Privacy policy

1. Data controller

Identity: Leisa Harvey

Tax ID (NIF): 43143028L

Address: Plaza Marina Alta 10, 03700 Denia, Alicante. España

Email: [ email@domain.com ]

For any matter relating to the protection of your personal data, you can contact us at the email address above.

2. Personal data we collect

This website (https://leisaharveyhealer.com) has no user registration. We collect personal data depending on how you interact with us:

Form data: your name, email, phone (optional), the reason for your enquiry or the session you chose, the days and times that suit you (optional) and the message you write, when you use the contact or booking form.

Booking data: your name and the contact details needed to manage your booking and, where applicable, invoicing. Payment is processed through an external gateway; we may have access to transaction details such as the account holder, date and amount, but not to your full card details.

Browsing data: IP address, device and browser type and pages visited, which the server records for security reasons. This website does not use its own cookies or analytics tools. The forms let you activate Google reCAPTCHA anti-spam verification, which is only loaded if you choose so (see the Cookie Policy).

Embedded videos: if you press “Play video” in a blog article, YouTube (Google LLC) or Vimeo receive your IP address and technical data from your browser. Nothing is sent to them until you press it (see the Cookie Policy).

Communication data: any information you give us when you contact us by email at [ email@domain.com ] or by any other channel provided.

[ Health or other sensitive data a person shares during sessions: handling and legal basis pending legal review ]

3. Purposes of processing

We process your personal data for the following purposes:

To handle the enquiries and booking requests you send through the forms.

To provide the Conscious Quantum Healing and Intuitive Art services and manage your bookings.

To manage the booking and payment of sessions through the integrated payment gateway.

To communicate with you: to send service-related notifications and answer your questions or requests for information.

To keep the Website secure and prevent fraud.

To comply with our legal obligations: tax, accounting, etc.

4. Legal basis for processing

The legal basis for processing your personal data depends on the purpose:

Consent: to process the data you send through the forms to load Google reCAPTCHA when you activate it, and to load the YouTube or Vimeo player when you press “Play video” (art. 6.1.a GDPR). You can withdraw it at any time.

Performance of a contract: to manage your booking, provide the service you have booked and process your payment (art. 6.1.b GDPR).

Compliance with a legal obligation: to comply with tax, accounting and other applicable laws (art. 6.1.c GDPR).

Legitimate interest: to answer your questions and keep the Website secure, provided your fundamental rights and freedoms do not override it (art. 6.1.f GDPR).

5. Data retention

We will keep your personal data only for as long as necessary to fulfil the purposes for which it was collected and to determine any liabilities that may arise from those purposes and from the processing, in addition to the periods set by archiving and documentation rules.

Client data: for as long as the relationship lasts. Once it ends, the data is blocked and kept only for the legal periods required to deal with possible liabilities (generally 5 years under the Commercial Code, 6 years for tax purposes).

Invoicing data: for the periods required by tax and accounting rules (generally 6 years).

Communications and enquiries: for as long as needed to handle your request.

[ Specific retention period for contact and booking emails that do not lead to a contract: still to be decided ]

[ Retention period for the server's access logs and backups: still to be checked ]

6. Sharing data with third parties

We will not share your personal data with third parties unless it is necessary to provide the service, we are required to by law, or you have given us your explicit consent. In particular, your data may be disclosed to:

Payment gateways: to process payment for sessions. Leisa Harvey Healer does not store your full card details; they are handled directly by the chosen gateway (Stripe) under its own security protocols.

Technology service providers: companies that provide auxiliary services needed for the Website to work (for example, hosting, web maintenance and email). These providers act as data processors, have been selected for offering adequate guarantees, and are prohibited from using the data for their own purposes.

Google: if you activate the anti-spam check, Google LLC (reCAPTCHA) receives technical data from your browser and device, such as the IP address, to check that you are a person.

YouTube and Vimeo: if you press “Play video” in a blog article, Google LLC (YouTube) or Vimeo receive technical data from your browser and device, such as the IP address, to show the video.

Public authorities, courts and tribunals: where there is a legal obligation to disclose the data.

7. International data transfers

Some of the service providers mentioned in the previous section may be located outside the European Economic Area (EEA), such as Stripe and Google (USA). In those cases, Leisa Harvey Healer ensures that such international transfers are made with the appropriate safeguards required by the GDPR. We select reputable providers that show a high level of data-protection compliance and that generally adhere to mechanisms such as the Standard Contractual Clauses (SCCs) approved by the European Commission, or are located in countries with an adequacy decision.

[ Vimeo: country where it processes the data and the safeguard for the transfer: pending legal review ]

8. Your rights

You have the right to exercise the following rights over your personal data:

Access: obtain confirmation of whether we are processing your data and access it.

Rectification: request the correction of inaccurate or incomplete data.

Erasure (right to be forgotten): request the deletion of your data when, among other reasons, it is no longer necessary for the purposes for which it was collected.

Objection: object to the processing of your data on grounds relating to your particular situation.

Restriction of processing: request that we restrict the processing of your data in certain circumstances (for example, while its accuracy is being verified).

Portability: receive your personal data in a structured, commonly used, machine-readable format and transmit it to another controller, when the processing is based on your consent or on a contract and is carried out by automated means.

To exercise these rights, you can send a written request, attaching a copy of your ID, to the postal address above or to the email [ email@domain.com ], clearly stating the right you wish to exercise.

You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) if you consider that the processing of your personal data infringes the applicable rules.

9. Security measures

At leisaharveyhealer.com we adopt the technical and organisational measures necessary to ensure a level of security appropriate to the risk, in accordance with article 32 of the GDPR. These measures include, among others, encryption of data in transit, the use of secure servers and restricted access management. However, the User should be aware that security measures on the Internet are not impregnable.

10. Minors' data

The Website is not aimed at minors. If we find that we have collected personal information from a minor without proper consent, we will delete it immediately. We recommend that parents or legal guardians supervise their children's use of the Internet and contact us if they believe a minor has provided personal data without their authorisation.

11. Policy updates

This Privacy Policy may be updated from time to time to reflect changes in legislation, our data-processing practices or the evolution of our services. We will inform you of any substantial change through a prominent notice on the Website or by other suitable means. We recommend that you review this policy regularly.

Date of last update: [ publication date ]