Privacy Policy

Last updated: 18 November 2025

1. Introduction

This Privacy Policy sets out how School of Shamanic Herbalism (“we”, “us”, “our”) collects, uses, and protects personal information when you visit or interact with www.shamanicherbalism.co.uk (“our website”).

We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR).

By using our website, you agree to this Privacy Policy and the collection and use of information in accordance with it.

2. Data Controller

The Data Controller responsible for your personal information is:
School of Shamanic Herbalism
Email: shamanicherbalism@gmail.com
We do not maintain a fixed postal address.

If you have any questions about this Privacy Policy or your data protection rights, you can contact us at the above email address.

3. Information We Collect

We may collect and process the following personal data about you:

  • Contact details: such as your name, email address, and phone number when you fill out contact or enquiry forms.

  • Purchase information: including your name, postal address, and payment details when you buy products or book courses through our website.

  • Course information: including limited health information and emergency contact details when enrolling in in-person courses, so we can ensure your safety and provide appropriate care or adjustments where required.

  • Technical data: such as your IP address, browser type, operating system, and similar information collected automatically through cookies and analytics tools when you visit our website.

  • Marketing preferences: including your name and email address when you sign up to our newsletter or mailing list.

Personal data is collected directly from you through our website, hosted on Squarespace, through Google Forms (for course enrolments), and through PayPal when you make purchases.

4. Lawful Bases for Processing

We process your personal data under one or more of the following lawful bases:

  • Consent: for example, when you subscribe to our newsletter or provide health information for course enrolment.

  • Contractual necessity: when processing information to provide you with goods, services, or courses you have purchased or booked.

  • Legitimate interests: to communicate with you, respond to enquiries, and improve our services, where such interests are not overridden by your rights.

  • Vital interests: when processing is necessary to protect your health and safety during an in-person course.

  • Legal obligation: when we must retain certain records for legal or tax purposes.

For health and other special category data, we rely on your explicit consent or vital interests as the lawful basis for processing.

5. How We Use Your Information

We use the personal information we collect for the following purposes:

  • To process purchases of products and courses.

  • To manage and respond to your enquiries.

  • To maintain contact with you and provide newsletters or updates you have requested.

  • To ensure participant safety during in-person courses.

  • To operate, maintain, and improve our website and services.

  • To comply with our legal obligations.

We do not sell or rent your personal information to any third party.

6. Third-Party Services and Data Processors

We use trusted third-party providers to help us deliver our services. These include:

  • PayPal, for processing payments.

  • Squarespace, for hosting our website, newsletters, and contact forms.

  • Google Analytics, for analysing website traffic and performance.

  • Google Forms, for collecting course enrolment and health information.

Each third-party provider only processes data on our behalf and in accordance with applicable data protection law. Where personal data is transferred outside the UK, it is protected by appropriate legal safeguards such as the UK’s standard contractual clauses.

7. Cookies

Our website uses cookies to distinguish you from other users and to enhance your experience.

We use essential cookies that are necessary for the operation of the site, and optional cookies for analytics and marketing purposes. You can manage your cookie preferences at any time through the cookie consent bar or by adjusting your browser settings.

Further details about the specific cookies we use may be made available in our Cookie Notice (if published separately).

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting, or reporting obligations.
Health and emergency contact information provided for in-person courses is deleted or securely anonymised once the course is completed, unless there is a legal reason to retain it longer.

9. Data Security

We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure, alteration, or destruction.
Access to personal data is restricted to authorised individuals who have a legitimate need to know and who are bound by confidentiality obligations.

10. Your Rights

Under the UK GDPR, you have the following rights:

  • The right to access your personal data.

  • The right to correct or update inaccurate data.

  • The right to request deletion of your personal data (the “right to be forgotten”).

  • The right to restrict or object to processing.

  • The right to data portability.

  • The right to withdraw consent at any time, where processing is based on consent.

  • The right to lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk.

To exercise any of these rights, please contact us at shamanicherbalism@gmail.com.

11. International Data Transfers

Where data is transferred outside the United Kingdom (for example, by our service providers), we ensure that appropriate safeguards are in place to protect your personal information, such as contractual clauses approved under UK data protection law.

12. Children’s Data

Our website and services are not intended for children under the age of 16, and we do not knowingly collect personal data from minors. If you believe we may have inadvertently collected such data, please contact us so we can delete it.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements. The updated version will be posted on this page with a revised “last updated” date.

14. Contact Us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact:
Email: shamanicherbalism@gmail.com