Instrument version

Privacy Policy

This document describes how Musclesrpurify processes personal information when you browse musclesrpurify.world, join educational programmes about daily body activation, purchase reference materials, or correspond with our reception desk in Wellington. It is written for adults making informed choices; it does not offer medical, legal, or financial advice. Where we refer to “we” or “us”, we mean the organisation operating from 75 Taranaki Street, Te Aro, Wellington 6011, New Zealand, unless a contract names a different entity.

You may contact us about privacy at service@musclesrpurify.world or by telephone on +64 4 555 0522 during the business hours we publish on correspondence footers. We aim to acknowledge substantive requests without undue delay, subject to identity checks designed to protect you from impersonation.

Controller: NZ-based studio HTTPS surface only EEA & UK visitors covered

Summary tiles

Transparency

Why we touch data at all

We collect only what we need to deliver scheduling, billing, safety of our platforms, and honest measurement of how readers use long-form movement education. We avoid building hidden profiles for unrelated industries.

Control

Your levers stay visible

Where the law gives you access, correction, export, or erasure rights, we describe how to exercise them and what exceptions may apply when records must be kept for tax or dispute reasons.

Posture

Educational context only

Workshop notes, exercise scripts, and email replies discuss voluntary movement habits. They are not clinical records. We do not use this site to diagnose conditions or store special-category health data by design.

Detailed provisions

Who and what this policy covers

The policy applies to visitors, waitlist subscribers, paying participants, corporate clients commissioning workshops, and anyone sending email to our published addresses. It also covers contractors who appear in directory listings with consent. It does not govern third-party platforms that you might open from our links—those services publish their own statements.

When you participate under a separate agreement, schedules about confidentiality, intellectual property, or liability may add detail. If a conflict appears between this page and a countersigned contract, the contract governs the commercial relationship, but this page still explains our baseline privacy posture.

Categories of personal information

Depending on how you engage with us, we may process identifiers (name, email address, phone number you supply), account or order references, payment metadata handled by our payment partners, technical connection data (truncated IP address, user agent, approximate timing, HTTPS status codes), security telemetry (rate-limit counters, CAPTCHA outcomes), communication content you choose to include in forms, accessibility preferences you ask us to remember, and workshop feedback you submit voluntarily.

We do not aim to collect government identifier numbers through this site. If you include them in a free-text field by mistake, we ask that you redact them in follow-up messages so we can minimise what we retain.

  • Identity & contact fields you type into consenting forms.
  • Transactional references generated when you buy digital folios or cohort seats.
  • Support threads that may quote earlier messages to resolve an open ticket.
  • Aggregated analytics derived from optional cookies, subject to your banner choices.

Legal bases and purposes

For European visitors, we rely on appropriate lawful bases under the GDPR: contract performance for delivering services you purchase; legitimate interests for securing our infrastructure, understanding which articles are read, and improving editorial clarity, balanced against your rights; consent where we place non-essential cookies or send optional marketing stories; legal obligations for tax and regulatory record-keeping.

In New Zealand, we align with the Privacy Act 2020 principles: collecting for lawful purposes connected to our functions, keeping data accurate and no longer than needed, and protecting it with reasonable safeguards. We document internal decisions about new processing activities so future reviewers can see the reasoning trail.

Disclosures and subprocessors

We share information with infrastructure hosts, email transport providers, payment processors, accounting tools, and occasional captioning or translation vendors bound by confidentiality. Each relationship is reviewed for location, certification summaries where available, and subprocessing rules. We do not sell personal information as a line of business.

We may disclose information when required by competent authorities, provided the demand is valid and proportionate, or when we must protect the rights and safety of staff and participants. Where permitted, we will notify you after the fact unless a court order forbids it.

International transfers

Some partners store encrypted replicas outside New Zealand or the EEA. When required, we use standard contractual clauses or equivalent mechanisms and perform risk assessments that consider government access laws. You may request a summary of the categories of data involved and the regions in question.

Retention schedule highlights

Marketing contact lists honour unsubscribe signals promptly. Transaction ledgers follow statutory accounting periods. Security logs roll off on a tiered schedule that preserves enough history to investigate incidents while shrinking raw identifiers over time. Workshop chat exports used for quality review are stripped of direct identifiers when practical and deleted after internal sign-off unless a participant opts into a quoted, anonymised case study with fresh consent.

Security measures in plain language

We deploy TLS for data in transit, permissioned access for staff accounts, device posture expectations for people handling inboxes, and backups encrypted at rest. No online system is perfectly secure; we monitor anomaly alerts and rehearse response steps so that suspected breaches are escalated to leadership and, where the law requires, to regulators and affected individuals.

Your rights and how to use them

You may request access to personal information we hold about you, ask for corrections, object to certain processing, request portability where systems allow machine-readable export, or ask for deletion when no overriding duty compels retention. We may need to verify your identity before releasing sensitive extracts. If we decline a request, we will explain the exception and point you to review options.

In New Zealand, you may contact the Office of the Privacy Commissioner for guidance. In Europe, you may contact your local supervisory authority. We welcome good-faith dialogue before complaints escalate because it often resolves misunderstandings about what data exists and why.

Children and vulnerable participants

Our public site targets adults organising their own learning. If you believe a minor has submitted personal data without guardian involvement, contact us and we will take reasonable steps to delete non-essential entries and adjust mailing lists.

Changes to this policy

When we materially change how we process data, we update this page, adjust the highlight date near the top, and, where appropriate, send a concise notice or banner so returning visitors can revisit their choices. Continued use after a reasonable notice period may constitute acceptance of non-controversial clarifications, but we will seek fresh consent when the law requires it for new optional uses.

Incident response sequence we train against

  1. Contain. Rotate credentials, isolate affected components, preserve forensic snapshots under legal advice.
  2. Assess. Determine categories of people and data touched, time window, and whether notification thresholds trigger.
  3. Notify. Inform regulators and individuals when required, with plain-language summaries and recommended precautions.
  4. Learn. Document root causes, patch processes, and training gaps without blaming individual reporters who flag issues early.