Privacy policy

1. Who is responsible

The controller of your data is the Ocean Yoga Caparica studio, Rua do Juncal, 5C, Torre das Argolas, 2825-359 Costa da Caparica, which runs the site oceanyogacaparica.pt and the My Ocean app.

For anything about your data: hello@oceanyogacaparica.pt or +351 962 236 921 (WhatsApp). The studio is not required to have a data protection officer and has not appointed one; your messages go straight to management.

2. What data we process, why, and on what basis

When you visit the site

• The site counts page views so we know which pages interest people and where visits come from. It keeps only the page, the day, where the visit came from by category (for example Instagram, Google or a direct link, and the campaign name when the link has one) and whether it is a phone or a computer. It does not keep your IP address, your browser or any identifier, and it does not link visits together. These figures are not personal data.
• During the visit, your browser keeps that origin category (only the category, never who you are) so it isn't counted twice and so it can be passed to the app if you create an account from the site. It is deleted when you close the tab. See section 8.
• Basis: the studio's legitimate interest in knowing where it is worth being, with as little processing as possible.
• As on any site, the hosting briefly logs incoming requests (IP address, page and time), for security. Basis: legitimate interest in keeping the site secure.

When you create an account and use the app

• Name and email (or the Google or Facebook account you choose to sign in with, from which we receive only your name, email and an identifier). To sign in we email you a 6-digit code; we keep only an encrypted fingerprint of it, which stops working after a few minutes. If you create a password, we keep only its encrypted fingerprint.
• If you choose to give them: phone, tax number (for the invoice and so first-time offers are one per person), address (only for therapies at home), photo (the team sees it on your classes' lists and on your profile) and language.
• Your acceptance of the terms and the statement of responsibility, with the date.
• Your bookings, attendance, waiting lists, standing bookings, plans, classes left, credit, gift cards, purchases and payments, and the notices we send you.
• If you arrived through someone's «bring a friend» link, that link; when you pay your first monthly plan, we tell them your first name, so they know where the discount comes from.
• Where you came to the app from (the category above) and, if you answer, your answer to «How did you hear about us?».
• If you are an Urban Sports Club member, your USC plan and the visits you make with it.
• Management's internal notes about your account (for example, something agreed with you). You don't see them in the app, but you have the right to know them if you ask (section 9).
• A record of the changes made by the team (who did what and when), for security and so we can fix mistakes.
• Basis: performing the contract you make with us when you create an account, book and buy. The change record and internal notes: legitimate interest in running the studio well and being able to show what happened. The answer to «How did you hear about us?» is optional.

When you pay

• Payment is made through Stripe. Stripe tells us the result, the amount, the payment method, the fee and, for a card, only the brand and the last 4 digits. If you agree to keep your card to buy again in one tap, Stripe keeps it and we keep your answer, the words you said yes to and the date. For monthly plans the card is kept for automatic renewal, as we tell you before you pay.
• The studio issues the invoice outside the app, with the purchase details.
• Basis: performing the contract and legal obligations (invoicing and accounting).

Health limitations (optional)

• In Me → Health you can note injuries or conditions the teacher should know about. This is health data, a special category of data. We keep it only with your explicit consent, which you give by writing it and confirming. See section 4.

Therapy forms (optional)

• Before or during a therapy you can fill in a form (pain, conditions, medication, allergies, what you want to work on). Only the therapist you chose reads it. Basis: your explicit consent. See section 4.

Notices and news

• We send you notices about what is yours (confirmations, reminders, waiting list, changes and cancellations, payments), as a phone notification, by email or both, as you choose in Me → Notices. Basis: performing the contract.
• We also send studio news (a new class, a retreat, the summer timetable). Basis: legitimate interest in telling existing customers about the studio's services, as the electronic communications law allows. You can say no to them when you create your account, or stop them at any time, in Me → Notices or with the «Stop getting the studio news» link in every email, at no cost.
• Phone notifications only arrive once you allow them on that phone. They are delivered by your browser's or system's notification service (for example Google, Apple or Mozilla), which receives only the encrypted message.

When you write to the studio

• If you contact us by email, WhatsApp, phone or social media, we use what you tell us to answer you. Basis: your request and our legitimate interest in answering.

Work with us

• What you send from the Work with us page (name, contact details, the proposal and the message) is seen only by management and deletes itself after 12 months. Basis: your consent, given in the form, which you can withdraw at any time.

Photos at classes and events

• We sometimes take photos at classes and events for the studio's site and social media. We only publish images in which you can be recognised with your agreement. If you'd rather not appear, tell the teacher or management; if an image of you is already published, we take it down when you ask.

Partners (Urban Sports Club and ClassPass)

• If you book through Urban Sports Club or ClassPass, those partners send us your name, the booking and attendance, and we send them attendance so they count the visit. Each partner processes your data under its own policy, as an independent controller. ClassPass customers don't receive the studio's news.

If you came to the studio before the app

• The data the studio had in its previous booking system (name, contact details, plans, classes left, balance and booking history) moved to the app in October 2026, so you keep what you had. Basis: performing the contract you already had with the studio.

The studio makes no decisions about you based solely on automated processing with legal or similarly significant effects. The app recommends the plan that seems to suit how often you come, but the choice is yours.

3. Required and optional data

To create an account we need your name and an email (or a Google or Facebook account). Without them we can't book for you or tell you anything. Everything else is optional, and the app says so.

4. Health data

• Health limitations and therapy forms only exist if you write them. There is no mandatory health declaration.
• Health limitations are seen only by management and by the teacher of a class you booked, on that class's list. The front desk doesn't see them. If management records a limitation you told them in person, it does so only with your agreement.
• A therapy form is read only by the therapist you chose. Neither the front desk nor management sees it.
• None of this is sent to the artificial intelligence assistant management uses, nor included in the studio's data exports.
• You can change or delete your limitations in Me → Health, and the form on the booked therapy, whenever you like. Withdrawing your permission deletes the notes. Withdrawing consent does not affect what was done before.

5. Who sees your data at the studio

Each person on the team sees only what they need for their work:

• Teachers: the list of their classes (name, photo if you added one, whether it is your first class, attendance and, if you gave permission, health limitations).
• Therapists: their bookings, the contact details they need and the forms you filled in with them.
• Front desk: accounts, bookings, plans and payments, to help you. Never health data.
• Management: everything needed to run the studio, except therapy forms.

Other students don't see who is booked on a class.

Everyone on the team is bound to confidentiality.

6. Who we send data to

We use companies that process data on our behalf (processors), under contracts that oblige them to protect it and use it only to provide their service to us:

• Hosting of the site, the app and the database, on servers in the European Union.
• Sending emails: our transactional email provider.
• Payments: Stripe Payments Europe, Ltd. (Ireland). Stripe is also responsible for the data it processes to meet its own legal obligations, such as fraud prevention.
• Maps: for events and classes away from the studio, the app shows a Google Maps or OpenStreetMap map, which receives your IP address when the map loads.
• Signing in with Google or Facebook: only if you choose that way to sign in.
• Artificial intelligence assistant: management may use an artificial intelligence assistant connected to the app to look up and organise the timetable, bookings and accounts. It never receives health data or therapy forms.
• Development and maintenance: the company that builds and maintains the site and the app, which only accesses data when needed to fix a problem.

We also share data when the law requires it: with the certified accountant and the Tax Authority (invoicing), and with authorities or courts when they ask under the law.

Outside the European Union. Some of these providers are based in the United States or have group companies there. Where data may leave the European Economic Area, the transfer is protected by the EU-US Data Privacy Framework, when the company is certified, or by the standard contractual clauses approved by the European Commission. You can ask us for more about these safeguards.

We don't sell your data or use it for third-party advertising.

7. How long we keep data

• Account, bookings and plans: while you have an account. If you ask us to delete it, we delete or anonymise your data within one month, except what the law requires us to keep. Figures that don't identify you (for example how many people came to a class, what the studio received and what it paid the team) stay, without your name.
• Purchases, payments and invoices: 10 years, as tax and commercial law require.
• Health limitations: until you delete them, withdraw permission or delete your account.
• Therapy forms: until you delete them or you delete your account.
• Sign-in codes: stop working after a few minutes; we keep only the encrypted fingerprint.
• Work with us: 12 months, then deleted automatically.
• Site visit counts: 25 months, with no personal data.
• Hosting technical logs: a short time.
• Complaints and disputes: as long as the law requires or until the matter is closed.

8. Cookies and what your browser keeps

The site and the app use no advertising, social media or analytics cookies. They use only what they need to work, or to remember a choice of yours:

Some pages show content from other companies that may set their own cookies: the Google Maps map for events away from the studio, Stripe's payment page and, while the site still has them, booking forms from other systems. Their own policies apply.

You can delete or block cookies in your browser's settings. If you block oy_session, you can't stay signed in.

9. Your rights

At any time and free of charge, you can:

• Know what data we hold about you and get a copy.
• Correct data that is wrong or incomplete (most of it you can change in Me).
• Delete your data, when it is no longer needed or you withdraw consent, except what the law requires us to keep.
• Restrict processing while a request of yours is checked.
• Take the data you gave us, in a common format.
• Object to processing based on legitimate interest, and always to the studio's news.
• Withdraw consent you gave (health limitations, therapy forms, Work with us, a kept card), without affecting what was done before.

Write to hello@oceanyogacaparica.pt. We answer within one month (we may extend by two more months for a complex request, and tell you why). We may ask you to confirm who you are.

You also have the right to complain to the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (CNPD), Av. D. Carlos I, 134, 1.º, 1200-651 Lisboa, www.cnpd.pt.

10. Security

• Connections to the site and the app are encrypted (HTTPS).
• We don't store passwords or sign-in codes, only encrypted fingerprints that can't be reversed.
• Each person on the team signs in with their own account and sees only what their role allows.
• No system is infallible. If a data breach puts you at risk, we tell you and the CNPD as the law requires.

11. Children

The app is for adults. Children's classes are booked by a responsible adult, in their own account, and a child's data is limited to what the class needs.

12. Changes

If we change this policy in an important way, we tell you in the app and by email before the change applies. The date at the top says when it last changed.