Privacy Policy

Musclesvibrant publishes general workplace education around office stress rhythm and break design. Nothing on the website constitutes medical advice, psychological treatment, occupational health determination, or legal counsel. When you submit health-adjacent anecdotes, we treat them as correspondence content and do not convert them into clinical records.

If you are an employee acting on behalf of your organisation, you confirm you have authority to share any business contact data you include. Personal opinions in free-text fields remain yours; we process them solely to respond or to fulfill an order you initiated.

• Identity & contact: name, work email, telephone, company name, VAT or business ID when invoicing, postal address for physical shipments if ever offered.
• Transaction: product SKU, delivery email, receipts, payment references generated by payment processors, refund requests, credit notes.
• Usage & device: IP address, browser family, approximate region derived from IP, timestamps, pages opened, and—only after consent—events captured through analytics tools.
• Communications: bodies of emails, contact form messages, calendar invitations for workshops, attachments you voluntarily upload to agreed secure folders.
• Cookie identifiers: values stored under optional categories explained in the Cookie Policy.
• Security & integrity: abuse signals, login attempts if accounts exist, hashed credentials, session tokens necessary to keep you signed in.

We avoid collecting government identifiers or special-category data unless a statutory exception applies and we have documented it in writing with you.

We process data only for specific, explicit, and legitimate purposes. The table below summarizes the pairing most visitors encounter; bespoke enterprise agreements may add annexes.

• Delivering goods and services (contract, Art. 6(1)(b)): fulfilling digital downloads, arranging facilitation dates, invoicing, customer support tied to your purchase.
• Pre-contractual steps: answering scoped questions before you pay, holding provisional calendar slots once you request them.
• Legal obligation (Art. 6(1)(c)): accounting ledgers, tax filings, responding to lawful requests from public authorities after verification.
• Legitimate interests (Art. 6(1)(f)): securing networks, detecting fraud patterns, aggregating product analytics that cannot reasonably identify individuals, sending strictly service-related notices such as outage bulletins.
• Consent (Art. 6(1)(a)): optional analytics/marketing cookies, some newsletter formats, recording certain webinars when we offer explicit tick-box consent separate from the purchase contract.

For legitimate-interest processing we document a balancing test weighing your expectations against our needs, and we offer simple objection routes where the law expects them.

General enquiry emails without a purchase: up to twenty-four months after the last substantive message unless litigation preserves them longer. Completed purchase ledgers: Finnish bookkeeping laws generally require six fiscal years from closure. Cookie-based identifiers follow vendor-specific defaults adjusted downward when possible, typically not exceeding twenty-six months for analytics.

Security logs roll on a ninety-day cycle unless an active investigation extends read-only copies in a segregated bucket. Marketing lists honour immediate unsubscribe, with suppression records kept to prove your preference.

When retention expires, we delete, irreversibly anonymise, or aggregate records so they no longer identify you.

Staff bound by confidentiality agreements may access personal data on a need-to-know basis. External processors—hosting platforms, transactional email relays, payment acquirers, support ticketing software—receive instructions through Data Processing Agreements referencing Article 28 GDPR.

We publish or share an updated subprocessor index when enterprise clients require it. Consumers may request the current list relevant to their transaction informally by email.

Where a vendor processes data in a country without an adequacy decision, we implement Standard Contractual Clauses (2021 versions) or rely on another Article 46 mechanism, supplemented by transfer impact assessments when regulators expect them.

You may request a redacted copy of the core safeguards we rely on for your category of data.

HTTPS across the public site, segregated production credentials, encryption of laptops used by facilitators in the field, MFA on administrative consoles, annual vendor risk questionnaires, and offline backup snapshots stored in EU-centric data centres. Incident response includes notification timelines aligned with GDPR Articles 33–34 when applicable.

No control eliminates risk entirely; we encourage you to use unique passwords for accounts you create with us.

We do not make decisions that produce legal or similarly significant effects about you using exclusively automated means. Scorecards or habit trackers inside educational PDFs operate locally on your device unless you explicitly export data.

Services are designed for working adults. We do not target children under sixteen and delete accounts if we learn they were created without appropriate authority.

Material changes to this Privacy Policy will be highlighted on the homepage or inside purchase flows for at least thirty days where practicable. Archived PDF snapshots are available on request for enterprise procurement.

Related documents: Cookie Policy, Terms of Use, Refund Policy, Contact.