1. Who we are

Carmo Club is operated by Carmo AB, a company registered in Sweden (Org. No: 559542-7864).

Carmo AB is the data controller, which means we are responsible for how your personal data is processed and protected.

2. Data we collect

We only collect the information you share with us when using Carmo Club. This includes basic details such as your name, email address, and payment information when you create an account, book a session, or contact us. We also store information about your membership, bookings, and any messages you send to us.

We use a few essential cookies to make the website and app function properly, and basic analytics cookies to understand general usage patterns. We do not collect personal data from other sources, and we don't use cookies for advertising or profiling.

3. How we use your data

Your data is used only to provide and improve the Carmo experience. We use it to create and manage your account, handle bookings and payments, communicate with you about sessions, and deliver customer support.

We may also use aggregated and anonymous information to understand how people use the platform and to make Carmo better. If you've chosen to receive updates or newsletters, we'll send them only with your consent — and you can unsubscribe anytime.

4. Legal basis for processing

We process your data mainly because it's necessary to provide our service — for example, to manage your bookings and payments. Some data is kept to comply with legal obligations such as accounting or taxation. In certain cases, we rely on your consent, such as for optional communications or cookies.

You can withdraw your consent at any time by changing your preferences or contacting us.

5. Data sharing

We only share your personal data when it's required to deliver the service you've asked for. This includes sharing limited contact details with hosts who deliver workshops, payment information with Stripe, and technical information with trusted IT and hosting providers that help us run the Carmo platform.

All our partners comply with the GDPR and process data only on our instructions.

6. Data retention

We keep your personal data only as long as it's needed for the purposes described in this Policy.

Account data is stored while you remain a member. If your account becomes inactive, we will delete it after 24 months. Payment information is retained for the period required by Swedish law, usually seven years.

When data is no longer needed, it is securely deleted or anonymized.

7. Your rights

Under the GDPR, you have several rights regarding your personal data. You can request access to your information, ask us to correct or delete it, or object to certain types of processing. You can also withdraw any consent you've given.

To exercise your rights, just email us at hello@carmoclub.com.

If you are not satisfied with how we handle your data, you can contact the Swedish Authority for Privacy Protection (IMY) at www.imy.se.

8. Cookies

We use a small number of cookies to keep Carmo Club running smoothly. Some are essential — for example, to let you log in or make a payment. Others help us understand how the site is used so we can improve it over time.

You can manage or disable cookies in your browser settings. We do not use cookies for advertising, and we don't track you across other websites.

9. Updates to this policy

We may update this Privacy & Cookies Policy as Carmo grows or as the law changes.

If we make significant updates, we'll let you know through the platform or by email at least 30 days before they take effect.