Privacy policy atlas

This statement supports informational bodyweight-learning sessions. It complements but does not supersede contractual riders when you enrol in paid coursework. If an offline agreement conflicts, the contemporaneous written instrument governs factual fee schedules while this document governs foundational transparency ideals.

Identity & jurisdictional mooring

The accountable entity is referenced throughout the site as Phexroxxttaz, anchored at Market Street premises shared with ancillary retail tenants who do not dictate our record-keeping rhythms.

Electronic coordination routes through Studio Line tooling and the inbox online@phexroxxttaz.world because it remains dedicated to logistical dialogue rather than social broadcast channels.

Material scope & definitional scaffolding

Coverage embraces HTML experiences served from https://phexroxxttaz.world, encrypted transport layers, ancillary PDF curricula delivered after explicit opt-in correspondence, handwritten sign-in manifests compiled at sanctioned venues, SMS threads only when you originate them, and third-party ticketing utilities when their privacy addenda explicitly bind us downstream.

This statement intentionally bypasses hypothetical future microsites until they publish conspicuous links back to this atlas to avoid orphaned expectations.

Personal data atlas arranged by tenor

Sources & ingestion choreography

We ingest data volunteered through web forms with GDPR-adjacent checkboxes, via telephone relays transcribed succinctly inside secured notes, occasionally through postal correspondence when institutions issue physical purchase orders under legacy procurement rules, or through ticketing partners syncing roster CSV files after salting attendee identifiers appropriately.

Processing purposes braided with lawful bases

Responsive correspondence: honours Article 6(1)(b) pre-contract scaffolding or Article 6(1)(a) consent tokens captured beside checkboxes referencing this policy by hyperlink.

Operational integrity: leverages Article 6(1)(f) legitimate-interest analyses covering fraud-pattern review, moderated comment spam filtering, archival tamper auditing, albeit never repurposed for intrusive profiling unrelated to informational workshop logistics.

Optional marketing choreography: triggers solely when analytics or marketing cookies remain toggled on through the Cookie Settings modal and when explicit newsletter permissions mirror CAN-SPAM list-unsubscribe etiquette.

Recipients & subprocessors

We align with invoicing spreadsheets hosted on workstation volumes protected by TPM modules, transactional email relays offering EU SCC riders, ticketing vendors certified under SOC 2 Type II where budgets allow, archival couriers shredding documents off-site pursuant to shred-it style manifests, insurers requiring anonymized incident memoranda— not participant names unless compelled.

International transfers beyond California

When collaborators host infrastructure in GDPR jurisdictions, DPAs execute Standard Contractual Clauses supplemented by Transfer Impact Assessments refreshed after material regulatory rulings affecting US intelligence-collection narratives.

Individuals may request sanitized copies illustrating which transfers remain active quarterly without exposing proprietary contractual fee tables beyond redacted excerpts.

Retention lattice calibrated to bookkeeping cycles

General correspondence settles at eighteen-month horizons unless elongated by litigation holds. Roster composites persist twenty-four months to reconcile duplicate registrations. Fiscal artefacts remain up to seven years where California or federal treasury guidance demands overlap. Cookie lifetimes synchronize with durations outlined inside the Cookie Policy companion page.

Security fabric & layering

Defensive strata include salted password vaults rotated quarterly when enterprise suites permit, offline backup disks stored in biometric safes unrelated to attendee apartments, tabletop exercises mimicking ransomware restoration on idle hardware, segregation of staging versus production namespaces, phishing simulations for coordinators without punitive scoring.

Incident choreography sans sensationalism

Suspected unauthorised access prompts containment checklists invoking counsel. Regulatory notifications transpire strictly when statutory timelines and evidence thresholds— not marketing optics— determine necessity.

Decision automation & humane overrides

Spam heuristics may auto-quarantine dubious messages yet human analysts release false positives routinely. Pricing calculators apply transparent arithmetic devoid of covert scoring influencing medical eligibility because workshop admission never hinges upon health outcomes rhetoric.

Data subject manoeuvres mirrored with courtesy

Individuals may solicit access rectification, portability extracts in structured CSV subsets when technically feasible, erasure tempered by contradictory legal duties, objections to discretionary marketing— even when originally consented— with grace periods aligning to campaign send queues.

Verification echoes industry norms: abbreviated challenge questions referencing prior bookings without demanding excessive identification theatrics unless statutory fraud patterns surface.

US state appendix (CPRA-aligned vocabulary)

California residents recognise categories enumerated above mirrored with CPRA-style tables upon request within forty-five-day windows minus legitimate extension notices. Sensitive personal information quotas remain dormant because biometric inference or precise geolocation never belong to catalogue architecture.

We neither sell nor share personal information for cross-context behavioural advertising outside cookie categories you explicitly revive.

Operational channels & escalation cadence

Invoke rights by contacting the Studio Line or mailing physical letters referencing "Privacy manoeuvre". Supervisory escalation remains discretionary after earnest attempts at direct resolution respecting cross-border proportionality doctrines.