Privacy Policy

Introduction and scope

Protecting your privacy matters to how we run sessions, programmes, and digital touchpoints. We describe processing in plain language and align this Policy with the EU General Data Protection Regulation where it applies to individuals in the European Economic Area, and with the New Zealand Privacy Act 2020 for individuals interacting with our New Zealand operations.

The website publishes general educational material about functional training. Nothing here replaces clinical judgement. When health information appears in a message you send voluntarily, we treat it as ordinary correspondence unless a separate consent applies.

Identity of the data controller

The organisation responsible for decisions about personal data is:

• Name: Vorlaxerphthrelu
• Address: 1A/155 Queen Street, Auckland CBD, Auckland 1010, New Zealand
• Phone: +64 9 941 4911
• Email: mailuse@vorlaxerphthrelu.world

Where we appoint processors (such as hosting or payment vendors), they process data only under documented instructions and remain accountable to us for contractual safeguards described later in this Policy.

Categories of personal information

Depending on your interaction, we may hold:

• Contact details: name, email address, phone number if supplied, postal address when billing requires it.
• Booking context: preferred session times, movement preferences you disclose, notes from coaches after sessions where you consent.
• Financial metadata: transaction references generated by payment providers; we avoid storing full card numbers on our servers.
• Technical identifiers: IP address, browser user-agent string, approximate region derived from IP, HTTP referrer, timestamps.
• Cookie identifiers: values linked to analytics or marketing cookies when you opt in through our banner.
• Communication content: free-text messages submitted via forms or email threads.

We do not aim to collect sensitive categories such as medical diagnoses. If you voluntarily disclose health details, we restrict access and retain only what is necessary to respond or manage safety during sessions you attend.

How we use personal information

Lawful bases for processing

For GDPR-covered processing we rely on:

• Contract: processing necessary to deliver booked services or digital goods you purchase.
• Legitimate interests: securing infrastructure, responding to inbound enquiries, modest internal reporting, and preventing abuse—balanced against your rights.
• Consent: optional analytics cookies, optional marketing communications, and certain programme surveys where we explicitly ask.
• Legal obligation: tax records, responses to lawful regulator requests, or court orders.

Under the Privacy Act 2020 we collect information for purposes connected to our business functions, ensure accuracy where practicable, protect information through reasonable safeguards, and give you access pathways described below.

Who receives personal information

We share information only when needed:

• Infrastructure and communications vendors bound by confidentiality and data-processing clauses.
• Payment processors handling card authorisation and settlement.
• Professional advisers such as accountants or lawyers under strict engagement terms.
• Authorities when disclosure is mandatory under applicable law.

We do not sell personal information and do not permit subprocessors to market independently using your data.

International transfers

Servers or collaboration tools may reside outside New Zealand or the European Economic Area. When GDPR applies, we implement appropriate safeguards such as Standard Contractual Clauses, adequacy decisions where available, or supplementary measures recommended by regulators.

Transfers for purely transient routing (for example, email crossing international backbones) remain incidental to communication you initiate.

Retention periods

• General enquiries: up to twenty-four months after last meaningful contact unless accounting or dispute records require longer retention.
• Booking ledgers: aligned with tax and consumer law obligations, typically seven years from transaction date unless local rules prescribe otherwise.
• Server logs: rotated within ninety days unless a security investigation freezes datasets temporarily.
• Cookie preference snapshots: stored locally in your browser until cleared or updated.
• Marketing mailing lists: retained until you unsubscribe plus a short reconciliation window.

Security measures

We deploy HTTPS across public endpoints, principle-of-least-privilege access for internal accounts, multi-factor authentication where platforms allow, encrypted backups segregated from production, vulnerability patching routines, and confidentiality expectations in staff agreements.

No control eliminates risk entirely. If we discover an incident that jeopardises your rights, we assess notification duties under applicable law and contact affected individuals when required.

Your privacy rights

You may contact us to:

• Request access to personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion where no overriding obligation requires retention.
• Object to processing grounded in legitimate interests, subject to balancing tests.
• Request restriction while disputes are verified.
• Receive structured data you supplied where portability applies.
• Lodge complaints with the Office of the Privacy Commissioner (New Zealand) or your EU supervisory authority.

We respond within statutory timelines and may request proportionate identity verification before releasing records.

Automated decision-making

We do not use automated processing that produces legal or similarly significant effects without human review. Session recommendations stem from coach judgement rather than opaque scoring systems.

Cookies and similar technologies

Detailed cookie descriptions appear in our Cookie Policy. Only strictly necessary technologies load before you interact with the preference centre; analytics and marketing categories activate following explicit choices or acceptance via “Accept All”.

Paid advertising, landing pages, and analytics

If we run online advertising (for example through Google Ads) pointed at visitors in New Zealand or elsewhere, we aim for destinations that clearly identify Vorlaxerphthrelu, explain what we offer, and match the wording used in the ad within reasonable editorial variance. We do not disguise commercial intent as unrelated editorial articles solely to bypass advertising policies.

Measurement pixels or conversion tags may process technical identifiers described elsewhere in this Policy. Where consent or legitimate-interest balancing applies, we respect cookie-category switches stored in our banner and honour advertising-platform opt-out tools alongside statutory privacy rights.

Children

Services target adults. Where guardians enrol adolescents, parental authority must be evidenced when required. We do not knowingly operate profiling programmes aimed at young children online.

Changes to this Policy

When practices materially change we revise this page and adjust the prominent date shown in the hero section. Significant changes affecting consent-based processing may trigger an additional notice via email if we hold a suitable address.

Privacy enquiries

Direct questions to mailuse@vorlaxerphthrelu.world or write to 1A/155 Queen Street, Auckland CBD, Auckland 1010. Please include enough context for us to locate relevant records without oversharing sensitive identifiers in subject lines.