Who we are

ZenGlow Studio is operated by Brilhempedacos Unipessoal, Lda (NIF 517 386 550), Rua do Comércio 168, 8135-127 Almancil, Algarve, Portugal. Throughout this policy “we”, “us” and “our” refer to that legal entity. Our studio is at Rua do Comércio 168, 8135-127 Almancil, Algarve, Portugal.

For any data-related question, including access, correction, or deletion requests, contact us at zenglow.almancil@gmail.com.

What data we collect

We only collect data needed to run the studio and answer your enquiries:

When you book a ritual

• Your name, email, phone number
• The ritual chosen, date and time
• Payment details (handled directly by Stripe — we never see your full card number)
• Any optional notes you add

When you become a member

• Same booking information above, plus subscription history kept by Stripe

When you buy a gift voucher

• Your name and email (for the receipt)
• Recipient name and email (so we can send them the voucher)
• Optional gift message

When you simply visit the site

• Standard server logs (anonymised IP, browser, referring page) for security and troubleshooting
• Analytics data via Google Analytics 4 (aggregated visits, pages viewed, country)
• Your chosen language (stored as a cookie called zg_lang, see our cookie policy)

Why we use it

• To fulfil bookings and memberships — under the contract you enter when reserving
• To send transactional emails — confirmations, reminders, cancellations, voucher receipts
• To meet legal and accounting obligations — tax records, invoices
• To improve the studio and the website — aggregated analytics, no personal profiling
• We do not sell your data, and we do not send marketing emails without your explicit opt-in

Who we share it with

We only share data with the service providers that make the studio work, all of them bound by GDPR-compliant data processing agreements:

• Stripe (Stripe Payments Europe Ltd, Ireland) — payment processing
• Acuity Scheduling (Squarespace, USA) — appointment management. Data covered by EU Standard Contractual Clauses.
• Brevo (Sendinblue SAS, France) — transactional email delivery
• Google Analytics + Search Console (Google Ireland Limited) — site analytics
• Our hosting provider for the website itself

How long we keep it

• Booking records: kept for 10 years for tax and accounting (Portuguese law)
• Membership records: kept while your membership is active, then 10 years for tax
• Gift voucher records: kept until the voucher is redeemed or expires, plus 10 years for tax
• Analytics data: 14 months in GA4, then auto-deleted
• Server logs: 30 days, then auto-deleted

Your rights

Under GDPR you have the right to:

• Access the data we hold about you
• Correct anything that is inaccurate
• Ask us to delete your data (subject to legal retention obligations)
• Receive your data in a portable format
• Object to or restrict our processing
• Withdraw consent (where consent was the basis)

To exercise any of these, email zenglow.almancil@gmail.com. We respond within 30 days.

You also have the right to lodge a complaint with the Portuguese data protection authority: Comissão Nacional de Proteção de Dados (CNPD).

Security

The site is served over HTTPS. Payments are processed entirely by Stripe (PCI-DSS Level 1 compliant) — we never store full card details. Booking data is stored in our database with industry-standard access controls.

Changes to this policy

If we update this policy in any significant way, we will email anyone with an active booking or membership. The “Last updated” date at the bottom of this page always reflects the latest version.