PRIVACY POLICY.

This Policy applies to all personal data processed by Bunker Mangue — including members who use our physical conditioning services, prospective members who contact us, website visitors and anyone whose data we process in connection with our fitness activities. Physical conditioning services inherently involve health-related data — we treat all such data with the heightened care required by LGPD Art. 11 and our CREF4/PE professional obligations.

• Identification and contact data: Full name, CPF, date of birth, phone and email — collected when members sign up for membership or personal training.
• Physical assessment data (avaliação física): Body composition measurements, cardiovascular fitness indicators, strength and mobility benchmarks, postural assessment findings and all physical evaluation data collected by our CREF-registered instructors at intake and throughout the membership. This is sensitive health data under LGPD Art. 5º, II, processed under Art. 11.
• Health anamnese data: Health history, current medical conditions, medications, injuries, contraindications to exercise and any health information provided by the member or their physician relevant to safe physical conditioning. Sensitive health data — processed under Art. 11.
• Training records: Session attendance, training loads, programme progression notes and performance tracking data maintained by instructors to support member progress.
• Membership and contract data: Membership type, contract dates, NFS-e billing data (CPF or CNPJ) and payment records.
• Access control data: Entry and exit times where biometric or access-card systems are used — for security and operational purposes only.
• Contact and enquiry data: Name, phone and message when submitting enquiries via WhatsApp or our website form.
• Technical website data: IP address, browser type, pages visited and access times.

• Referring physicians (with member consent): Where a member consents to our communicating with their doctor, sports medicine physician or physiotherapist — only for health and safety coordination directly relevant to physical conditioning.
• Health insurance companies (when requested by member): Where a member requires NFS-e documentation or fitness assessment results for health insurance purposes — shared only at the member's request.
• SEFAZ-PE / Receita Federal: Tax data for NFS-e issuance and fiscal compliance in Pernambuco.
• Prefeitura de Recife (ISS): For ISS obligations on physical conditioning service activities in Recife.
• CREF4/PE: Where required by a professional ethics investigation or CREF regulatory proceeding.
• Emergency services (LGPD Art. 11, II, "a"): Where a member's physical safety is at acute risk — minimum necessary information to emergency services. Applied only in genuine medical emergencies on-site.
• PROCON-PE: When required in a consumer dispute under the CDC.
• Legal authorities: When required by a competent judicial or administrative order.

Our physical conditioning services are based in Recife, PE. All member health data and training records are stored in Brazil. Where scheduling, membership management or communication platforms operate on international servers, we use only platforms compliant with Art. 33 of the LGPD. Member health data is never transmitted internationally as part of our operational activities.

• Physical assessment and health anamnese records: Retained while the member is active plus a minimum of 2 years after membership ends — consistent with CREF professional standards for physical conditioning records and applicable CDC consumer protection periods. Records may be retained longer where a member requests ongoing access or where a dispute is pending.
• Training progression records: Retained while the membership is active plus 2 years — may be provided to the member on request at any time.
• NFS-e and fiscal records: Minimum 5 years under Receita Federal and SEFAZ-PE requirements.
• Membership contracts: Duration plus 5 years for contractual dispute purposes.
• Access control logs: Maximum 90 days unless required for a security incident investigation.
• Contact and enquiry data (no membership commenced): Up to 6 months from last contact.
• Website analytics: Aggregated and anonymised after 12 months.

• Physical assessment and health anamnese data accessible only to the CREF4/PE-registered instructor responsible for that member's programming — never accessible to other staff;
• Health and training records stored in access-controlled systems separate from administrative and billing data;
• Physical files stored securely at our Santana facility;
• WhatsApp health information handled with discretion — detailed health data collected in-person at the facility, not via open messaging;
• Website and digital communications encrypted in transit (HTTPS/TLS);
• PCI-DSS certified payment platforms — card data never retained;
• As a Ltda, formal internal data handling protocols maintained;
• Incident response and breach notification per LGPD Art. 48.

• Confirmation and Access (Art. 18, I–II): Confirm whether we hold your data and receive a copy — including copies of your avaliação física results and training records.
• Correction (Art. 18, III): Request correction of inaccurate identification or contact data.
• Anonymisation / Blocking / Deletion (Art. 18, IV): Request deletion — subject to retention obligations for fiscal records and the applicable CREF/CDC retention period for health and training data.
• Portability (Art. 18, V): Receive your physical assessment results and training records in a structured format — for example, to transfer to another fitness service provider.
• Deletion of consent-based data (Art. 18, VI): Withdraw consent for consent-based health data processing. Note that withdrawing consent for health data processing will affect our ability to prescribe safe conditioning programmes.
• Information on sharing (Art. 18, VII): Find out whether and with whom your health or personal data has been shared.
• Withdrawal of Consent (Art. 8º, §5º): Withdraw consent at any time.
• Complaint to the ANPD (Art. 18, §1º): Lodge a complaint at www.gov.br/anpd.
• Complaint to CREF4/PE: Ethical complaints about a physical education professional's conduct can be lodged with CREF4/PE independently of LGPD rights.

We respond within 15 business days.

Our website may use cookies for essential functionality and aggregated performance analysis. We do not use behavioural tracking or advertising cookies. Preferences can be managed through browser settings.

Where physical conditioning services are provided to minors (under 18), parental or guardian consent is required in compliance with LGPD Art. 14 and applicable CREF4/PE professional standards for youth fitness programmes. Health and avaliação física data for minors is processed under parental consent and subject to the same heightened protections as adult health data. Minors' health information is not disclosed to third parties without parental consent except in genuine safety emergencies.

Physical conditioning services involve the systematic collection of health-related data. All such data — avaliação física results, anamnese, health conditions, medications, injury history and training health indicators — constitutes sensitive health data under LGPD Art. 5º, II and is processed under the heightened protections of LGPD Art. 11.

This Policy may be updated to reflect changes in our services, the LGPD, ANPD guidance, CREF4/PE regulations or applicable Pernambuco tax legislation. Material changes will be communicated to active members by WhatsApp or email and via notice at the studio.

All privacy requests — including requests for copies of your avaliação física results and training records — should be directed to our Data Protection Officer (Encarregado — LGPD Art. 41):