Privacy Policy

Last updated: May 2026

1. Data Controller

The controller of personal data collected through this website is:

• Isabella Becker — Founder of PRM™
• Garmisch-Partenkirchen, Bavaria, Germany
• Email: contato@alquimiadasvirtudes.com

Based in Germany and serving clients in Brazil and other countries, the controller complies simultaneously with GDPR (EU) and LGPD (Brazil) obligations.

2. Data we collect

We collect only the data strictly necessary for the purposes described in this policy:

2.1. Data provided directly by you

• Name and email — when you subscribe to mailing lists, download free materials, or fill in contact forms
• Messages and responses — when you complete the free assessments (Temperament Map, Soul Map, 53 Evolutionary Needs, etc.) or send messages via contact form
• Payment data — when applicable, processed by third parties (Stripe, PayPal, or similar). We do not store credit card data on our servers
• Clinical session data — when you become a client, therapeutic notes and process history are stored encrypted and treated under professional confidentiality

2.2. Data collected automatically

• Technical browsing data — IP address, browser type, operating system, pages visited, session duration (anonymised when possible)
• Cookies and similar technologies — see Cookie Policy

3. Purpose of data processing

Personal data is used exclusively for the following purposes:

• Sending requested content (newsletter, free materials, assessment results)
• Responding to contact requests
• Scheduling and conducting PRM™ sessions
• Processing payments for contracted services
• Continuous improvement of content and tools offered
• Compliance with legal and tax obligations

Data is never sold, rented, or shared with third parties for external marketing.

4. Legal basis for processing

Data processing is based on the following legal grounds (GDPR Art. 6 / LGPD Art. 7):

• Consent — for newsletter and promotional materials
• Contract performance — for PRM™ sessions and contracted services
• Legal obligation — for tax and regulatory purposes
• Legitimate interest — for site improvement, security, and fraud prevention

5. Sharing data with third parties

To operate the site and services, we use providers that process data on our behalf, under confidentiality and data protection agreements:

• Brevo (email marketing — policy)
• Netlify (site hosting — policy)
• Cloudflare (proxy and security infrastructure — policy)
• Anthropic (assessment processing via API — policy)
• Google (Google Drive for materials delivery — policy)
• Payment providers (Stripe, PayPal, or equivalent — when applicable)

Some of these providers may operate outside the EU or Brazil. When this occurs, appropriate safeguards (Standard Contractual Clauses, adequacy certifications) are adopted as required by GDPR and LGPD.

6. Data retention

• Newsletter subscribers — until unsubscription
• Contact messages — 2 years after last contact
• Active client data — during the engagement and for 5 years after termination
• Tax data — for the legally required period (minimum 5 years)
• Technical logs — 90 days

After these periods, data is irreversibly deleted or anonymised.

7. Your rights

As data subject, you have the following rights under GDPR (Arts. 15–22) and LGPD (Art. 18):

• Access — confirm processing and obtain a copy of your data
• Rectification — correct incomplete, inaccurate, or outdated data
• Erasure ("right to be forgotten") — request deletion of unnecessary or unlawfully processed data
• Portability — receive your data in structured, portable format
• Withdrawal of consent — withdraw consent at any time
• Objection — object to processing based on legitimate interest
• Restriction — request limited processing in specific cases
• Information — know with which third parties your data has been shared
• Lodge a complaint — with the competent authority (BfDI/LfDI Bayern in Germany, ANPD in Brazil)

To exercise these rights, see section 9 below. For specific GDPR details, see our GDPR rights page.

8. Data security

We adopt reasonable technical and organisational measures to protect your data against unauthorised access, loss, destruction, or alteration. This includes encryption in transit (HTTPS), system access controls, regular backups, and internal confidentiality policies. No internet transmission or electronic storage method is 100% secure — we guarantee reasonable and continuous effort.

9. How to exercise your rights

10. Children and minors

The services offered are not directed to persons under 18. We do not knowingly collect data from children or adolescents. If you are responsible for a minor and have identified that they have provided data without authorisation, please contact us for deletion.

11. Changes to this policy

This Privacy Policy may be periodically updated to reflect changes in services, legislation, or processing practices. The last update date appears at the top of this page. Material changes will be communicated via email to subscribed users.

12. Applicable law

This policy is governed by German/EU law (GDPR) and Brazilian law (LGPD) as applicable. Disputes will be resolved preferably amicably and, ultimately, in the competent forum based on the data subject's residence.