Legal
Privacy Policy
Last updated: 17 October 2026
Your trust matters to me. This policy explains, in plain language, what personal data I collect, why, how long I keep it, and the rights you have.
1. Who is responsible for your data
Kelly Fantazi
NIF: 304558443
Calheta, Madeira, Portugal
Email: hello@kellyfantazi.com
2. What data I collect
- When you contact me: your name, email address and the content of your message.
- When you book a call or session: your name, email address, the time you choose and your answers to booking questions.
- When you pay: payment details are handled by PayPal. I receive confirmation of payment and your name and email, but never your full card or bank details.
- When you work with me 1:1: the information you share in your intake form and during sessions, which may include information about your health, cycle and well-being, and my session notes.
- When you subscribe to my newsletter: your name and email address.
- When you join my community: your Skool account details, managed by Skool, and your answers to the joining questions (your email address and how sensitive you consider yourself). If you agree, I add your email to my newsletter.
3. Why I use your data, and on what legal basis
- To reply to your messages and booking requests, because you asked me to (steps before a contract, or my legitimate interest in answering you).
- To provide sessions and events: to deliver the service you booked (contract).
- To care for you in 1:1 sessions: health-related information is only collected with your explicit consent, given in the intake form and consent agreement. You can withdraw this consent at any time.
- To send my newsletter, only with your consent. Every email includes an unsubscribe link.
- To meet legal obligations, such as keeping invoices for tax purposes.
4. How long I keep your data
- Messages and enquiries: up to 1 year after our last exchange, unless we start working together.
- Intake forms and session notes: 3 years after our last session, then securely deleted.
- Invoices and payment records: 10 years, as required by Portuguese tax law.
- Newsletter: until you unsubscribe.
5. Health information
Information you share about your health and well-being is treated with particular care and confidentiality. It is only used to support you in our sessions, is never shared with anyone without your permission (except where required by law), and is stored securely in a password-protected cloud account with restricted access.
6. Services I use
To run my practice, I use a small number of trusted services. Each processes your data only for the purpose described and under its own privacy policy:
- Cal.com: online booking of calls and sessions
- PayPal: payments
- Brevo: newsletter and email
- Skool: the Wholistic Women’s Health Skool community
- Google (Drive): secure storage of intake forms and session notes
- Zoom: online sessions
- Hostinger: website hosting
Some of these services may store data outside the European Union. Where that happens, transfers are protected by appropriate safeguards, such as the European Commission’s Standard Contractual Clauses.
7. Cookies
This website uses only what is needed for it to work. The booking calendar (Cal.com) may set its own cookies when it loads. Where cookies are not essential, you’ll be asked for your consent first.
8. Your rights
Under the GDPR, you have the right to access, correct or delete your personal data, to restrict or object to its use, to receive a copy of it (data portability), and to withdraw your consent at any time. To use any of these rights, simply email me at hello@kellyfantazi.com. I’ll reply within one month.
You also have the right to lodge a complaint with the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt.
9. Changes to this policy
I may update this policy from time to time. The latest version will always be available on this page, with the date it was last updated.