This Privacy Notice sets out how I, Carla Greenwood of The Lunar Loving Witch (the Data Controller) collects and uses your personal data. Any references to “I”, “me”, or “controller” in this Privacy Notice mean Carla Greenwood of The Lunar Loving Witch Tarot Healing.
When I refer to:
● UK GDPR – I mean the UK General Data Protection Regulation;
● DPA18 – I mean the Data Protection Act 2018; and
● PECR – I mean the Privacy Electronic Communications Regulation 2003.
My Privacy Notice is structured in a way for you to easily find the specific details of what I do with your personal data.
Contents
My contact details 1
Data Protection Officer 2
How I get your personal data 2
Why I need your personal data and what I do with it 3
Lawful grounds to use your personal data 5
Sharing your personal data with other businesses 6
Using data processors and 3 rd parties 6
Transferring personal data outside of the UK 7
Your rights 8
How to make a complaint about us to the Information Commissioner’s Office 9
Links to other websites 9
This Privacy Notice was last updated May 2022.
My contact details
You can contact me to discuss the use of your personal data via one of the following ways:
● Telephone: 07710 175762
● Email: thelunarlovingwitch@gmail.com
● Instagram: https://www.instagram.com/the_lunar_loving_witch
● Instagram: https://www.instagram.com/holistic_healing_knares_hgate
● Facebook: https://www.facebook.com/TheLunarLovingWitch/
● Tik Tok: https://vm.tiktok.com/ZMLEdjwPa/
Data Protection Officer
Although I do not meet one of the criteria to legally appoint a Data Protection Officer under UK GDPR, I take my data protection compliance obligations seriously. I use the services of an external data protection consultant where necessary to help ensure I collect and use your personal data in a manner you would expect me to.
How I get your personal data
I usually obtain your personal data directly from you for the following reasons:
● when you make enquiries about my services;
● when you make an appointment for one of my services;
● when you attend your appointment;
● when you sign up to receive marketing from me; and
● when you book on one of my workshops.
If I have met you at a networking event, business club or some other form of social engagement we may have swapped business cards or contact details. I may use your contact details to get in touch with you.
There may be occasions when I have obtained your details by word-of-mouth referrals, introductions and recommendations from other people.
I also collect personal data about you automatically. This is done when you visit my website and I collect your IP address and other information from the cookies that are deposited on the device you are using. You can control which cookies are deposited to your device and you can change your settings at any time you wish. To find out more about the cookies I use, please read my Cookie Policy.
Why I need your personal data and what I do with it?
There are various reasons I need to collect and use your personal data. The table below
sets out what those reasons are, the personal data I will need, what I will do with your
data, the lawful ground I rely on to process your data, how long I intend to keep your
data, and the data processors I may use.
Lawful grounds to use your personal data
Here is a bit more information on the lawful grounds I rely on to collect and use your personal data.
Consent (GDPR Article 6(1)(a) Explicit Consent (GDPR Article 9(2)(a)
I rely on your consent when you sign up to receive my newsletters and other promotions and special offers.
You always have the right to withdraw your consent to receive marketing, you can do this by clicking the “unsubscribe” link or contact me via one of the ways shown in the “My contact details” section.
If you choose to unsubscribe, I will stop sending you marketing communications. I always aim to stop sending you marketing as soon as I possibly can after I have received your
unsubscribe request.
I rely on your explicit consent for you to provide medical information to me in relation to the treatment you are receiving.
It is your choice as to how much information you
provide to me, if at all.
You always have the right to withdraw your explicit consent for me to use your medical
information for the purpose of delivering the treatment to you.
Contractual obligation (GDPR Article 6(1)(b))
This lawful ground allows me to use your personal data to respond to your enquiries
about my services, to make bookings with you, and to allow me to deliver my services to you and get paid for the services I provide.
I require certain information from you to enable me to fulfil my contractual obligation
with you. If you are not able to provide all the necessary information I have asked for it
may mean that I am not be able to provide the service to you and the arrangement may
therefore not proceed or may need to be terminated.
Legal obligation (GDPR Article 6(1)(c))
There are times when I must process your personal data for me to comply with a legal or regulatory requirement. In these cases I will usually rely on the lawful ground known as “legal obligation” as the processing is necessary for me to fulfil my legal obligation to which I am subject to. For example:
● I have a legal obligation under finance and tax laws to keep certain information relating to payments and tax.
● I have a legal obligation to provide the police or other law enforcement body with information if they are investigating a potential crime.
Sharing your personal data with other businesses
I do not share, sell or rent your personal data to other businesses for them to use for their own marketing purposes.
I may sometimes need to share your data with other organisations, such as when I have a legal obligation to do so.
Whenever I am asked to share your personal data I always
ensure I have a lawful ground to do so and I fully document the reasons for the sharing.
Using data processors and 3 rd parties
There are times when I need to use other businesses to help me fulfil the delivery of my
services to you. These other businesses will either be:
● data processors as they are acting under my strict instruction on what they can
and cannot do with your personal data; or
● joint data controllers as they have their own purposes to process your personal
data.
When I do use other businesses to process personal data on my behalf (data processors) I always ensure I have appropriate UK GDPR compliant contracts in place with each one.
A data processor is not allowed to do anything with your personal data other than what I have instructed them to do with it. They will not share your personal data with any other business apart from me, unless they are required to do so by law. They will hold it securely and retain it for the period I instruct.
Transferring personal data outside of the UK
Sometimes it is not possible for me to store or process your personal data wholly in the UK. When your personal data does need to be transferred or stored outside of the UK I make sure I comply with UK GDPR to allow me to do this. Your personal data will only be transferred outside of the UK when one of the following provisions are in place to safeguard the processing:
● An “adequacy regulation” is in place with the country where the personal data is
being transferred to.
● An “appropriate safeguard” is in place. These include the UK’s International Data
Transfer Agreement and other standard contractual clauses.
● An “exception” can be relied on if there is no adequacy decision or appropriate
safeguard in place. For example, I could rely on your explicit consent to make the
transfer of personal data.
Your rights
Depending on the reasons why I need your personal data and the legal basis I rely on, there are various rights available to you. You can:
● access the personal data I keep about you and be given specific information about
the processing. This right always applies regardless of the reason I need your
personal data.
● ask me to rectify personal data I hold about you that you think is inaccurate. This
right always applies regardless of the reason I need your personal data.
● ask me to delete your personal data. This right only applies in specific
circumstances depending on the reason we need to use your personal data.
● ask me to restrict the processing of your personal data. This right only applies
when specific circumstances apply.
● object to the processing when I have relied on legitimate interest to undertake
that processing activity and you believe I have infringed your rights.
● transfer your personal data from us to another service provider. This right only applies to personal data you have given to me directly and when the lawful ground for the processing is consent or contractual basis and the processing is automated.
I do not undertake any solely automated decision making, including profiling, about you.
To find out more about how to exercise your rights please refer to the guidance on the
Information Commissioner’s Office website. https://ico.org.uk/your-data-matters/
You do not need to pay a fee to exercise any of your rights. However, if your request is manifestly unfounded or excessive, I do have the right to either charge a reasonable fee or refuse the request. I shall respond to a valid request within one month of receiving it.
If you wish to exercise one of your rights, please contact me via one of the methods
shown in the “My contact details” section.
How to make a complaint about us to the Information Commissioner’s Office
If you are not happy with how I am processing your personal data or you believe I have
not dealt with one of your rights correctly you are entitled to make a complaint to the
Information Commissioners Office (ICO). The ICO has several ways in which you can get in touch with them, including post, email, and online forms. For full details how to make acomplaint please refer to their website. https://ico.org.uk/make-a-complaint/
Links to other websites
My website may provide links to websites of other organisations. My Privacy Notice does not cover how those organisations process your personal data when you visit their website.
I advise you to read their Privacy Notices.