S3 STUDIOS – PRIVACY AND PERSONAL DATA PROTECTION POLICY
Version: August 2026
1. INTRODUCTION
S3 Studios values the privacy of its Clients, employees, instructors and other users and is committed to processing their personal data lawfully, transparently, securely and responsibly.
This Privacy and Personal Data Protection Policy explains how S3 Studios collects, uses, stores and protects the personal data of its Clients and users, as well as the rights available to them.
This Policy has been prepared taking into account, in particular:
Regulation (EU) 2016/679 of 27 April 2016 – the General Data Protection Regulation (GDPR);
Law No. 58/2019 of 8 August, which ensures the implementation of the GDPR in Portugal;
Portuguese legislation applicable to physical exercise activities and sports facilities;
Other applicable legislation concerning privacy, electronic communications, security and consumer protection.
The GDPR establishes, among others, the principles of lawfulness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality.
2. DATA CONTROLLER
The controller responsible for processing personal data is:
IDEIAS AO LARGO, LDA.
Portuguese Corporate Tax Identification Number (NIPC): 519520068
Registered office: Estrada da Algodeia 23 C, 2900-209 Setúbal
Trading name: S3 Studios
Email: hello@s3studios.pt
Telephone: +351 910 371 724
S3 Studios is responsible for determining the purposes and means of the processing of personal data carried out in connection with its activities.
3. WHAT PERSONAL DATA DO WE COLLECT?
Depending on the relationship established with S3 Studios and the services used, different types of data may be collected and processed.
3.1. Identification Data
We may collect:
full name;
date of birth;
tax identification number;
identification document, where necessary;
photograph associated with the account, where applicable.
3.2. Contact Data
We may collect:
telephone number;
email address;
postal address;
emergency contact details, where provided.
3.3. Data Relating to the Contractual Relationship
We may process information relating to:
selected membership plan;
registration date;
number and type of classes;
bookings;
cancellations;
attendance;
absences;
suspension of membership;
payments;
invoices;
campaigns and promotional conditions;
history of the contractual relationship with S3 Studios.
3.4. Health Data
As part of registration and use of the services, the Client may be asked to provide information necessary to assess their fitness and safety for physical exercise.
Depending on the form used, and only to the extent necessary, this information may include:
limitations affecting physical exercise;
relevant injuries;
physical conditions relevant to participation;
relevant surgeries or medical procedures;
medication or other information that the Client considers necessary to communicate in order to ensure safe participation;
other health information directly related to the safety and suitability of physical activity.
Health data constitutes a special category of personal data under the GDPR.
S3 Studios shall seek to apply the principle of data minimisation by collecting only information that is adequate, relevant and necessary for the identified purposes.
4. DATA RELATING TO MINORS
Where the Client is a minor, personal data relating to both the minor and their parent or legal representative may be processed.
The legal representative must provide the data necessary for:
identification of the minor;
management of registration;
management of bookings;
performance of the agreement;
communication with the legal representative;
compliance with legal obligations;
ensuring the safety of the minor's participation.
Where health data relating to a minor is processed, the safeguards provided for under the GDPR and applicable legislation shall apply.
S3 Studios shall seek to limit the collection of information to what is strictly necessary for the identified purposes.
5. PURPOSES OF PROCESSING
Personal data may be processed for the following purposes:
a) Registration Management
To create and manage the Client's account and formalise membership of S3 Studios.
b) Performance of the Agreement
To provide the contracted services and manage membership plans, classes, bookings, payments and other conditions of the contractual relationship.
c) Management of Classes and Bookings
To allow the Client to book, cancel and manage their participation in classes.
d) Safety and Suitability for Physical Activity
To assess the information provided by the Client regarding their fitness for physical exercise and to enable S3 Studios to adopt appropriate safety measures.
e) Management of Accidents and Incidents
To record and manage accidents, injuries or incidents occurring on the premises and, where necessary, communicate information to the insurer or competent authorities.
f) Compliance with Legal Obligations
To comply with tax, accounting, employment, administrative, safety and other legally applicable obligations.
g) Payment and Invoicing Management
To process payments, issue invoices, manage outstanding amounts and comply with accounting and tax obligations.
h) Management of Complaints and Requests
To respond to requests for information, complaints, suggestions and the exercise of rights.
i) Security of the Premises
Where video surveillance has been lawfully implemented, to protect persons and property and prevent and investigate incidents, within legally applicable limits.
j) Marketing Communications
Where an appropriate legal basis exists, data may be used to send communications relating to news, classes, services, campaigns or events organised by S3 Studios.
Where processing depends on consent, consent shall be requested separately and may be withdrawn at any time.
6. LAWFUL BASES FOR PROCESSING
S3 Studios does not rely on a single legal basis for all processing activities.
Depending on the purpose, processing may be based, in particular, on:
6.1. Performance of the Agreement
Where processing is necessary to enter into or perform the membership agreement for S3 Studios services.
For example:
creation of the account;
management of membership;
bookings;
management of classes;
payments;
communications necessary for the performance of the agreement.
The Portuguese Data Protection Authority (CNPD) clarifies that where processing is necessary for the performance of a contract, the appropriate legal basis is generally contractual performance rather than consent.
6.2. Compliance with Legal Obligations
Where processing is necessary to comply with a legal obligation applicable to S3 Studios.
6.3. Legitimate Interests
Where processing is necessary for the purposes of the legitimate interests pursued by S3 Studios or third parties, provided that those interests are not overridden by the fundamental rights and freedoms of the data subject.
These may include, where applicable:
security of the premises;
fraud prevention;
defence of legal claims;
management and security of IT systems.
6.4. Consent
Where processing cannot lawfully be based on another legal basis and consent is legally appropriate.
Consent must be:
freely given;
specific;
informed;
unambiguous;
capable of being withdrawn at any time.
The CNPD emphasises that consent should not be used indiscriminately as the legal basis for all processing activities.
7. PROCESSING OF HEALTH DATA
S3 Studios recognises that certain information provided by Clients as part of the fitness and health information declaration may constitute health data and therefore fall within the special regime established under Article 9 of the GDPR.
7.1. Processing of such data shall be limited to what is adequate, relevant and necessary for the identified purposes.
7.2. S3 Studios does not intend to carry out medical diagnoses or replace assessments performed by healthcare professionals.
7.3. Health information shall be used, in particular, to:
identify relevant limitations affecting participation;
adapt participation in activities where possible;
alert instructors to limitations that may be relevant to safety;
manage accidents or emergency situations;
comply with legal or insurance obligations, where applicable.
7.4. Health information shall not be used for marketing purposes.
7.5. Access to health data shall be limited to persons who need to know such information in order to perform their duties and strictly to the extent necessary.
7.6. Health data must not be disclosed to other Clients or used for purposes incompatible with those for which it was collected.
The CNPD has emphasised that health information is subject to enhanced protection and must be processed with particular attention to the principle of data minimisation.
8. INSTRUCTORS' ACCESS TO HEALTH INFORMATION
Where necessary to ensure the safety of physical exercise, certain S3 Studios professionals may have access to relevant information provided by the Client.
Such access must be limited to the information necessary for the safe provision of the service.
Whenever possible, instructors should have access only to functionally relevant information, avoiding disclosure of unnecessary clinical information.
For example, it may be relevant for an instructor to know that a Client has a shoulder limitation requiring certain exercises to be adapted, without it being necessary for the instructor to have access to all of the clinical information provided by the Client.
9. DATA RELATING TO ACCIDENTS
Where an accident or incident occurs on the premises, S3 Studios may collect and record the information necessary to manage the situation.
The following information may be recorded:
date and time;
location;
description of the incident;
activity being carried out;
persons involved;
measures taken;
information necessary to notify the insurer;
information necessary to comply with legal obligations.
Where an accident involves health data, such data shall be processed in accordance with the rules applicable to special categories of personal data.
10. INSURER
Where it is necessary to make a claim under the personal accident insurance applicable to S3 Studios' activities, the data required to report and settle the claim may be communicated to the insurer.
The communication shall be limited to the data necessary for that purpose and shall be carried out in accordance with applicable legislation and the terms of the relevant insurance policy.
11. PROCESSORS AND SERVICE PROVIDERS
In order to ensure the operation of S3 Studios, certain data may be processed by service providers acting on behalf of S3 Studios.
Depending on the services actually used, these may include:
customer and booking management platforms;
studio management software;
IT system providers;
hosting and storage service providers;
payment service providers;
certified accountant;
legal service providers;
insurer;
electronic communications service providers;
marketing service providers, where applicable.
Where these service providers act as processors, S3 Studios shall ensure that the processing is governed in accordance with the requirements of the GDPR.
The GDPR establishes specific requirements governing the relationship between data controllers and processors.
12. INTERNATIONAL TRANSFERS
S3 Studios shall seek to ensure that personal data is processed within the European Economic Area.
Where a service provider involves a transfer of personal data outside the European Economic Area, such transfer shall only take place where there is a legally valid mechanism under the GDPR.
Where applicable, mechanisms may include:
an adequacy decision by the European Commission;
Standard Contractual Clauses;
other safeguards provided for by law.
13. RETENTION PERIODS
S3 Studios shall retain personal data only for the period necessary to fulfil the purposes for which it was collected, without prejudice to any retention periods required by law.
Specific retention periods shall depend on the nature of the processing.
Contractual and Registration Data
Such data shall be retained for the duration of the contractual relationship and subsequently for the period necessary to comply with legal obligations and to establish, exercise or defend legal claims.
Accounting and Tax Data
Such data shall be retained for the periods required under applicable tax and accounting legislation.
Health Data
Such data shall be retained only for the period necessary for the purposes justifying its collection and/or for any legally required period, with efforts being made to avoid retaining health information for longer than necessary.
Marketing Data
Such data shall be retained for as long as a valid legal basis for processing exists or until the data subject withdraws consent, where consent is the applicable legal basis.
Video Surveillance Data
Such data shall be retained for the period legally applicable to the system implemented, except where additional retention is necessary in circumstances provided for by law.
14. DATA SECURITY
S3 Studios shall implement appropriate technical and organisational measures to protect personal data against:
unauthorised access;
loss;
destruction;
alteration;
improper disclosure;
unlawful use.
Measures adopted may include, among others:
access controls;
use of individual credentials;
restriction of access to health data;
IT security measures;
protection of devices used;
backups;
training and awareness of staff members;
internal incident management procedures.
The GDPR requires security measures appropriate to the risk of processing, including measures designed to ensure the confidentiality, integrity and availability of data.
15. PERSONAL DATA BREACHES
In the event of a personal data breach, S3 Studios shall assess the nature, severity and risk of the incident and adopt the measures required under the GDPR.
Where applicable, the breach shall be reported to the Portuguese Data Protection Authority (CNPD) within the legally prescribed deadlines, and data subjects shall be informed where required by law.
16. VIDEO SURVEILLANCE
Where a video surveillance system is installed on the premises, the processing of data shall be carried out in accordance with applicable legislation.
Video surveillance shall be used for purposes relating to the security of persons and property and shall not be used to monitor employee performance.
Cameras shall not be installed in areas where recording is prohibited by law.
The CNPD expressly states that cameras may not cover certain areas reserved for Clients' privacy, including the interior of sanitary facilities.
The existence of video surveillance shall be clearly indicated and the information required by law shall be made available.
17. PHOTOGRAPHY AND IMAGE
S3 Studios may take photographs or record videos on its premises for communication and promotional purposes, provided that an appropriate legal basis exists.
Where the use of the image of an identifiable person depends on consent, such consent shall be requested separately from membership of the services.
Refusal or withdrawal of consent for the use of an individual's image shall not affect the provision of contracted services.
S3 Studios shall seek to avoid unnecessarily capturing or publishing images of persons who have not authorised the use of their image.
18. MARKETING AND COMMERCIAL COMMUNICATIONS
S3 Studios may communicate with Clients in connection with the performance of the agreement, including for:
booking confirmations;
changes to schedules;
information relating to classes;
payments;
relevant changes to the operation of the studio;
administrative matters.
These communications do not necessarily constitute marketing communications.
Commercial and promotional communications shall be carried out in accordance with applicable legislation.
Where consent is required, the Client may choose not to receive such communications or may subsequently withdraw their consent.
Withdrawal of consent for marketing shall not affect the contractual relationship or access to services.
19. COOKIES AND SIMILAR TECHNOLOGIES
The website and/or application used by S3 Studios may use cookies or similar technologies.
Depending on their purpose, these may include:
strictly necessary cookies;
functional cookies;
analytics cookies;
marketing cookies.
Where required by law, consent shall be requested before non-essential cookies are used.
Additional information may be provided in a separate Cookie Policy.
20. RIGHTS OF DATA SUBJECTS
Under the GDPR, the data subject may, where applicable, exercise the following rights:
Right of Access
To obtain confirmation as to whether their personal data is being processed and to access such data.
Right to Rectification
To request correction of inaccurate or incomplete data.
Right to Erasure
To request deletion of personal data where the conditions established by law are met.
Right to Restriction
To request restriction of processing in certain circumstances.
Right to Data Portability
To receive certain personal data in a structured, commonly used and machine-readable format and request its transmission to another controller where the legal conditions are met.
Right to Object
To object to certain processing activities, particularly where they are based on legitimate interests or relate to certain marketing purposes.
Right to Withdraw Consent
Where processing is based on consent, such consent may be withdrawn at any time.
Withdrawal of consent shall not affect the lawfulness of processing carried out before its withdrawal.
The CNPD confirms these rights and clarifies that exercising them is generally free of charge and that the controller must respond to the request within one month, except where situations provided for by law allow that period to be extended.
21. HOW TO EXERCISE YOUR RIGHTS
Requests to exercise rights may be submitted through:
Email: hello@s3studios.pt
Address: Avenida Luísa Todi, No. 277, Ground Floor – E8, 2900-463 Setúbal
The request must identify the data subject and clearly indicate the right they wish to exercise.
S3 Studios may request additional information necessary to confirm the identity of the applicant in order to prevent unauthorised access to personal data.
22. COMPLAINT TO THE SUPERVISORY AUTHORITY
Without prejudice to any other administrative or judicial remedy, the data subject has the right to lodge a complaint with the competent supervisory authority.
In Portugal, the supervisory authority is:
Comissão Nacional de Proteção de Dados (CNPD)
Rua de São Bento, No. 148-3.º
1200-821 Lisbon
Telephone: +351 213 928 400
Email: geral@cnpd.pt
The CNPD is the national authority responsible for supervising the application of data protection rules in Portugal.
23. UPDATES TO THE PRIVACY POLICY
This Policy may be updated whenever necessary, including as a result of:
legislative changes;
regulatory changes;
changes to S3 Studios' services;
changes to the systems used;
changes to the data processing activities carried out.
The updated version shall be made available through the appropriate channels.
Where an amendment involves a relevant change to the information provided to the data subject, S3 Studios shall adopt appropriate measures to ensure that the data subject is duly informed.
23. CLIENT DECLARATION
The Client declares that they have had access to this Privacy and Personal Data Protection Policy and that they have received information regarding how their personal data is processed.