclose your data when required by law or to protect our rights, the rights of our members, or the public interest.

Some of our processors (Vercel) are based in the United States. When your personal data is transferred outside the European Economic Area, we rely on one of the following safeguards under Chapter V of the GDPR:

• The EU-US Data Privacy Framework, where the processor is certified.
• Standard Contractual Clauses approved by the European Commission, supplemented by additional technical and organisational measures where necessary.

You can request a copy of the safeguards in place by emailing us.

We keep your personal data only for as long as necessary for the purposes for which we collected it:

• Newsletter subscribers and prospects who never purchased: until you unsubscribe, or for 3 years from the last interaction, whichever comes first.
• Active customers: for the duration of your relationship with us plus 6 months after the last service ends, to handle any post-service queries.
• Payment records and invoices: 10 years, as required by Portuguese tax law (Decreto-Lei n.º 28/2019).
• Communications you send us: 3 years from the date of the communication.

Under the GDPR, you have the following rights:

• Right of access (Art. 15): you can ask us for a copy of the personal data we hold about you.
• Right to rectification (Art. 16): you can ask us to correct inaccurate data.
• Right to erasure (Art. 17), sometimes called the "right to be forgotten".
• Right to restrict processing (Art. 18).
• Right to data portability (Art. 20): you can ask us to send your data to another controller in a structured, machine-readable format.
• Right to object (Art. 21), particularly to processing based on legitimate interests and to direct marketing.
• Right to withdraw consent at any time, where the processing is based on your consent.
• Right not to be subject to automated decision-making (Art. 22). We do not currently use automated decision-making that produces legal effects on you.

To exercise any of these rights, email us at virginie@laprofvirginie.com. We will respond within one month of receiving your request.

If you believe we have failed to comply with the GDPR, you have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD): Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, Portugal. www.cnpd.pt.

We use cookies and similar tracking technologies. For details, see our Cookie Policy.

Our services are intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.

We may update this policy from time to time to reflect changes in our practices or in applicable law. The "Last updated" date at the top will reflect the most recent revision. For material changes, we will notify you by email.

Data controller: La Prof Virginie, based in Portugal. Full registered address and tax ID available on request by email.

Contact: virginie@laprofvirginie.com

We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 of the GDPR. For any privacy-related questions, please use the email above.