PRIVACY POLICY

STUDIO LEGACY

Last updated: June 2026

1. Introduction and scope

This Privacy Policy describes how LEGADO TRANSLÚCIDO, Lda., the company operating the registered trademark STUDIO LEGACY (hereinafter “Studio Legacy”, “we”, “us” or “the Company”), collects, uses, shares and protects the personal data of its customers, members, website users and other data subjects, in the context of its fitness and wellbeing studio activity and the use of the website https://studiolegacy.pt (the “Website”).

This Policy applies to the processing of personal data carried out both online (through the Website, the customer area, the booking system and the online store) and in person, at the Studio Legacy premises.

Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation – “GDPR”), with Law no. 58/2019 of 8 August (which implements the GDPR in the Portuguese legal system) and other applicable personal data protection legislation.

When using the Website and the Studio Legacy services, we recommend that you read this Policy carefully. This Policy replaces and prevails over any previous texts regarding privacy.

2. Data controller and contact details

The controller responsible for processing your personal data is:

Company name LEGADO TRANSLÚCIDO, Lda. (trademark “Studio Legacy”) Tax/Corporate ID (NIPC) 517 512 181 Registered office Rua 5 de Outubro, no. 298, 4100-173 Porto, Portugal E-mail hello@studiolegacy.pt

For any questions relating to this Policy or to the processing of your personal data, as well as to exercise your rights, you may contact us at hello@studiolegacy.pt, indicating “Data Protection” in the subject line.

Data Protection Officer (DPO): Studio Legacy is not legally required to appoint a Data Protection Officer, as it does not carry out large-scale processing of special categories of data nor large-scale, regular and systematic monitoring of data subjects. Nevertheless, all communications regarding data protection should be addressed to the contact details indicated above.

3. Definitions

For the purposes of this Policy:

  • “Personal data”: any information relating to an identified or identifiable natural person (the “data subject”), such as a name, an identification number, location data, online identifiers or factors specific to that person’s physical, physiological, economic, cultural or social identity.

  • “Processing”: any operation performed on personal data, such as collection, recording, organisation, storage, consultation, use, disclosure, erasure or destruction.

  • “Controller”: the entity that determines the purposes and means of the processing — in this case, Studio Legacy.

  • “Processor”: the entity that processes personal data on behalf of the controller.

  • “Data subject”: the natural person to whom the personal data relates (customer, member, user, visitor).

4. Categories of personal data we collect

Depending on your relationship with us, we may process the following categories of personal data:

a) Identification and contact data Full name, date of birth, identification document number and type, postal address, e-mail address and telephone number.

b) Tax and billing data Tax Identification Number (NIF) and data required to issue invoices.

c) Payment data Bank details (IBAN/NIB) for SEPA direct debit payments, and data relating to card payments. We do not store your full payment card details — these are processed directly by our payment service providers (see Section 10). We may receive limited information, such as the last digits of the card, the country of issue and the expiry date.

d) Account and service usage data Customer area login credentials (username and password), class booking history, attendance records, plans/packs and memberships purchased, gift cards and training preferences.

e) Physical fitness data (special categories — health data) At the time of registration, you are asked to declare that you have no contraindications to the physical activity you intend to undertake. If you voluntarily provide us with additional information related to your health (for example, injuries or limitations), this will be treated as a special category of data, with the safeguards described in Section 7.

f) Communication and marketing data The content of the communications you send us (by e-mail, forms or social media), communication preferences and consent records.

g) Browsing and technical data IP address, browser type and operating system, pages visited, date and time of access, and information collected through cookies and similar technologies (see Section 9).

h) Image (where applicable) Photographs or videos taken at events or for promotional purposes, only with your prior consent.

5. How we collect your data

We collect personal data through the following means:

  • Directly from you, when you register, create an account on the Website, purchase a plan, pack, membership or gift card, make a booking, contact us or subscribe to our communications.

  • In person, at the studio reception, at the time of registration or attendance confirmation.

  • Automatically, through cookies and tracking technologies, when you browse the Website (see Section 9).

6. Purposes and lawful bases for processing

We process your personal data for the following purposes and on the following lawful bases (Article 6 of the GDPR):

Purpose Categories of data Lawful basis Managing registration, the customer account and the contractual relationship (membership) Identification, contact, account Performance of a contract — Art. 6(1)(b) Managing bookings and access to classes and premises Identification, account, bookings Performance of a contract — Art. 6(1)(b) Sale of plans, packs, memberships and gift cards, and payment processing Identification, billing, payment Performance of a contract — Art. 6(1)(b) Collection by SEPA direct debit and management of recurring payments Payment, billing Performance of a contract — Art. 6(1)(b) Issuing invoices and complying with tax and accounting obligations Identification, billing Legal obligation — Art. 6(1)(c) Personal accident and civil liability insurance coverage Identification Performance of a contract / legal obligation — Art. 6(1)(b) and (c) Ensuring the safe practice of physical activity (fitness declaration) Physical fitness / health Explicit consent — Art. 9(2)(a) (see Section 7) Responding to enquiries, complaints and customer support Identification, contact, communication Performance of a contract / legitimate interest — Art. 6(1)(b) and (f) Commercial communications and marketing of our own services to customers Contact, preferences Legitimate interest / consent — Art. 6(1)(f) and (a) (see Section 16) Sending newsletters and communications to non-customers (subscribers) Contact, preferences Consent — Art. 6(1)(a) Use of non-essential cookies and analytics technologies Browsing, technical Consent — Art. 6(1)(a) (see Section 9) Website security, fraud prevention and prevention of misuse Browsing, account, payment Legitimate interest — Art. 6(1)(f) Establishment or defence of legal claims and debt recovery Identification, billing Legitimate interest / legal obligation — Art. 6(1)(f) and (c) Use of image for promotional purposes Image Consent — Art. 6(1)(a)

Whenever processing is based on legitimate interest, Studio Legacy ensures that such interest does not override your fundamental rights and freedoms, having carried out the appropriate balancing test. You may request further information about this assessment using our contact details.

7. Health data and special categories of data

Information relating to your fitness to undertake physical activity constitutes a special category of data (health data), benefiting from enhanced protection under Article 9 of the GDPR.

This processing is limited to what is strictly necessary to ensure that you can safely undertake physical activity and is based on your explicit consent, given at the time of registration. In the event of a medical emergency on the premises, we may also process health data to protect your vital interests or those of third parties (Article 9(2)(c) of the GDPR).

Access to this data is restricted to those who strictly need it, and it is not used for any other purposes, in particular marketing. You may withdraw your consent at any time, although doing so may affect the safe provision of the services.

8. Minors

The minimum age to enter into a contract and attend Studio Legacy is 16 years. Data subjects under 18 years of age may only register when duly accompanied and authorised by their legal representative, who signs the contract and the corresponding authorisation.

Under Article 16 of Law no. 58/2019, the processing of children’s personal data on the basis of consent, in the context of information society services, is only lawful from the age of 13; below that age, consent must be given by the child’s legal representatives.

We do not knowingly collect data from minors outside this framework. If you become aware that a minor has provided us with data without the proper authorisation, please contact us so that we can delete it.

9. Cookies and tracking technologies

The Website uses cookies and similar technologies to ensure its operation, improve navigation and, subject to consent, analyse usage and personalise content.

  • Strictly necessary cookies: essential to the operation of the Website, the customer area and the purchase process. They do not require consent.

  • Analytics/performance cookies: allow us to understand how users interact with the Website (for example, through Google Tag Manager and analytics tools). They are used only with your consent.

  • Marketing cookies: may be used to measure campaigns and display relevant content on social media and other channels. They are used only with your consent.

You can manage your cookie preferences through the consent banner provided on the Website and/or in your browser settings. Refusing non-essential cookies does not affect access to essential services.

10. Who we share your data with

Studio Legacy does not sell your personal data. However, we may share it with the following categories of recipients, always to the extent necessary and with appropriate safeguards:

a) Service providers (processors) acting on our behalf and under data processing agreements (Article 28 of the GDPR), namely:

  • Provider of the website, online store and booking platform — the Website and its e-commerce and scheduling services are supported by the Squarespace, Inc. platform.

  • Payment service providers — secure processing of card and online payments.

  • Analytics and tag management tool providers.

  • E-mail marketing/newsletter platform provider, where applicable.

b) Insurance company, for the purposes of the personal accident and civil liability insurance of which members are beneficiaries.

c) Professional advisors and service providers — accountants, lawyers and auditors, in the context of complying with legal obligations and defending rights.

d) Public, judicial or regulatory authorities, where legally required or to defend the rights of Studio Legacy.

e) Debt collection entities, in the event of non-payment, for the purpose of recovering amounts owed.

f) Third parties in the context of corporate transactions, such as a merger, acquisition or reorganisation, in which case the data may be transferred subject to applicable legal safeguards.

11. International data transfers

Some of our service providers (in particular the providers of the website, payment and analytics platforms) are based in, or process data outside, the European Economic Area (EEA), namely in the United States of America.

Whenever this occurs, we ensure that the transfer is carried out with appropriate safeguards, in accordance with Articles 44 to 49 of the GDPR, namely:

  • on the basis of an adequacy decision of the European Commission, such as the one relating to the EU-U.S. Data Privacy Framework, where the recipient is certified; and/or

  • through the conclusion of Standard Contractual Clauses (SCCs) approved by the European Commission, supplemented, where necessary, by additional security measures.

You may request further information about these safeguards, or a copy of the applicable mechanisms, using our contact details.

12. Data retention periods

We retain your personal data only for as long as necessary for the purposes for which it was collected and in compliance with applicable legal obligations, namely:

  • Contractual and customer account data: for the duration of the contractual relationship and, after its termination, for the limitation period applicable to the establishment or defence of legal claims (generally up to 20 years for the ordinary limitation period, with data usually retained only for the strictly necessary period).

  • Billing and accounting data: 10 years, as required by Portuguese tax and commercial law.

  • Direct debit payment data (SEPA mandate): for the duration of the mandate and for the period legally required after its cancellation.

  • Data processed on the basis of consent (marketing, newsletter, image): until you withdraw your consent or object to the processing.

  • Browsing data and cookies: for the validity period of each cookie or until consent is withdrawn.

  • Communications and support requests: for the period necessary to handle them and, where relevant, for evidentiary purposes.

Once the applicable periods have elapsed, the data is securely deleted or anonymised.

13. Information security

Studio Legacy implements appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, alteration or improper disclosure, taking into account the state of the art and the nature of the data, namely access control, the use of passwords, the encryption of sensitive communications and the engagement of providers that offer security guarantees.

Despite the efforts undertaken, no system is entirely secure. In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we undertake to notify the Portuguese Data Protection Authority (CNPD) within 72 hours and, where applicable, to inform the affected data subjects, in accordance with Articles 33 and 34 of the GDPR.

We recommend that you keep your customer area login credentials confidential and contact us immediately if you suspect any misuse of your account.

14. Your rights as a data subject

Under the GDPR, you have the following rights:

  • Right of access — to obtain confirmation as to whether your data is being processed and to access it (Art. 15).

  • Right to rectification — to correct inaccurate or incomplete data (Art. 16).

  • Right to erasure (“right to be forgotten”) — to request the deletion of your data, in the situations provided for by law (Art. 17).

  • Right to restriction of processing — to restrict the processing in certain circumstances (Art. 18).

  • Right to data portability — to receive the data you have provided to us, in a structured, commonly used format, and to transmit it to another controller (Art. 20).

  • Right to object — to object to processing based on legitimate interest and, at any time and without the need for justification, to processing for direct marketing purposes (Art. 21).

  • Right to withdraw consent — where processing is based on consent, you may withdraw it at any time, as easily as you gave it, without affecting the lawfulness of processing carried out beforehand (Art. 7(3)).

  • Right not to be subject to automated decisions — including profiling, that produce legal effects or significantly affect you (Art. 22 — see Section 15).

How to exercise your rights: you may exercise these rights, free of charge, by contacting us at hello@studiolegacy.pt (subject: “Data Protection”). We may request additional information to confirm your identity. We will respond within one month, which may be extended by up to two further months in cases of particular complexity, in which case you will be informed.

15. Automated decision-making and profiling

Studio Legacy does not make decisions based solely on automated processing of data, including profiling, that produce legal effects on you or significantly affect you in a similar way.

Should segmentation tools be used for marketing purposes, these will not be based on sensitive data, and the data subject may object to the processing at any time.

16. Marketing and commercial communications

We may send you commercial communications about Studio Legacy services, classes, campaigns and news through the contact details you have provided to us, as follows:

  • To customers: on the basis of our legitimate interest in promoting our own services similar to those you have already purchased (soft opt-in), with the right to object at any time.

  • To subscribers and prospective customers: only on the basis of your prior, express consent.

Sharing your data with commercial partners so that they can send you their own marketing communications always depends on your specific and separate consent, which you may freely refuse or withdraw, without any prejudice to the provision of the services.

All electronic marketing communications will include a simple mechanism to unsubscribe (opt-out). You may also request to unsubscribe at any time by e-mailing hello@studiolegacy.pt, indicating “Marketing Opt-out” in the subject line.

17. Video surveillance (include only if applicable)

Note: This section should only be kept if there are video surveillance systems (CCTV) on the premises. If there are none, it should be deleted.

Where the Studio Legacy premises are equipped with video surveillance systems, these are intended exclusively for the protection of persons and property and the security of the premises, on the basis of the controller’s legitimate interest (Article 6(1)(f) of the GDPR) and in accordance with Article 19 of Law no. 58/2019. The cameras do not cover areas of reserved privacy (such as changing rooms and toilets), no sound is captured, and the footage is retained for the legally permitted period (generally 30 days), with restricted access. The existence of video surveillance is indicated by visible signs on the premises.

18. Links to third-party websites

The Website may contain links to third-party websites or platforms (for example, social media such as Instagram, TikTok and Spotify). Studio Legacy is not responsible for the privacy practices of those websites, which are governed by their own policies. We recommend that you read them whenever you access those services.

19. Changes to this Privacy Policy

Studio Legacy reserves the right to update this Policy whenever necessary, in particular due to legal or technological changes or changes in the way we process data. The version in force will always be available on the Website, indicating its date of update.

Where the changes are substantial and involve significant modifications to the processing of your data — in particular where they depend on consent — we undertake to inform you in advance and, where required, to request fresh consent.

20. Complaints and supervisory authority

If you believe that the processing of your personal data infringes applicable law, you have the right to lodge a complaint with the competent supervisory authority:

Comissão Nacional de Proteção de Dados (CNPD) (Portuguese Data Protection Authority) Av. D. Carlos I, 134, 1st floor — 1200-651 Lisbon, Portugal Telephone: +351 213 928 400 E-mail: geral@cnpd.pt Website: www.cnpd.pt

Without prejudice to this right, we would appreciate it if you would contact us first at hello@studiolegacy.pt, so that we can clarify or resolve your matter.

21. Consumer dispute resolution

In the event of a consumer dispute, the consumer may turn to an alternative consumer dispute resolution entity. For more information, you may consult the Portuguese Consumer Portal (www.consumidor.gov.pt) and the European Online Dispute Resolution Platform (https://ec.europa.eu/consumers/odr).

The territorially competent alternative consumer dispute resolution entity is the Porto Consumer Information and Arbitration Centre (CICAP) — Rua Damião de Góis, 31, Loja 6, 4050-225 Porto · Tel.: +351 225 508 349 · E-mail: cicap@cicap.pt · www.cicap.pt.

This Privacy Policy is governed by Portuguese law. The Portuguese courts shall have jurisdiction to resolve any disputes arising from it, without prejudice to mandatory consumer protection rules. In the event of any discrepancy between language versions, the Portuguese version shall prevail.