Privacy Policy

1. Introduction

Paulo's HIITBOX ("we," "us," or "our") is committed to protecting your personal data and respecting your privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when you visit our website, use our services, or interact with us in any way.

Paulo's HIITBOX is registered at Dirkslandstraat 2, 3086 CK Rotterdam, Netherlands. We operate in compliance with the General Data Protection Regulation (GDPR) as enforced within the Netherlands and the European Union, as well as any other applicable data protection legislation.

By accessing our website or using our services, you acknowledge that you have read, understood, and agree to the practices described in this Privacy Policy. If you do not agree with the terms of this policy, please refrain from using our website or services.

2. Data Controller

The data controller responsible for your personal data is:

If you have any questions or concerns regarding this Privacy Policy or how your data is handled, please contact us using the details above.

3. Personal Data We Collect

We may collect and process the following categories of personal data:

3.1 Information You Provide Directly

• Contact information: Full name, email address, phone number
• Inquiry details: Program of interest, messages, and questions submitted through our contact form
• Registration data: Information provided when enrolling in coaching programs
• Communication records: Content of emails or other correspondence with our team

3.2 Information Collected Automatically

• Technical data: IP address, browser type and version, operating system, device type
• Usage data: Pages visited, time spent on pages, referring URLs, navigation patterns
• Cookie data: Information collected through cookies and similar tracking technologies (see our Cookie Policy)
• Location data: Approximate geographic location derived from your IP address

3.3 Information From Third Parties

We may receive limited information from third-party analytics services, advertising platforms, or payment processors in connection with our services. This data is processed in accordance with the privacy policies of those third parties and this Privacy Policy.

4. Legal Basis for Processing

Under the GDPR, we process your personal data based on one or more of the following legal grounds:

• Consent: Where you have given explicit consent for us to process your data for specific purposes, such as receiving communications or accepting cookies.
• Contractual necessity: Where processing is necessary for the performance of a contract with you, such as providing educational coaching services you have requested.
• Legitimate interests: Where processing is necessary for our legitimate interests, such as improving our website, preventing fraud, and ensuring security, provided those interests are not overridden by your rights and freedoms.
• Legal obligation: Where processing is required to comply with applicable laws and regulations in the Netherlands and the European Union.

5. How We Use Your Data

We use your personal data for the following purposes:

• To respond to your inquiries and provide information about our coaching programs
• To process program registrations and manage participant enrollment
• To deliver educational coaching services and support materials
• To communicate with you regarding program updates, schedules, and relevant information
• To improve and optimize our website, services, and user experience
• To analyze website usage patterns and traffic for internal analytics purposes
• To ensure the security and integrity of our website and systems
• To comply with legal obligations and resolve disputes
• To send educational materials and updates, only with your prior consent

6. Data Sharing and Disclosure

We do not sell, rent, or trade your personal data to third parties. We may share your data in the following limited circumstances:

• Service providers: Trusted third-party service providers who assist us in operating our website, processing payments, hosting data, or delivering services, under strict contractual obligations to protect your data.
• Legal requirements: When required by law, regulation, legal process, or governmental request from authorities in the Netherlands or the EU.
• Business transfers: In connection with any merger, acquisition, or sale of assets, where personal data may be transferred as part of the business assets.
• Protection of rights: When necessary to protect our rights, property, or safety, or the rights, property, or safety of others.

7. International Data Transfers

As Paulo's HIITBOX is based in the Netherlands and serves participants throughout Canada, your personal data may be transferred to, stored, and processed in countries outside the European Economic Area (EEA). When such transfers occur, we ensure that appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions issued by the European Commission for the receiving country
• Other legally recognized transfer mechanisms under the GDPR

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, unless a longer retention period is required or permitted by law. Specifically:

• Contact form submissions: Retained for up to 24 months from the date of submission, unless a continued relationship is established.
• Program enrollment data: Retained for the duration of the program and up to 36 months following completion for administrative and record-keeping purposes.
• Technical and usage data: Retained for up to 12 months for analytics and website optimization purposes.
• Legal and compliance records: Retained as required by applicable Dutch and EU law.

When data is no longer needed, it is securely deleted or anonymized in accordance with our data management procedures.

9. Your Rights Under the GDPR

As a data subject, you have the following rights under the GDPR and applicable Dutch data protection legislation:

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days as required by the GDPR.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your browser and our website
• Secure server infrastructure with firewall protection
• Regular security assessments and updates
• Access controls limiting data access to authorized personnel only
• Secure form processing with anti-spam protection
• Data encryption at rest where applicable

While we strive to protect your personal data, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security, but we are committed to maintaining the highest standards of data protection.

11. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to enhance your browsing experience and analyze website usage. For detailed information about the types of cookies we use, their purposes, and how to manage your preferences, please refer to our Cookie Policy.

You can control cookie preferences through your browser settings or through the cookie consent banner displayed when you first visit our website.

12. Third-Party Links

Our website may contain links to external websites or services operated by third parties. We are not responsible for the privacy practices or content of those third-party sites. We encourage you to review the privacy policies of any external websites you visit before providing any personal information.

13. Children's Privacy

Our website and services are intended for adults. We do not knowingly collect personal data from individuals under the age of 16. If we become aware that we have inadvertently collected personal data from a child under 16, we will take steps to delete that information as promptly as possible. If you believe that a child under 16 has provided us with personal data, please contact us at [email protected].

14. Supervisory Authority

If you are not satisfied with how we handle your personal data or believe that your data protection rights have been violated, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens):

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or operational needs. When we make material changes, we will update the "Last updated" date at the top of this page.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data. Your continued use of our website and services after any changes constitutes your acceptance of the updated policy.

16. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us:

We aim to respond to all privacy-related inquiries within 30 days of receipt.