PRIVACY POLICY

Last updated: July 29, 2026

This Privacy Policy explains how GROUP SPOTLIGHT LTDA collects, uses, stores, and shares personal data when individuals visit our websites, purchase products, contact customer support, or use our digital services.

1. Data controller

GROUP SPOTLIGHT LTDA
CNPJ: 51.104.973/0001-01

Address:

Av. Eng. Luiz Carlos Berrini, 1681
Conj. Salas 111 e 112, Anexo 2418
Cidade Monções
São Paulo/SP – CEP 04571-011
Brazil

Privacy contact: maximasaude15@gmail.com

2. Personal data we may collect

Depending on how you interact with us, we may collect:

• Name and contact information;
• Email address and telephone number;
• Billing and transaction information;
• Product purchased, amount, currency, order number, and payment status;
• Account and members-area information;
• IP address, browser, device, and approximate location;
• Website activity and access records;
• Communications sent to customer support;
• Cookie, analytics, advertising, and attribution information.

We generally do not directly receive or store complete card information. Payment information is handled by the payment or checkout provider.

3. Information received from Digistore24

When a purchase is processed through Digistore24, we may receive information necessary to deliver the product, maintain transaction records, provide support, prevent fraud, and manage access.

Digistore24 processes transaction data according to its own privacy policy and legal obligations.

4. Purposes of processing

We may process personal data to:

• Complete and confirm purchases;
• Deliver digital products;
• Create and manage customer access;
• Send transactional emails and access instructions;
• Respond to support and refund requests;
• Prevent fraud, piracy, and unauthorized access;
• Maintain accounting and tax records;
• Analyze website and product performance;
• Improve products, services, and customer experience;
• Send marketing communications when permitted;
• Comply with legal and regulatory obligations.

5. Legal bases

Depending on the situation and applicable law, data may be processed based on:

• Performance of a contract;
• Compliance with legal obligations;
• Legitimate interests;
• Consent;
• Exercise or defense of legal rights;
• Fraud prevention and security.

6. Service providers and data sharing

We may share necessary information with providers involved in operating our business, including:

• Digistore24 and other authorized checkout providers;
• Payment processors and fraud-prevention services;
• Website and cloud-hosting providers;
• Email-delivery and automation providers;
• Members-area and content-delivery platforms;
• Analytics and advertising providers;
• Accounting, tax, legal, and professional advisers;
• Public authorities when legally required.

We do not sell personal data as a standalone commercial product.

7. International transfers

Some service providers may process information outside Brazil.

Where required, we use contractual, technical, and organizational safeguards intended to protect information transferred internationally.

8. Data retention

We retain information only for as long as reasonably necessary to:

• Deliver purchased products;
• Maintain customer accounts;
• Provide support;
• Fulfill contractual obligations;
• Comply with tax, accounting, and legal requirements;
• Prevent fraud and resolve disputes.

Retention periods may vary depending on the category of information and applicable law.

9. Cookies and similar technologies

Our websites may use cookies, pixels, tags, and similar technologies for:

• Essential website functions;
• Security and fraud prevention;
• Analytics and performance measurement;
• Advertising attribution;
• Remarketing, where permitted.

Users may manage cookies through their browser or available consent controls. Blocking necessary cookies may affect website functionality.

10. Marketing communications

We may send promotional communications when we have an appropriate legal basis.

Recipients may unsubscribe by using the link included in the message or by contacting us.

Transactional messages concerning purchases, access, security, refunds, or account administration may still be sent when necessary.

11. Data-subject rights

Subject to applicable law, individuals may request:

• Confirmation that their data is being processed;
• Access to personal data;
• Correction of inaccurate information;
• Information about data sharing;
• Portability, where applicable;
• Anonymization, restriction, or deletion;
• Withdrawal of consent;
• Objection to certain processing activities.

Requests can be sent to maximasaude15@gmail.com with the subject:

Privacy Request

We may request reasonable information to confirm the identity of the requester.

12. Information voluntarily provided to support

Customers should avoid sending unnecessary sensitive personal information through support communications.

When information concerning health or another sensitive subject is voluntarily provided, it will be used only as reasonably necessary to respond to the request, protect the individual, or comply with law.

13. Security

We use reasonable administrative, technical, and organizational measures intended to protect personal data against unauthorized access, alteration, disclosure, loss, or destruction.

No internet-based system can guarantee absolute security.

14. Children

Our websites and products are intended for adults and are not directed to individuals under 18 years of age.

If we become aware that a minor has provided personal information without appropriate authorization, we may delete it.

15. External links

Our websites may contain links to external websites. We are not responsible for the privacy practices or content of third-party websites.

16. Policy updates

We may update this Privacy Policy to reflect changes in our services, providers, or legal obligations.

The current version will be displayed on this page with its latest revision date.

17. Contact

Privacy questions and requests may be sent to:

maximasaude15@gmail.com