Effective Date: 31 December 2025

1. Introduction and Controller Information

Nostra Fortuna BV ("we", "us", or "our") is committed to protecting your privacy and handling personal data responsibly and transparently. This Privacy Policy explains how we collect, use, store, and protect personal information when you visit or interact with our website, our sales pages, and when you use services that we provide through third-party platforms, including Content Creator Machine (CCM).

Data Controller: Nostra Fortuna BV, Franklin Rooseveltlaan 349, B 112, email: [email protected]

For any questions regarding the processing of personal data, you may contact us using the details above.

2. Scope of This Policy

This Privacy Policy applies to visitors to our website and sales pages, customers and prospective customers of our digital products and services, users whose data is processed by Nostra Fortuna BV through third-party platforms we use, such as Content Creator Machine (CCM).

3. Personal Data We Collect

We collect only personal data that is necessary to provide our services, communicate with users, process payments, and comply with legal obligations. Categories of personal data we may process:

- First and last name

- Email address

- Telephone number (if provided)

- IP address

- Browser type and language

- Operating system and version

- Interaction data (e.g. page visits, clicks, time spent on pages)

We do not knowingly collect sensitive personal data such as government identification numbers, health data, or precise real-time location data.

4. Purposes of Processing

We process personal data for the following purposes: authentication and security, content delivery (including access to purchased digital products), communication efforts (service-related communication and support), customer support

Processing is based on consent where required, performance of a contract, compliance with legal obligations, or our legitimate business interests.

5. Data Storage and Security

Data storage: Personal data may be stored on secure servers located in the European Union and the United States, depending on the service provider involved. Where personal data is transferred outside the EU/EEA, appropriate safeguards such as Standard Contractual Clauses (SCCs) are applied.

Security measures: We apply appropriate technical and organisational safeguards, including encryption of data in transit, access restrictions to authorised personnel only.

6. Data Sharing and Third-Party Service Providers

To operate our business and deliver services, we rely on trusted third-party service providers who process personal data on our behalf or act as independent processors.

Key third-party providers include:

Content Creator Machine (CCM)

Purpose: Platform used to deliver digital content and services

Role: Data processor

Data processed: Name, email address, usage and interaction data

Privacy policy: https://contentcreatormachine.com/privacy

GoHighLevel

Used by CCM as technical infrastructure (sub-processor)

Privacy policy: https://www.gohighlevel.com/privacy-policy

Stripe

Purpose: Payment processing

Data processed: Email address and payment-related information

Privacy policy: https://stripe.com/privacy

PayPal

Purpose: Payment processing

Data processed: Email address and payment-related information

Privacy policy: https://www.paypal.com/privacy

Google Ads (if enabled)

Purpose: Advertising and campaign performance measurement

Privacy policy: https://policies.google.com/privacy

Cloudflare

Purpose: Security and performance optimisation

Privacy policy: https://www.cloudflare.com/privacypolicy/

We do not sell personal data to third parties.

7. Cookies and Tracking Technologies

We use cookies and similar technologies to ensure the proper functioning of our website, to analyse usage, and to support marketing activities where enabled. What are cookies? Cookies are small text files that are stored on your device when you visit a website. They help websites function efficiently, improve user experience, and provide information about how the website is used. Types of cookies we use:

Strictly necessary cookies: These cookies are essential for the operation and security of the website and cannot be switched off. They do not require user consent.

Analytics and performance cookies: At this time, we do not use analytics or performance tracking cookies on our website. If such cookies are enabled in the future, they will only be placed with your consent.

Marketing cookies: We use marketing and advertising cookies, such as tracking pixels (e.g. Meta Pixel), to measure ad performance and improve our marketing efforts. These cookies are only placed after you provide explicit consent through our cookie management tool.

Cookie consent: Where required by law, non-essential cookies are placed only after obtaining your consent via a cookie consent mechanism. You can manage or withdraw your cookie preferences at any time using the cookie settings available on the website.

IIf we use a third-party consent management platform (such as Cookiebot), the detailed and up-to-date cookie declaration will be made available through that tool.

8. International Data Transfers

Some service providers are located outside the EU/EEA. Any international data transfers are carried out using appropriate safeguards in accordance with GDPR requirements.

9. Children’s Privacy

Our services are not intended for children under the age of 18. We do not knowingly collect personal data from children. If such data is identified, it will be deleted promptly.

10. Direct Marketing and Communications

We may send direct marketing communications, such as emails, where legally permitted; marketing communications are sent only with consent or another lawful basis. Every marketing email includes an unsubscribe option. Where social media direct messages are used, this will only occur following user interaction or consent and in accordance with platform rules.

11. Your Rights

You have the right to access, rectify, or delete your personal data, restrict or object to processing, data portability, withdraw consent at any time, lodge a complaint with a supervisory authority.

Requests can be made via [email protected]

12. Data Breach Notification

In the event of a personal data breach: authorities will be notified within 72 hours, where required. Affected individuals will be informed without undue delay if there is a high risk.

13. Changes to This Privacy Policy

We may update this policy from time to time. Significant changes will be communicated via our website or other appropriate channels.

14. Contact

Nostra Fortuna BV

Franklin Rooseveltlaan 349, B112, 9000 Ghent, Belgium.

Email: [email protected]