Privacy and data protection policy
Provisional document. The seller’s identity, address and support and privacy contact must be completed before sales begin.
1. Scope and controller
This policy describes the FormFit presentation website. The controller’s identity and contact are pending completion below. Future checkout and library platform practices must be verified and reflected in this policy before activation.
2. Data on the current website
The page has no registration or payment processing. Hosting may process IP addresses, browser details and access times for operation and security. First-party measurement records visits, offer views, checkout clicks, device category, approximate country supplied by hosting and URL campaign UTMs, without cookies or browser storage. A random identifier exists only in memory for each page load and does not identify people across pages. These events do not store IP addresses, email addresses, advertising identifiers, card details or health data. Hosting authenticates private access. We also record approximate region and city when supplied by hosting, presence signals while the page is visible, scroll depth and approximate click positions. These measurements support aggregated maps and charts; we do not record sessions, typed text, form contents or clicked links. Recent presence is removed after ten minutes without activity. Other events follow the retention described below.
3. Fonts, cookies and third parties
Google Fonts may receive IP addresses and technical request details. Consent preferences are stored locally for up to 180 days. With analytics consent, campaign attribution is stored for the browser session. If GA4, GTM, Google Ads, Meta, TikTok or Taboola are configured, tags run only after consent for their category. Custom campaign code requires advertising consent. You can revise your choice through Privacy and cookies. Hosting may use necessary authentication and security cookies.
4. Future purchases and support
When sales and support are enabled, name, email, order details and voluntarily submitted information may be needed to deliver the product, handle requests and administer refunds. External checkout providers may process payment information under their own policies. Do not submit clients’ health data or sensitive information through this website.
5. Purposes and legal bases
Purposes include delivering and securing the website and, when a purchase exists, fulfilling it and supporting the buyer. Depending on the activity and applicable law, processing may rely on contractual necessity, legal obligations, legitimate interests subject to assessment and safeguards, or consent where required. Advertising and non-essential cookies require legally necessary controls before activation.
6. Recipients and international transfers
Hosting, font and future payment or delivery providers may receive information necessary for their roles. The current code has no integration for selling personal data. If providers process data in other countries, the controller must identify recipients and establish transfer mechanisms and safeguards required by applicable law.
7. Retention, security and incidents
Visit and click events are retained for up to 90 days, with gradual deletion thereafter. Consent preferences expire after 180 days, and local attribution lasts for the browser session. Future purchases and support will require specific retention periods based on purposes and legal obligations. Hosting and third-party log retention still needs confirmation. The site uses HTTPS and the administration panel requires an authorised account. Incidents will be handled and notified as required by applicable law.
8. Your rights
Depending on applicable law, you may request access, correction, deletion, information about sharing, portability, objection or restriction, and withdrawal of consent. Not every right applies in every situation. Proportionate identity verification may be required. You may also complain to the competent data protection authority in your region.
9. Children, changes and contact
This website is not designed to collect children’s personal information. Do not submit minors’ personal data. This policy must be updated when services, providers or purposes change. To exercise rights, use the controller contact that must be completed below.
Operator: [legal name] · Registration: [business or tax identification] · Address: [business address] · Contact: [support and privacy email].