Privacy Policy

Last updated: 28.02.2025

Sculpt with Iris (“we,” “us,” or “our”) values your privacy and is committed to protecting your personal data. This Privacy Policy explains how we collect, use, and protect your information when you use our website, services, and digital platforms.

1. Data Controller
Sculpt with Iris is the data controller responsible for processing personal data.

If you have any questions, you can contact us at:
Email: iris@sculptwithiris.com
Address: Minervaplein 41-2, 1077 TM Amsterdam

2. Personal Data We Collect
We collect and process the following categories of personal data:

2.1. Data You Provide to Us
Account Information: Name, email address, phone number, payment details (for purchases or bookings).
Health Information: (Optional) You may share health-related details relevant to your participation in our workouts.
Communication Data: When you contact us via email, social media, or forms.

2.2. Data We Collect Automatically
Technical Data: IP address, browser type, and device information.
Usage Data: Pages visited, time spent, and interactions with content.

2.3. Data from Third Parties
Payment processors (e.g., Stripe, PayPal) collect transaction details.
Social media platforms if you interact with our content.

3. Purpose & Legal Basis for Processing
We process your personal data only when legally permitted:

• Purpose Legal Basis
• To provide our services (e.g., classes, subscriptions) Contractual necessity
• To process payments  Contractual necessity
• To communicate with you (e.g., newsletters, customer support)    Legitimate interest or consent
• To improve our services and website Legitimate interest
• To comply with legal obligations Legal obligation
• If we process health-related data, we will ask for explicit consent before doing so.

4. How We Share Your Data
We do not sell or rent your personal data. We may share data with:

• Service Providers: Payment processors, hosting providers, analytics tools.
• Legal Authorities: If required by law or to protect our legal rights.

5. Data Retention
We retain personal data only as long as necessary:

• Account data: Until you request deletion.
• Financial records: 5 years (for tax compliance).
• Marketing data: Until you withdraw consent.

6. Your Rights Under GDPR
You have the following rights under the General Data Protection Regulation (GDPR):

• Access: Request a copy of your data.
• Correction: Update inaccurate or incomplete data.
• Erasure (“Right to be Forgotten”): Request data deletion.
• Restriction: Limit processing in certain cases.
• Objection: Opt out of data processing for marketing purposes.
• Data Portability: Request your data in a structured format.
• Withdraw Consent: If processing is based on consent, you can withdraw it anytime.

 How to Exercise Your Rights:

• Email iris@sculptwithiris.com with your request. We will respond within 30 days.

7. Cookies & Tracking Technologies
We use cookies to enhance your experience. You can manage cookie preferences through your browser settings. See our Cookie Policy for details.

8. Data Security
We implement security measures (encryption, access controls) to protect your data from unauthorized access.

9. International Data Transfers
If we transfer data outside the EEA (European Economic Area), we ensure safeguards like EU Standard Contractual Clauses (SCCs) or work with GDPR-compliant service providers.

10. Marketing Communications 
When signing up you will receive automated ‘marketing’ emails, you can always opt out by clicking at the bottom of the newsletter.

11. Children’s Privacy
We do not aim any of our products or services directly at children under the age of 18, and we do not knowingly collect personal information about children under 18.

12. Data Breach Policy 
When we collect and process personal information, and while we retain this information, we will protect it within commercially acceptable means to prevent loss and theft, as well as unauthorized access, disclosure, copying, use, or modification. Although we will do our best to protect the personal information you provide to us, we advise that no method of electronic transmission or storage is 100% secure, and no one can guarantee absolute data security. We will comply with laws applicable to us in respect of any data breach.

You are responsible for selecting any password and its overall security strength, ensuring the security of your own information within the bounds of our services. We will be notifying affected users within 72 hours if a data breach occurs.

13. Changes to This Policy
We may update this Privacy Policy. Any changes will be posted here, with a new “Last updated” date.