Privacy

1. Who we are and what this policy covers

This Privacy Policy explains how Carolina Melendez (we, us, our) collects, uses, and shares personal data when you use carolinamelendez.co and any related pages, content, programmes, products, and services (the Website), and when you contact us by email or other means.

For the personal data described here, Carolina Melendez is the data controller — the person who decides why and how your data is processed. You can reach us about any privacy matter at contact@carolinamelendez.co.

This policy sits alongside our Terms of Use, which govern your use of the Website. Terms defined there have the same meaning here. Please read both. Where we offer a separate cookie notice or product-specific privacy terms, those apply in addition to this policy.

By using the Website or giving us your information, you acknowledge this policy. Where the law requires your consent for a specific use (for example some marketing or cookies), we ask for it separately and you can withdraw it at any time.

2. The personal data we collect

We collect personal data in three ways.

a. Data you give us. When you sign up for a newsletter, create an account, buy a product or service, join a programme, enter a survey, or contact us, you may give us: your name; email address; postal or billing address; phone number; the contents of messages you send us; account login details; and any content you choose to post or submit. If you become an affiliate or are paid by us, we may also need payment and tax details to pay you.

b. Data we collect automatically. When you use the Website, we and our providers collect technical and usage data, such as: your IP address; device and browser type; operating system; the pages you view and links you click; referring and exit pages; dates, times, and time spent; and similar diagnostics. Much of this is collected through cookies and similar technologies (see Section 4).

c. Data from third parties. We may receive data about you from: payment processors (confirmation of payment, not your full card number); analytics and advertising providers; and social or sign-in services you use to connect to us. We combine this only as described in this policy.

Payment card details. We do not store full payment card numbers. Card payments are handled by a third-party payment processor acting on our behalf (for example Stripe or PayPal); they process your card data under their own terms and security standards.

Public content. Anything you post in a public area of the Website (such as comments) can be seen and used by others and is not protected by this policy. Think before you post.

Sensitive data. We do not ask for special-category data (such as health, religion, or political views). Please do not send it to us unless we specifically request it with a clear lawful basis.

3. How and why we use your data

Under the UK and EU GDPR we must have a lawful basis for each use of your personal data. The table below sets out what we do and the basis we rely on.

Where we rely on legitimate interests, we have weighed those interests against your rights, and you can object at any time (see Section 9). Where we rely on consent, you can withdraw it at any time without affecting earlier processing.

4. Cookies and similar technologies

Cookies are small files stored on your device that help a website remember your visit. We use cookies and similar technologies (such as pixels and local storage) in three broad categories:

• Essential — needed to run the Website, sign you in, and process orders. These do not need your consent.
• Analytics — help us understand how the Website is used so we can improve it (for example Google Analytics).
• Marketing — used to show and measure advertising, including on other sites (for example Meta or Google ads).

In the UK and EU/EEA, we set non-essential cookies only after you agree through our cookie banner, and you can change your choice at any time. You can also control cookies through your browser settings, though blocking some may stop parts of the Website working. For the full list of cookies and their purposes, see our separate Cookie Policy (link it in your site footer once published).

5. When and with whom we share your data

We do not sell your personal data. We share it only as described here.

• Service providers (processors) acting for us — companies that help us run the business, such as website hosting, payment processing, email and CRM, scheduling, customer support, and analytics. They may access your data only to do their job for us, under a contract that requires them to protect it and use it for nothing else.
• Affiliate or referral partners — if you reach us through a partner's referral link, we may tell that partner you were referred and, where relevant, share your name and email so they can honour any bonus. We do not control how a partner then uses your data; check their own privacy policy.
• Legal and safety — we may disclose data where we must, to comply with the law, respond to a lawful request from an authority, enforce our Terms of Use, or protect the rights, safety, and property of you, us, or others.
• Business transfers — if the business is sold, merged, or reorganised, your data may transfer to the new owner, who must continue to protect it under terms consistent with this policy.

We may also create and share aggregated or anonymised information that does not identify you (for example usage statistics).

6. International data transfers

We are based in the UK, and some of our providers are located in other countries, including the United States. This means your personal data may be transferred to, and processed in, countries outside the UK and the EU/EEA whose data-protection laws may differ from your own.

When we transfer personal data out of the UK or the EU/EEA, we rely on a lawful transfer safeguard, such as: an adequacy decision (where the UK or EU recognises a country as providing adequate protection); the UK International Data Transfer Agreement (IDTA) or the UK Addendum; or the European Commission's Standard Contractual Clauses (SCCs). You can ask us for more detail about the safeguard used for a particular transfer by emailing contact@carolinamelendez.co.

7. How long we keep your data

We keep personal data only as long as we need it for the purposes in this policy, or as the law requires, then delete or anonymise it. In practice:

• Account data — for as long as your account is active, and for a reasonable period afterwards in case you return or we need our records.
• Order and payment records — for the period tax and accounting law requires (commonly around six years in the UK).
• Marketing data — until you unsubscribe or withdraw consent, after which we keep a minimal suppression record so we do not contact you again.
• Support messages — for as long as needed to resolve your query and keep a reasonable history.

When you close your account, we delete or anonymise your data within a reasonable time, except where we must keep some of it to meet a legal obligation or to establish or defend a legal claim.

8. How we protect your data

We take reasonable technical and organisational measures to protect your personal data against loss, misuse, and unauthorised access, disclosure, or alteration — for example using reputable providers, access controls, and encryption in transit where appropriate. No system is completely secure, and email in particular can be insecure, so please take care about what you send us.

If a personal-data breach is likely to put your rights at risk, we will notify the relevant authority (and you, where required) within the timeframes the law sets — for example without undue delay, and within 72 hours to the ICO under the UK GDPR where feasible.

9. Your rights (UK and EU/EEA)

If you are in the UK or the EU/EEA, you have the following rights over your personal data:

• Access — get a copy of the data we hold about you.
• Rectification — have inaccurate or incomplete data corrected.
• Erasure — ask us to delete your data in certain cases.
• Restriction — ask us to limit how we use your data while a concern is resolved.
• Objection — object to processing based on our legitimate interests, and to direct marketing at any time.
• Portability — receive certain data in a portable format, or have it sent to another provider.
• Withdraw consent — where we rely on consent, withdraw it at any time.

To exercise any right, email contact@carolinamelendez.co. We will respond within one month (extendable where the law allows), and we will not charge a fee or discriminate against you for exercising your rights, except where the law permits. We may need to verify your identity first.

If you are unhappy with how we handle your data, you can complain to your data-protection authority — in the UK, the Information Commissioner's Office (ICO) at ico.org.uk; in the EU/EEA, your national authority. We would appreciate the chance to resolve it with you first.

10. Your rights in other regions

Brazil (LGPD). If you are in Brazil, you have rights under the Lei Geral de Proteção de Dados, including to confirm whether we process your data; to access, correct, anonymise, or delete it; to data portability; to information about with whom we share it; and to withdraw consent. You can exercise these at contact@carolinamelendez.co, and you may contact Brazil's data-protection authority, the ANPD.

United States (including California). Depending on your state, you may have rights to know what personal information we collect, to access or delete it, to correct it, and to opt out of its sale or sharing for cross-context behavioural advertising. We do not sell your personal information, and we do not share it in a way that the California Consumer Privacy Act (CCPA/CPRA) treats as a sale. We will not discriminate against you for exercising these rights. To make a request, email contact@carolinamelendez.co. Where required, we honour recognised opt-out preference signals (such as Global Privacy Control).

ASEAN (for example Singapore's PDPA). If you are in an ASEAN country with a data-protection law, you have the rights that law gives you — typically to access and correct your data and to withdraw consent. In Singapore, you may contact the Personal Data Protection Commission (PDPC). Email us at contact@carolinamelendez.co to exercise your rights.

If a mandatory local law gives you broader rights than this policy describes, those rights apply to you.

11. Marketing and your choices

We send marketing emails only where you have agreed, or where you are an existing customer and the law allows us to tell you about similar offerings. Every marketing email has an unsubscribe link, and you can also opt out at any time by emailing contact@carolinamelendez.co. We will action your request promptly.

Opting out of marketing does not stop essential service messages about your account or orders (for example a receipt or an important notice), which are not marketing.

12. Children's privacy

The Website is intended for adults, and we do not knowingly collect personal data from children below the age of digital consent that applies to them. That age is 16 under the UK GDPR (some EU/EEA countries set it lower, down to 13); the LGPD gives special protection to the data of children and adolescents in Brazil; and laws such as Singapore's PDPA require a parent's or guardian's consent for a minor.

If you are below the relevant age, please do not send us your personal data without a parent or guardian. If you believe a child has given us personal data without the proper consent, email contact@carolinamelendez.co and we will delete it.

13. Automated decisions and profiling

We do not make decisions that produce legal or similarly significant effects about you based solely on automated processing. We may use basic analytics and segmentation to understand our audience and tailor content, but a person remains involved in decisions that materially affect you. If this changes, we will update this policy and, where the law requires, give you information about the logic involved and your right to request human review.

14. Third-party links and services

The Website may link to or embed third-party sites and services (for example a payment page, a video player, or a social media button). We do not control their privacy practices and are not responsible for them. When you follow a link or use an embedded service, read that provider's own privacy notice.

15. Changes to this policy

We may update this Privacy Policy from time to time. The version in force is the one posted on the Website, with its date at the top. If we make a material change, we will give reasonable notice — for example by posting the new version and, where appropriate, emailing you. Please check back from time to time. Our use of data we already hold continues under the policy in force when we collected it, except where the law requires otherwise.

16. How to contact us and complain

For any question or request about this policy or your personal data, contact the data controller:

Carolina Melendez

• Email: contact@carolinamelendez.co
• Website: carolinamelendez.co

We aim to respond within the timeframes the law sets (for example one month under the UK and EU GDPR). If you are not satisfied, you have the right to complain to your data-protection authority — in the UK, the Information Commissioner's Office (ICO) at ico.org.uk; in Brazil, the ANPD; in Singapore, the PDPC; and in the EU/EEA, your national authority.

This Privacy Policy is effective from October 20, 2026.