Privacy and Cookies Policy
Last updated: 1 October 2026. This is a courtesy translation. In case of doubt, the Portuguese version prevails.
1. Data controller
Surprise Sphere - Unipessoal, Lda., single-member private limited company
Registered office: Rua Paul Harris, lote 20.8, loja A, 3030-508 Coimbra, Portugal
Registered with the Commercial Registry under the single registration and tax number (NIPC) 515365807
Share capital: 1.00 euro
Email: ola@heloisaoliveira.com
For any question about your data, please contact us at this email address.
2. What data we process and why
| Purpose | Data | Legal basis | Retention period |
|---|---|---|---|
| Sending the free guide or another requested resource | Name and email | Your request (pre-contractual steps) | As long as needed to send it |
| Newsletter and information about courses | Name and email | Consent, given in a separate, unticked box | Until you withdraw consent |
| Sale of and access to courses and ebooks | Name, email, billing data, purchase and access history | Performance of the contract | For the duration of access and then for the legal periods |
| Invoicing and accounting | Name, tax number, address, amounts | Legal obligation | 10 years |
| Individual guidance sessions | Contact details and information shared in the session | Performance of the contract and, for health data, explicit consent | 1 year after the last session |
| Website security and operation | IP address and technical browser data, in server logs | Legitimate interest | The period set by the hosting provider, usually a few days |
| Replying to requests and complaints | Data included in the message | Legitimate interest and legal obligation | Up to 3 years after resolution |
3. Data about children
Our products are intended for adults. We do not collect data about children through the website. During an individual session, parents may share information about their child, including health information or reports. This information is processed only for the session, with the explicit consent of the parent or legal guardian, and we ask you to share only what is strictly necessary.
4. Who has access to the data
The data is processed by us and by service providers acting on our behalf and following our instructions:
- Netlify, which hosts the heloisaoliveira.com website
- systeme.io, which hosts the forms, the courses, payments and email sending, at cursos.heloisaoliveira.com
- Stripe, payment provider
- Moloni, certified invoicing software
- ImprovMX, which forwards emails sent to ola@heloisaoliveira.com
- Google, for the mailbox (Gmail) and video calls (Google Meet)
- our accounting firm
We do not sell or share data with third parties for commercial purposes. Data may be disclosed to authorities when required by law.
5. Transfers outside the European Economic Area
Some providers may process data outside the European Economic Area. In those cases, transfers only take place with appropriate safeguards under the GDPR, such as adequacy decisions or standard contractual clauses approved by the European Commission.
6. Your rights
You may at any time request access to, rectification or erasure of your data, restriction of processing and data portability, and you may object to processing. You may withdraw consent at any time, without affecting processing carried out before. Every newsletter email includes a link to unsubscribe.
To exercise these rights, write to the email in section 1. We reply within one month. You also have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD).
7. Security
We use encrypted connections, password-protected access and providers with appropriate security measures to protect data against unauthorised access, loss or disclosure.
8. Cookies
Cookies are small files stored on your device when you visit a website.
heloisaoliveira.com
The website itself does not use cookies. Fonts are loaded from Bunny Fonts, a European service that does not use cookies or store visitor data. Pages with a form include a form from systeme.io, which may use essential cookies so that the form works and to keep it secure.
Courses and payments
The course and payment pages, at cursos.heloisaoliveira.com, are hosted by systeme.io. These pages use essential cookies, needed to keep you logged in to the members' area, complete purchases and ensure security, which do not require consent.
If statistics or marketing cookies are used in the future, they will only be set after you accept them in a cookie notice, and you may refuse them without affecting your use of the website. You can always delete cookies in your browser settings.
9. Changes
This policy may be updated. The date of the last update is always shown at the top of the page.