Privacy
Policy

01 Who We Are

Goddu Pilates is a Pilates and rehabilitation education business run by Marina Goddu (STOTT PILATES Certified Instructor Trainer). We provide online courses, free educational guides, and movement resources for individuals seeking rehabilitation support and Pilates education.

For the purposes of the GDPR (EU) 2016/679, as applied in Portugal through Law No. 58/2019 of 8 August, Goddu Pilates is the data controller for personal data collected through this website and its services.

02 What Personal Data We Collect

Data you provide directly

• Full name and email address
• Country of residence (to determine applicable law and language preferences)
• Information included in messages or contact forms
• Payment information - processed securely via third-party providers; we do not store card details

Data collected automatically

• IP address, browser type and version, device type and operating system
• Pages visited and time spent on each page, referring URL
• Cookie identifiers (see Section 8)

Data about your engagement

• Email open and click data (via our email marketing platform)
• Course progress and completion (for registered course participants)

03 Legal Basis for Processing

Under the GDPR, we must have a lawful basis for processing your personal data. We rely on the following:

04 How We Use Your Data

• To process purchases and deliver digital products or courses
• To send free guides and follow-up emails you opted into
• To send newsletters, educational content, and promotional communications (with your consent)
• To respond to enquiries and provide customer support
• To improve the website, courses, and user experience
• To comply with legal and regulatory obligations
• To prevent fraud and ensure the security of our website

05 Who We Share Your Data With

We do not sell your personal data to third parties. We may share data with trusted service providers who process it on our behalf, under data processing agreements, including:

• Email marketing platform (GoHighLevel) - for sending automated emails and managing subscriber lists
• Payment processors (e.g. Stripe) - for secure payment processing. PCI-DSS compliant.
• Course hosting platform - for delivering online courses and tracking participant progress
• Analytics providers (e.g. Google Analytics) - for understanding how visitors use our website, with IP anonymization enabled

All third-party providers are contractually obligated to handle your data in compliance with GDPR and to use it only as instructed by us.

06 International Data Transfers

Some of our service providers may be based outside the European Economic Area (EEA). Where this is the case, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or adequacy decisions confirming equivalent protection.

You may request more information about the specific safeguards for any international transfer by contacting us at [email protected].

07 How Long We Keep Your Data

• Email subscribers: Until you unsubscribe or withdraw consent.
• Purchase records: 10 years from the date of transaction, as required by Portuguese and EU tax law.
• Course access records: Duration of your access period plus 2 years for support and compliance purposes.
• Contact enquiries: Up to 2 years after your last communication.
• Website analytics data: Up to 26 months (standard retention for analytics platforms).

When data is no longer needed, it is securely deleted or anonymized.

08 Cookies & Tracking Technologies

Our website uses cookies and similar tracking technologies. When you first visit our website, you will be presented with a cookie consent banner. You can change your cookie preferences at any time through the cookie settings in the website footer.

• Strictly necessary: Required for the website to function. Cannot be disabled.
• Analytics cookies: Help us understand how visitors use our website. Only placed with your consent.
• Marketing cookies: Track activity to show relevant advertising. Only placed with your consent.

09 Your Rights Under GDPR

To exercise any of these rights, contact us at [email protected] with proof of your identity. We will respond within 30 days.

10 Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Portuguese data protection authority. We encourage you to contact us first so we can resolve your concern directly.

11 Children's Privacy

Our services are not directed at children under the age of 16. We do not knowingly collect personal data from anyone under 16 years old. If you believe a child has provided us with personal data, please contact us immediately at [email protected] and we will delete it promptly.

12 Data Security

We implement appropriate technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction:

• Encrypted data transmission (HTTPS/SSL across the entire website)
• Access controls limiting who can access personal data
• Regular security reviews of systems and processes
• Data processing agreements with all third-party service providers

We commit to notifying you and the relevant authorities of any data breach as required under GDPR (within 72 hours of becoming aware).

13 Changes to This Policy

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by email (if you are a subscriber) and update the 'Last updated' date at the top of this document. Continued use of our website after changes are posted constitutes your acceptance of the revised policy.

14 Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy, please contact:

This Privacy Policy was prepared in compliance with GDPR (EU) 2016/679 and Portuguese Law No. 58/2019 of 8 August. Last updated: 2026 | Goddu Pilates | www.goddupilates.com