Privacy Policy

Privacy Policy — Calm Mind Collective

Last updated: 02.07.2026

  1. Introduction
    We respect your privacy and are committed to protecting your personal data in line with the UK GDPR and Data Protection Act 2018. This policy explains how we collect, use, share and protect personal data when you visit our website, sign up for courses/resources, book hypnotherapy, or make payments.

  2. Data controller and contact
    Data controller: Calm Mind Collective
    Contact email: hello@calmmindcollective.co.uk
    Postal address: Houghton le Spring, DH45NY
    Data Protection Officer (or privacy contact): hello@calmmindcollective.co.uk

  3. Personal data we collect
    We may collect:

  • Identity and contact data: name, email, phone number, postal address.

  • Account and course data: account credentials, course enrolment, progress, certificates.

  • Booking data: appointment dates/times, session notes relevant to scheduling.

  • Payment and billing data: payment card details (tokenised), billing address (processed by Stripe).

  • Health and special category data: information you provide about your health, mental health, or other sensitive matters in connection with hypnotherapy or course content. This is treated as “special category” data.

  • Technical and usage data: IP address, device/browser info, pages visited, cookies and analytics.

  • Communications: messages you send via forms, email, chat, or support channels.

  1. How we collect data

  • Directly from you (registration forms, bookings, course sign-ups, emails).

  • Via third-party services (see section 7).

  • Automatically via cookies and analytics when you use the site.

  1. Purposes and lawful bases for processing
    We process personal data for the following purposes and lawful bases:

  • To provide services and perform contracts (UK GDPR Article 6(1)(b)): course delivery, bookings, customer support, order fulfilment.

  • To process payments (contractual necessity; Stripe acts as processor).

  • To obtain your explicit consent for processing special category (health) data and certain marketing activities (Article 9(2)(a) and Article 6(1)(a)).

  • For legitimate interests (Article 6(1)(f)) such as improving the website, fraud prevention, managing our business and communications — we balance these interests against your rights.

  • To comply with legal obligations (Article 6(1)(c)), e.g., tax and accounting record keeping.

  1. Special category (sensitive) data
    If you provide health or other special category data (e.g., in intake forms for hypnotherapy), we will only process this with your explicit consent (Article 9(2)(a)). We use this data solely to deliver safe, appropriate therapy and to meet our contractual and clinical obligations. You may withdraw consent at any time; withdrawal will not affect processing done prior to withdrawal where another lawful basis applies.

  2. Third-party processors and services
    We use the following third parties; they act as processors or independent controllers per their terms:

  • Systeme.io — platform for courses, email automation and membership management.

  • Jotform — online forms and intake questionnaires.

  • Stripe — payment processing (payment card data processed and stored by Stripe).

  • Cookiebot (Usercentrics) — cookie consent management.

  • Hostinger — web hosting.
    We take contractual measures to ensure they provide appropriate safeguards. Their privacy practices govern their handling of your data — links to their privacy policies are available on their sites.

  1. Cookies and tracking
    We use cookies and similar technologies to operate the website, enable functionality, and for analytics and marketing. Cookie consent is managed via Cookiebot. You can manage or withdraw consent via the cookie banner or your browser settings. Essential cookies required for service operation are used regardless of consent.

  2. International transfers
    Some processors may transfer or store data outside the UK/EEA. Where transfers occur to countries without an adequacy decision, we rely on appropriate safeguards such as standard contractual clauses or the processor’s published safeguards. You can request details of the safeguards from our privacy contact.

  3. Data retention
    We retain personal data only as long as needed to provide services, comply with legal obligations, resolve disputes, and enforce agreements. Typical retention periods:

  • Financial and billing records: as required by law (usually 6–7 years).

  • Account/course data: for the duration of your account plus up to [X] years after inactivity.

  • Intake and therapy records: retained in line with professional guidance (commonly 7 years for adults) or as required by law.

  • Marketing data: until consent withdrawn.
    Contact us to request exact retention details for specific data.

  1. Your rights
    Under the UK GDPR you have the right to: access your personal data; rectify inaccurate or incomplete data; erase data where no lawful basis prevents it; restrict processing; object to processing (including for direct marketing); data portability (where applicable); withdraw consent at any time; and lodge a complaint with the supervisory authority. To exercise rights, contact us at the email above. We will respond within one month (extensions may apply).

  2. Complaints procedure (UK GDPR updates)
    If you have a concern or complaint about our handling of your personal data:

  1. Contact our privacy contact at hello@calmmindcollective.co.uk with details; we aim to acknowledge within 5 working days and investigate promptly.

  2. We will provide a written response setting out the outcome and any remedial steps within one month. If we need more time we will inform you and provide an expected resolution date (extensions up to two further months may apply).

  3. If you remain dissatisfied, you may escalate to the Information Commissioner’s Office (ICO): https://ico.org.uk. We will cooperate with any ICO inquiry.

  1. Security
    We implement appropriate technical and organisational measures to protect personal data (access controls, encryption where appropriate, secure hosting). No internet transmission or storage can be 100% secure. If a personal data breach affects your rights, we will notify you and the ICO when required by law.

  2. Automated decision-making and profiling
    We do not rely on automated decision-making or profiling that has legal or similarly significant effects on you. If this changes, we will notify you and obtain necessary consents.

  3. Children
    Our services are not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe we have done so, contact us to have the data deleted.

  4. Changes to this policy
    We may update this policy; material changes will be notified on the website or by email where appropriate. Check the “Last updated” date.

  5. Contact and further information
    For questions, data access requests, complaints, or to withdraw consent:

hello@calmmindcollective.co.uk
Supervisory authority: Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, UK. Website: https://ico.org.uk