Privacy policy
ASCE PERFORMANCE — PRIVACY AND COOKIE POLICY
Version: 1.5 Effective date: 31 August 2026 Last updated: 31 August 2026
1. WHO WE ARE
| Legal entity | ASCE.PERFORMANCE BV |
| Trading as | ASCE Performance |
| Registered office | Vilvoorde, Belgium |
| Enterprise number (KBO / BCE) | BE 1020.327.360 |
| Founder | Alan Salgado Espino |
| Contact email | dreamchaser@asce-performance.com |
We are the data controller for the information described here. This Policy covers our websites — thebulletproofkneeprotocol.com, bulletproofaclprotocol.com, aclfreetraining.com and asce-performance.com — our Shopify store, our member areas, and our email.
We have assessed our processing under Article 37 GDPR and are not required to appoint a Data Protection Officer. Privacy questions go directly to the founder at the address above.
2. WHAT WE COLLECT
2.1 What you give us
| Identity and contact | First and last name, email address, billing address, country of residence |
| Account | Login details for your member area (stored securely by our platform providers), purchase history |
| Order | What you bought, order number, amount, currency, date, discount code used, payment method type and last four digits — we never see or store your full card number |
| Messages | Emails you send us, and our replies |
| Marketing | Whether you have subscribed or unsubscribed |
| Anything you send us | Reviews, feedback, questions |
We do not ask for health information to sell you a self-guided product. You buy it, you get it. If you choose to tell us something about your injury in an email, we use it only to answer you.
2.2 What is collected automatically
Your IP address; approximate location from that IP (country or city level); device, operating system and browser; the page that referred you and any campaign parameters; pages viewed and links clicked; whether you opened our emails; and cookie and advertising identifiers. Most of this happens only if you accept analytics or advertising cookies — see Section 7.
2.3 What we get from others
Order and payment records from Shopify, and advertising performance data from Meta and Google.
2.4 What we never collect
We do not knowingly collect anything from under-18s. We do not collect government ID numbers. We do not collect full card numbers. We do not buy personal data lists.
3. WHY WE USE IT
| Purpose | Legal basis |
|---|---|
| Giving you access to what you bought | Contract — Art. 6(1)(b) |
| Taking payment and issuing invoices | Contract — Art. 6(1)(b); legal obligation for tax records — Art. 6(1)(c) |
| Sending order confirmations and access details | Contract — Art. 6(1)(b) |
| Answering your emails and handling complaints | Contract; legitimate interests — Art. 6(1)(f) |
| Marketing emails | Consent — Art. 6(1)(a), or the soft opt-in for our own similar products to existing customers, always with an unsubscribe link |
| Advertising, retargeting and measuring conversions | Consent — Art. 6(1)(a), through the cookie banner |
| Website analytics and improving our pages | Consent — Art. 6(1)(a) |
| Security, fraud prevention and stopping account sharing | Legitimate interests — Art. 6(1)(f) |
| Meeting our tax, accounting and consumer law obligations | Legal obligation — Art. 6(1)(c) |
Where we rely on legitimate interests, we have weighed our interest against your rights and concluded the processing is proportionate. Ask us and we will explain.
4. WHO WE SHARE IT WITH
We never sell your personal data. We do not rent it or trade it.
| Provider | What they do | Where |
|---|---|---|
| Shopify | Store, checkout, payment processing, order management and product delivery | Canada / USA — Standard Contractual Clauses |
| PayPal | Payment processing | EU / USA — Standard Contractual Clauses |
| Resend | Sending our emails | USA / EU — Standard Contractual Clauses |
| Vercel | Website hosting | USA — Standard Contractual Clauses |
| Meta | Advertising and conversion measurement | USA — Standard Contractual Clauses and/or EU–US Data Privacy Framework |
| Analytics and advertising | USA — Standard Contractual Clauses and/or EU–US Data Privacy Framework | |
| Google Workspace | Our email and file storage | EU / USA — Standard Contractual Clauses |
Each is bound by a written data processing agreement. We also share with our accountant, and with public authorities where the law requires it. If our business is ever sold or transferred, your data may pass to the buyer, and this Policy continues to apply.
Payment processors act as independent controllers for fraud prevention and regulatory compliance. Advertising platforms act as joint controllers with us for pixel and conversion data — we decide which events are collected, they decide how the data is used across their platform.
Our store runs on Shopify — what that means for you. Our store and checkout are hosted by Shopify, which collects and processes information about your visit in order to run the store for us. Information you submit is transmitted to Shopify and may be processed in countries other than the one you live in.
Shopify also operates enhanced features that draw on your interactions with our store together with your interactions with other merchants and with Shopify itself, including to support personalised advertising. For those purposes Shopify decides how your information is used and is responsible for that processing in its own right, not on our behalf. That means you deal with Shopify directly about it, and you can read how Shopify uses personal information in the Shopify Consumer Privacy Policy, and exercise your rights over that processing — including opting out of personalised advertising built on cross-merchant activity — through the Shopify privacy portal at https://privacy.shopify.com/en.
Depending on where you live, you may have the right to tell us not to share information about you for targeted advertising based on your activity across different merchants and websites. Email us and we will action it.
5. LEAVING THE EU, AND HOW LONG WE KEEP THINGS
5.1 International transfers. We are based in Belgium and store data primarily in the EU/EEA. Some providers above process data in the United States or Canada. Where data leaves the EEA we rely on an adequacy decision, the EU–US Data Privacy Framework where the recipient is certified, or Standard Contractual Clauses approved by the European Commission.
5.2 How long we keep it
| Your account and access | For as long as you have access, plus 12 months |
| Invoices and order records | 7 years from the end of the financial year — required by Belgian tax law |
| Record of the terms you accepted | 10 years — evidence of what was agreed |
| Emails you send us | 3 years from your last contact |
| Marketing contacts | Until you unsubscribe, then 12 months |
| Unsubscribe list | Kept indefinitely, minimal data only, so we never email you again by mistake |
| Website and security logs | 12 months |
Where a legal claim is threatened or ongoing, we keep relevant records until it is resolved.
6. YOUR RIGHTS
Want everything deleted? Just email us and ask. No reason, no form, no particular wording. We will delete everything we hold about you and confirm when it is done, normally within a month. The only exceptions are records the law requires us to keep — your invoice for tax purposes, and the record of the terms you accepted — and those are locked away and used for nothing else. Say the word and we will take you off our email list at the same time.
You also have the right to:
- access your data and get a copy of it;
- correct anything inaccurate;
- restrict how we use it while a dispute is sorted out;
- receive it in a portable format, or have it sent to another provider;
- object to processing based on legitimate interests — and object to marketing at any time, which we will always honour, no questions asked;
- withdraw consent whenever you like, as easily as you gave it.
We do not make automated decisions about you that have legal or similarly significant effects.
To use any of these, email us at the address in Section 1. We reply within one month, or tell you within that month if a complex request needs longer. It is free unless a request is clearly excessive. We may need to check your identity first.
If something is wrong, email us. We are a small team, a real person reads every message, and we would much rather hear from you and fix it than have you go anywhere else. Write to us at the address in Section 1 and we will come back to you. You also have the right to complain to the Belgian Data Protection Authority (www.dataprotectionauthority.be) or to the authority in your own country.
7. COOKIES
7.1 Cookies are small files placed on your device. We also use pixels and similar technologies; this section covers all of them.
7.2 Your choice. Strictly necessary cookies are set without asking. Everything else — analytics, advertising, personalisation — is only set after you agree through our banner. Accept and Reject are equally easy, nothing is pre-ticked, and no non-essential cookie fires before you choose. Continuing to scroll is not agreement. You can change your mind at any time through the "Cookie settings" link in our footer.
7.3 What we use
| Type | What for | Needs consent | How long |
|---|---|---|---|
| Strictly necessary | Keeping you logged in, running the cart and checkout, security, remembering your cookie choice | No | Session to 12 months |
| Functional | Remembering preferences and video position | Yes | Session to 12 months |
| Analytics | Understanding which pages work and where people drop off | Yes | Up to 24 months |
| Advertising | Meta Pixel, conversion measurement, retargeting | Yes | Up to 24 months |
7.4 Meta Pixel. We use the Meta Pixel to measure how our ads perform and to show ads to people who have visited us. It only fires if you accept advertising cookies. Meta acts as a joint controller for this — see facebook.com/privacy/policy.
7.5 You can also block cookies in your browser, and we honour Global Privacy Control signals. Blocking strictly necessary cookies will stop checkout working.
7.6 A full, current list of the cookies we use — names, providers, purposes and durations — is in the cookie settings panel, which you can open from the banner or from the "Cookie settings" link in our footer.
8. SECURITY
We use appropriate technical and organisational measures under Article 32 GDPR: encryption in transit and, where our providers support it, at rest; access controls; multi-factor authentication on admin accounts; written data processing agreements with every provider; confidentiality obligations on everyone who works with us; and secure deletion at the end of the retention periods above.
No system is completely secure and we cannot promise absolute security. If a breach occurs that is likely to put your rights at risk, we will tell the Belgian Data Protection Authority within 72 hours of finding out, and we will tell you directly without delay where the risk to you is high.
9. CHILDREN
Our products are for adults. We do not knowingly collect data from anyone under 18. If you think a minor has given us data, email us and we will delete it.
10. CHANGES
We may update this Policy. The date at the top will change. If a change materially affects how we use your data, we will email you or put a clear notice on our site before it takes effect. If a change needs your consent, we will ask separately rather than assume it from continued use.
ANNEX — IF YOU ARE OUTSIDE THE EU
Wherever you live, you can ask us to access, correct or delete your information, and to stop sending you marketing, by emailing the address in Section 1. We apply the rights set out in Section 6 to everyone, regardless of country.
United Kingdom. You have equivalent rights under the UK GDPR. Complaints go to the Information Commissioner's Office — ico.org.uk.
United States. If you live in a state with a comprehensive privacy law, you may have the right to know what we collect, get a copy, correct it, delete it, opt out of targeted advertising, and not be treated differently for exercising those rights. We do not sell personal information for money, though our use of advertising cookies may count as "sharing" for cross-context behavioural advertising under California law. To opt out, use the "Cookie settings" link in our footer or send a Global Privacy Control signal, which we honour. Email us with "US Privacy Request" in the subject line.
End of Privacy and Cookie Policy.