Last updated: April 2026
Privacy Policy
This Privacy Policy describes how 8 PER TE (hereinafter "the Data Controller", "we", "our") collects, uses and protects users' personal data. This notice is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).
1. Identity of the Data Controller
Data Controller: Marco Mazzanti (self-employed professional)
VAT ID: IT01781320385
Address: Via Amilcare Ponchielli 7, 40141 Bologna (BO), Italy
Email: info@8perte.com
For questions regarding this privacy policy or to exercise your rights, contact the Data Controller at the addresses indicated above.
2. Description of the Platform
8 PER TE — Postura is an 8-week digital, app-based fitness program delivered through the 8 PER TE platform. The service is available on iOS (App Store) and Android (Google Play).
The program requires a one-time payment (non-recurring) to access the platform's content and features.
3. Categories of Personal Data Collected
We collect the following categories of personal data:
- Identification Data: first name, last name, email address, phone number
- Contact Data: residential address, city, province, country
- Payment Data: transaction information (amount, date, payment method) processed through Stripe
- Platform Usage Data: progress in the program, exercises completed, session duration, performance-related data
- Technical Data: IP address, device type, operating system, browser, cookies and similar technologies
- Biometric Data (optional): if voluntarily provided through the app (e.g. movement data, posture)
- Communication Data: content of emails sent through the email marketing service
4. Purposes of Data Processing
We process personal data for the following purposes:
- User account management and authentication
- Provision of the 8 PER TE service (access to the fitness program)
- Payment processing and transaction management
- Sending onboarding emails, informational messages and service-related communications
- Improvement and optimization of the platform and its content
- Aggregated analysis of service usage for statistical purposes
- Compliance with legal and regulatory obligations (e.g. invoice retention, anti-money laundering)
- Prevention of fraud and unlawful activities
- Marketing communications (only with explicit consent)
5. Legal Basis for Processing
The processing of personal data is based on the following legal grounds under the GDPR:
- Article 6(1)(b) GDPR: performance of the service contract (program access, payment processing)
- Article 6(1)(c) GDPR: compliance with legal obligations (tax obligations, anti-money laundering, data retention)
- Article 6(1)(f) GDPR: legitimate interest (platform security, fraud prevention, usage analysis)
- Article 6(1)(a) GDPR: explicit consent (for marketing, promotional communications, optional biometric data)
6. Data Recipients (Data Processors)
Personal data may be shared with the following recipients, who act as Data Processors:
| Recipient |
Function |
Data Shared |
| Stripe Inc. |
Payment processor |
Payment data (card number, amount, email) |
| Resend (Amazon SES) |
Email delivery service |
Email, name, communication data |
| 8 PER TE |
Content delivery platform |
Identification data, usage data, progress |
| Railway |
Backend infrastructure hosting |
Technical and usage data (anonymized/encrypted) |
All Data Processors sign data protection clauses in accordance with the GDPR and use appropriate security measures.
7. International Data Transfers
Some Data Processors (Stripe, 8 PER TE) may transfer personal data outside the EU/EEA, including to the USA. Such transfers take place by means of:
- Standard Contractual Clauses (SCC) approved by the European Commission
- Adequacy Decisions (for countries with an adequate level of protection)
For more information about international transfers, contact the Data Controller at info@8perte.com.
8. Data Retention Period
Personal data is retained for the following periods:
- Account Data: for the duration of the program (8 weeks) + 30 days after completion
- Payment/Invoice Data: 10 years (Italian tax retention obligations)
- Email Communication Data: up to 24 months from last contact, unless ongoing marketing consent is given
- Technical Data/Cookies: up to 13 months (for analytics cookies)
- Fraud Prevention Data: up to 3 years
After the expiry of these periods, data is deleted or anonymized, except where legal obligations require longer retention.
9. Data Subject Rights
Under the GDPR, you have the right to:
9.1 Right of Access (Article 15 GDPR)
You have the right to access your personal data and to receive a copy in a readable and structured format.
9.2 Right to Rectification (Article 16 GDPR)
You have the right to request the correction of inaccurate or incomplete data.
9.3 Right to Erasure (Article 17 GDPR)
You have the right to request the deletion of your personal data ("right to be forgotten"), except where processing is necessary to comply with legal obligations or other legitimate purposes.
9.4 Right to Restriction of Processing (Article 18 GDPR)
You have the right to request the restriction of processing of your data in specific circumstances.
9.5 Right to Data Portability (Article 20 GDPR)
You have the right to receive your data in a structured, commonly used and machine-readable format, and to transfer it to another data controller.
9.6 Right to Object (Article 21 GDPR)
You have the right to object to the processing of your data for direct marketing purposes or based on the legitimate interests of the Data Controller.
9.7 Right Not to Be Subject to Automated Decision-Making
You have the right not to be subject to a decision based solely on automated processing that produces legal effects.
9.8 How to Exercise Your Rights
To exercise any of these rights, send a request to the Data Controller:
Email: info@8perte.com
Postal Address: Via Amilcare Ponchielli 7, 40141 Bologna (BO), Italy
Include in your message: full name, registered email address, and a clear description of your request. The Data Controller will respond within 30 days of receipt of the request.
10. Cookie Policy
10.1 What Cookies Are
Cookies are small text files stored on your device that allow your browser to be identified and improve the user experience.
10.2 Types of Cookies Used
- Technical/Essential Cookies: required for the platform to function, for authentication and security. No consent required (art. 122 Italian Privacy Code).
- Analytics Cookies (Google Analytics 4): measurement ID
G-E25E7BXQ85. Used to understand in aggregated form how users interact with the site. Activated only after your explicit consent via the cookie banner. Legal basis: art. 6 (1)(a) GDPR (consent).
- Marketing Cookies: currently not used on 8perte.com.
10.3 Google Consent Mode v2
The site implements Google Consent Mode v2 in advanced mode: Google tags load with all consent parameters set to "denied" by default; they are activated only after your explicit consent via the banner. Until consent is given, GA4 does not use cookies and does not identify the user.
10.4 Managing Cookies
On your first visit, a banner is shown so you can choose to accept, reject, or customize cookies. You can change your choice at any time by clicking Manage cookie preferences or via the 🍪 icon at the bottom-left of the page. The preference is stored locally on your device (localStorage) for 12 months.
You can also control cookies through your browser settings. Disabling analytics cookies will not affect the functioning of the service.
10.5 Third-Party Tracking
The only third-party service currently active is Google Analytics 4 (Google Ireland Limited), described above. No advertising, social, or marketing pixels are installed.
11. Data Security
The Data Controller implements appropriate technical and organizational security measures to protect personal data against unauthorized access, alteration, loss or destruction, including:
- Encryption of data in transit (HTTPS/TLS)
- Encryption of data at rest in databases
- Access controls and multi-factor authentication
- Infrastructure monitoring and anomaly detection
- Regular backups and disaster recovery
- Security audits and penetration testing
However, no system is entirely secure. In the event of a data breach, the Data Controller will notify data subjects and the Supervisory Authority within 72 hours, as required by the GDPR.
12. Profiling and Automated Decision-Making
The platform does not use profiling or automated decision-making that produces significant legal effects. Usage data is used only to improve program content in an aggregated and anonymized form.
13. Minors
The 8 PER TE service is not directed at minors under 18 years of age. The Data Controller does not knowingly collect personal data from minors. If you discover that a minor has provided personal data, please contact the Data Controller immediately to request its deletion.
14. Changes to This Policy
The Data Controller reserves the right to modify this Privacy Policy at any time. Changes will be published on this page along with an update to the "last updated" date. Continued use of the service after changes constitutes acceptance of the updated version.
15. Contacts and Complaints