Last updated: April 2026
Privacy Policy
This Privacy Policy describes how 8 PER TE (hereinafter "the Data Controller", "we", "our") collects, uses and protects users' personal data. This notice is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).
1. Identity of the Data Controller
Data Controller: Marco Mazzanti (self-employed professional)
VAT ID: IT01781320385
Address: Via Amilcare Ponchielli 7, 40141 Bologna (BO), Italy
Email: info@8perte.com
For questions regarding this privacy policy or to exercise your rights, contact the Data Controller at the addresses indicated above.
2. Description of the Platform
8 PER TE — Postura is an 8-week digital, app-based fitness program delivered through the 8 PER TE platform. The service is available on iOS (App Store) and Android (Google Play).
The program requires a one-time payment (non-recurring) to access the platform's content and features.
3. Categories of Personal Data Collected
We collect the following categories of personal data:
- Identification Data: first name, last name, email address, phone number
- Contact Data: residential address, city, province, country
- Payment Data: transaction information (amount, date, payment method) processed through Stripe
- Platform Usage Data: progress in the program, exercises completed, session duration, performance-related data
- Technical Data: IP address, device type, operating system, browser, cookies and similar technologies
- Biometric Data (optional): if voluntarily provided through the app (e.g. movement data, posture)
- Communication Data: content of emails sent through the email marketing service
4. Purposes of Data Processing
We process personal data for the following purposes:
- User account management and authentication
- Provision of the 8 PER TE service (access to the fitness program)
- Payment processing and transaction management
- Sending onboarding emails, informational messages and service-related communications
- Improvement and optimization of the platform and its content
- Aggregated analysis of service usage for statistical purposes
- Compliance with legal and regulatory obligations (e.g. invoice retention, anti-money laundering)
- Prevention of fraud and unlawful activities
- Marketing communications (only with explicit consent)
5. Legal Basis for Processing
The processing of personal data is based on the following legal grounds under the GDPR:
- Article 6(1)(b) GDPR: performance of the service contract (program access, payment processing)
- Article 6(1)(c) GDPR: compliance with legal obligations (tax obligations, anti-money laundering, data retention)
- Article 6(1)(f) GDPR: legitimate interest (platform security, fraud prevention, usage analysis)
- Article 6(1)(a) GDPR: explicit consent (for marketing, promotional communications, optional biometric data)
6. Data Recipients (Data Processors)
Personal data may be shared with the following recipients, who act as Data Processors:
| Recipient |
Function |
Data Shared |
| Stripe Inc. |
Payment processor |
Payment data (card number, amount, email) |
| Resend (Amazon SES) |
Email delivery service |
Email, name, communication data |
| 8 PER TE |
Content delivery platform |
Identification data, usage data, progress |
| Railway |
Backend infrastructure hosting |
Technical and usage data (anonymized/encrypted) |
All Data Processors sign data protection clauses in accordance with the GDPR and use appropriate security measures.
7. International Data Transfers
Some Data Processors (Stripe, 8 PER TE) may transfer personal data outside the EU/EEA, including to the USA. Such transfers take place by means of:
- Standard Contractual Clauses (SCC) approved by the European Commission
- Adequacy Decisions (for countries with an adequate level of protection)
For more information about international transfers, contact the Data Controller at info@8perte.com.
8. Data Retention Period
Personal data is retained for the following periods:
- Account Data: for the duration of the program (8 weeks) + 30 days after completion
- Payment/Invoice Data: 10 years (Italian tax retention obligations)
- Email Communication Data: up to 24 months from last contact, unless ongoing marketing consent is given
- Technical Data/Cookies: up to 13 months (for analytics cookies)
- Fraud Prevention Data: up to 3 years
After the expiry of these periods, data is deleted or anonymized, except where legal obligations require longer retention.
9. Data Subject Rights
Under the GDPR, you have the right to:
9.1 Right of Access (Article 15 GDPR)
You have the right to access your personal data and to receive a copy in a readable and structured format.
9.2 Right to Rectification (Article 16 GDPR)
You have the right to request the correction of inaccurate or incomplete data.
9.3 Right to Erasure (Article 17 GDPR)
You have the right to request the deletion of your personal data ("right to be forgotten"), except where processing is necessary to comply with legal obligations or other legitimate purposes.
9.4 Right to Restriction of Processing (Article 18 GDPR)
You have the right to request the restriction of processing of your data in specific circumstances.
9.5 Right to Data Portability (Article 20 GDPR)
You have the right to receive your data in a structured, commonly used and machine-readable format, and to transfer it to another data controller.
9.6 Right to Object (Article 21 GDPR)
You have the right to object to the processing of your data for direct marketing purposes or based on the legitimate interests of the Data Controller.
9.7 Right Not to Be Subject to Automated Decision-Making
You have the right not to be subject to a decision based solely on automated processing that produces legal effects.
9.8 How to Exercise Your Rights
To exercise any of these rights, send a request to the Data Controller:
Email: info@8perte.com
Postal Address: Via Amilcare Ponchielli 7, 40141 Bologna (BO), Italy
Include in your message: full name, registered email address, and a clear description of your request. The Data Controller will respond within 30 days of receipt of the request.
10. Cookie Policy
10.1 What Cookies Are
Cookies are small text files stored on your device that allow your browser to be identified and improve the user experience.
10.2 Types of Cookies Used
- Technical/Essential Cookies: required for the platform to function, for authentication and security. No consent required (art. 122 Italian Privacy Code).
- Analytics Cookies (Google Analytics 4 and Microsoft Clarity):
- Google Analytics 4 — measurement ID
G-E25E7BXQ85. Aggregated statistics on site usage.
- Microsoft Clarity — anonymous session recordings and heatmaps. Clarity does not collect personally identifiable information; form inputs (e.g. email) are automatically masked. More info: clarity.microsoft.com.
Both tools are activated only after your explicit consent via the cookie banner. Legal basis: art. 6 (1)(a) GDPR (consent).
- Marketing Cookies (Meta Pixel): activated only after your explicit consent, used to measure the effectiveness of Facebook/Instagram ads.
10.3 Google Consent Mode v2
The site implements Google Consent Mode v2 in advanced mode: Google tags load with all consent parameters set to "denied" by default; they are activated only after your explicit consent via the banner. Until consent is given, GA4 does not use cookies and does not identify the user.
10.4 Managing Cookies
On your first visit, a banner is shown so you can choose to accept, reject, or customize cookies. You can change your choice at any time by clicking Manage cookie preferences or via the 🍪 icon at the bottom-left of the page. The preference is stored locally on your device (localStorage) for 12 months.
You can also control cookies through your browser settings. Disabling analytics cookies will not affect the functioning of the service.
10.5 Third-Party Tracking
The only third-party service currently active is Google Analytics 4 (Google Ireland Limited), described above. No advertising, social, or marketing pixels are installed.
11. Data Security
The Data Controller implements appropriate technical and organizational security measures to protect personal data against unauthorized access, alteration, loss or destruction, including:
- Encryption of data in transit (HTTPS/TLS)
- Encryption of data at rest in databases
- Access controls and multi-factor authentication
- Infrastructure monitoring and anomaly detection
- Regular backups and disaster recovery
- Security audits and penetration testing
However, no system is entirely secure. In the event of a data breach, the Data Controller will notify data subjects and the Supervisory Authority within 72 hours, as required by the GDPR.
12. Profiling and Automated Decision-Making
The platform does not use profiling or automated decision-making that produces significant legal effects. Usage data is used only to improve program content in an aggregated and anonymized form.
13. Minors
The 8 PER TE service is not directed at minors under 18 years of age. The Data Controller does not knowingly collect personal data from minors. If you discover that a minor has provided personal data, please contact the Data Controller immediately to request its deletion.
14. Changes to This Policy
The Data Controller reserves the right to modify this Privacy Policy at any time. Changes will be published on this page along with an update to the "last updated" date. Continued use of the service after changes constitutes acceptance of the updated version.
15. Contacts and Complaints
Limited data sharing with commercial partners
8 PER TE may rely on commercial partners (referral programs) associated with unique discount codes. When a Customer freely chooses to use a discount code provided by a partner at purchase time, a limited portion of their data becomes visible to the partner in their private area, solely for the purpose of reporting earned commissions.
Data shared with the partner
- Customer's first name;
- last name initial (example: "Maria T." instead of "Maria Tognetti");
- purchase date;
- contract status (active or refunded).
The partner does not have access to email, address, phone numbers, payment amounts, program adherence data, or any other personal information of the Customer.
Legal basis
Processing is based on art. 6, par. 1, letter f) of EU Regulation 2016/679 (GDPR) — legitimate interest of the Controller in reporting and managing commercial relationships with partners. The Controller's interest is balanced by the minimal data exposure (only name and last name initial) and the Customer's voluntary choice to use the partner's code.
Rights of the data subject
Customers who wish to have their data removed from the partner's private area may request it by writing to info@8perte.com: in such case the record will be anonymised in the partner's view, without prejudice to the accounting retention obligation for transaction data.
Program adherence data
For Customers who have purchased the 8 PER TE program, the Controller collects and processes the following data relating to the execution of exercises within the "8 per te — Postura e Respiro" app:
- identifier of the executed exercise (workout card code, week, day);
- date and time of execution;
- completion status of the exercise.
This data is transmitted daily from the exercise execution application (trainingprogrampro) to the 8 PER TE system, where it is aggregated to calculate the Customer's daily, weekly, and cumulative adherence to the program.
Purposes of processing
- Performance of the contract: verification that the Customer is actually completing the program, for the purpose of any activation of the Method Guarantee provided for in the Terms and Conditions.
- Legitimate interest of the Controller: improvement of the program based on aggregate and anonymised usage data, identification of any critical issues in the weekly content, provision of personalised support to the Customer upon request.
Legal basis
Processing is based on art. 6, par. 1, letter b) of EU Regulation 2016/679 (GDPR) — performance of a contract to which the data subject is a party — for the purposes of verifying adherence for guarantee purposes, and on art. 6, par. 1, letter f) — legitimate interest of the Controller — for service improvement purposes.
Retention period
Personally identifiable adherence data is retained for 12 months from the expiry of the guarantee window (day 90 from activation), unless otherwise required by tax, accounting or legal defence obligations. After this period, the data is deleted or anonymised.
Rights of the data subject
The Customer can access their adherence data at any time from their personal area on 8perte.com. The rights provided for by articles 15-22 of the GDPR (access, rectification, erasure, restriction, portability, objection) can be exercised by writing to info@8perte.com. Please note that any request to erase adherence data before day 90 from activation will result in the loss of the Method Guarantee, as the guarantee requires verifiable data to be applied.