Privacy Policy for BodyDecoded

1. Introduction
1.1. This website is owned and operated by BodyDecoded, a UK sole trader, trading name “BodyDecoded”.
1.2. For any privacy‑related inquiries, please contact: bodydecoded@gmail.com.
1.3. We are committed to protecting your personal data and processing it in compliance with the UK Data Protection Act 2018 and the EU General Data Protection Regulation (GDPR).

2. Personal Data We Collect
2.1. You provide directly:

• Your full name

• Your email address

2.2. We collect automatically:

• IP address

• Cookie identifiers (see Section 5)
  2.3. Payment data (card details) are processed exclusively by Stripe and are not stored on our servers.
  2.4. We do not collect any health or sensitive data.

3. Legal Basis & Purpose of Processing
3.1. We process your data on the following lawful bases:

• Consent (GDPR Art. 6(1)(a)): for marketing emails and non‑essential cookies.

• Contractual necessity (Art. 6(1)(b)): to grant you membership access and process your payments.

3.2. Purposes:

• To provide paid membership and deliver content by email.

• To process payments via Stripe.

• To analyse site usage (Google Analytics).

4. Data Sharing & Storage
4.1. Stripe: processes all card payments under PCI DSS. They may transfer data internationally (e.g. to US data centres).
4.2. Mailchimp: processes names and email addresses for email campaigns.
4.3. Google Analytics: processes usage data and IP addresses for site analytics.
4.4. All other personal data are stored on our UK/EU‑based hosting provider.
4.5. We retain names and email addresses indefinitely, unless you request deletion or withdraw consent.

5. Cookies & Consent
5.1. We use cookies for essential site functions (login, session management) and for analytics.
5.2. Your consent is collected via the “Cookie Notice & Compliance for GDPR/CCPA” plugin.

6. Your Rights
Under GDPR, you have the right to:

• Access your personal data (Art. 15).

• Rectify any inaccurate data (Art. 16).

• Erasure (“right to be forgotten,” Art. 17).

• Restrict processing (Art. 18).

• Data portability (Art. 20).

• Withdraw consent at any time (Art. 7(3)).

• Object to processing (Art. 21).
  To exercise any right, email us at bodydecoded@gmail.com. 

8. Changes to This Policy
8.1. We may update this Privacy Policy at any time.
8.2. The “Last updated” date at the top will reflect when changes were made.
8.3. For material changes, we will notify you by email or via a site banner.