Privacy Policy

This Privacy Policy explains how FIT-FACES BY NATALIA BROBERG LTD ("we", "us", "our") collects, uses, stores and shares your personal data when you visit fit-faces.com, take our Aging Type Quiz, or purchase a Programme. We are committed to protecting your privacy and complying with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and the Cyprus Law 125(I)/2018 on the Protection of Natural Persons with regard to the Processing of Personal Data.

1. Who We Are

FIT-FACES BY NATALIA BROBERG LTD is the data controller for personal data collected through this website. We are a limited liability company incorporated in the Republic of Cyprus under registration number HE 493692. Registered address: Georgiou Karaiskaki, 29, Tsada, 8540, Paphos, Cyprus. Contact: [email protected].

2. What Data We Collect

Data you provide directly

• Name and email address (when you take the quiz or sign up)
• Quiz answers and aging type result (used to personalise your programme)
• Payment information (processed by Stripe — we never see or store your card details)
• Communications you send us by email

Data collected automatically

• IP address, browser type and device information
• Pages visited, time on site and referring website
• Cookie data (see Section 6)

3. How We Use Your Data

• To deliver your Programme — we use your email to send access details and programme-related communications
• To personalise your experience — your aging type result is used to send you relevant content and recommendations
• To process payments — via Stripe, our payment processor
• To send marketing emails — only with your consent, which you can withdraw at any time via the unsubscribe link in any email
• To improve our website — using anonymised analytics data
• To comply with legal obligations — where required by law

4. Legal Basis for Processing (GDPR)

• Contract — processing necessary to deliver the Programme you purchased
• Legitimate interests — improving our services and preventing fraud
• Consent — for marketing emails and non-essential cookies. You may withdraw consent at any time.
• Legal obligation — where required by applicable law

5. Third-Party Services

We share data with the following trusted third parties who process data on our behalf:

• GoHighLevel (GHL) — CRM, email marketing and funnel & quiz platform. Stores your name, email and aging type. GHL Privacy Policy
• Passion.io — membership platform that hosts and delivers your Programmes. Stores your account details, login credentials and course progress. You access it at fit-faces.passion.io and via the Fit-Faces app. Passion.io Privacy Policy
• Mailgun (Sinch) — email delivery. Processes your email address to send transactional and marketing emails on our behalf. Mailgun Privacy Policy
• Stripe — payment processing. Handles all card data securely. Stripe Privacy Policy
• Meta (Facebook & Instagram Pixel) — advertising and retargeting. Meta Privacy Policy
• Google (Analytics & Ads) — website analytics and advertising. Google Privacy Policy
• TikTok (Pixel) — advertising and analytics. TikTok Privacy Policy
• Cloudflare — DNS, content delivery, website security and performance. Cloudflare Privacy Policy

We do not sell your personal data to any third party.

6. Cookies

We use cookies to improve your experience on our website. These include:

• Essential cookies — necessary for the website to function
• Analytics cookies — Google Analytics, to understand how visitors use our site (requires consent)
• Marketing cookies — Meta, Google and TikTok pixels, for advertising (requires consent)

You can manage your cookie preferences via our cookie consent banner. To opt out of Google Analytics: tools.google.com/dlpage/gaoptout. To opt out of Meta advertising: facebook.com/settings/?tab=ads. To manage TikTok ad personalisation: via your TikTok account settings.

7. Data Retention

We retain your personal data for as long as necessary to provide our services and comply with legal obligations. If you request deletion of your data, we will action this within 30 days, subject to any legal retention requirements. To request deletion, email [email protected].

8. Your Rights Under GDPR

You have the right to:

• Access — request a copy of the data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your data ("right to be forgotten")
• Restriction — ask us to limit how we process your data
• Portability — request your data in a portable format
• Object — object to processing based on legitimate interests
• Withdraw consent — at any time, for consent-based processing

To exercise any of these rights, email [email protected]. We will respond within 30 days. You also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus at dataprotection.gov.cy, or with the supervisory authority in your country of residence.

9. International Data Transfers

Several of our providers are based in, or transfer data to, the United States and other countries outside the European Economic Area (EEA) — including GoHighLevel, Passion.io, Mailgun, Stripe, Cloudflare, Meta, Google and TikTok. Where personal data is transferred outside the EEA, we ensure an adequate level of protection through one or more of the following safeguards: an adequacy decision of the European Commission; the EU–US Data Privacy Framework (where the provider is certified); or Standard Contractual Clauses approved by the European Commission, together with supplementary measures where appropriate.

10. Additional Privacy Rights (US, Canada & Australia)

Because we serve customers worldwide, the following additional rights may apply depending on where you live. To exercise any of them, email [email protected].

California residents (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect and how we use it, to request access to or deletion of that information, to correct inaccurate information, and to opt out of the "sale" or "sharing" of personal information. We do not sell your personal information for money. However, our use of advertising pixels (Meta, Google, TikTok) may be considered "sharing" for cross-context behavioural advertising under California law; you can opt out at any time through our cookie consent banner. We will not discriminate against you for exercising these rights.

Canada (PIPEDA)

If you are in Canada, you have the right to access the personal information we hold about you and to request corrections. We collect, use and disclose personal information only with your knowledge and consent, except where otherwise permitted by law. You may direct complaints to the Office of the Privacy Commissioner of Canada at priv.gc.ca.

Australia (Privacy Act 1988)

If you are in Australia, you have the right to access and correct your personal information under the Australian Privacy Principles. If you have a concern about how we handle your data, you may contact us or lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

11. Children's Privacy

Our website and Programmes are intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us immediately.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The current version is always available at fit-faces.com/privacy. We will notify you of significant changes by email where required.

13. Contact

© 2026 FIT-FACES BY NATALIA BROBERG LTD. All rights reserved.