Privacy policy.

1. Who we are

This policy applies to wellinspirit.com ("our site") and to anything you buy from us or do on it. Well In Spirit is the trading name of Well in Spirit Ltd, a company registered in England and Wales, company number 17440171. Our registered office is 20 Wenlock Road, London, N1 7GU. We are the controller of your personal information, which means we decide how and why it is used, and we are responsible for it. In this policy "we", "us" and "our" mean Well In Spirit.

If you have any question about this policy, or want to use any of your rights, email hello@wellinspirit.com or write to us at the address above.

Our site is not intended for children. You must be 18 or over to create an account or order, and we don't knowingly collect information about children.

Our site links to other websites, such as our social media pages. We don't control those sites and aren't responsible for how they use your information, so please read their own privacy policies.

2. The information we collect

Personal information means any information about a person from which that person can be identified. We may collect, use, store and transfer these kinds of personal information about you:

• Identity data: your first name and last name, and the display name and picture you choose for your forum profile.
• Contact data: your billing address, delivery address, email address and telephone number.
• Order data: what you have bought from us and when, what you paid, discount codes you used, the digital guides you can download and any membership you hold.
• Payment data: your card details are collected and processed by our payment provider, Stripe. We never see or store your full card number. We receive a payment reference, the payment status and limited details such as the card type.
• Gift and personalisation data: anything you tell us so we can prepare a ritual or a gift, such as the recipient's first name, a birthday or star sign, a preference you mention and your gift message. If you give us information about someone else, please make sure they would be happy for you to do so.
• Account data: your sign-in email address and your password, which we store only in a protected (salted and hashed) form that we can't read.
• Community data: the topics, replies, comments, photos and likes you post, your bookmarks and notification settings, and reports you make or that are made about your posts.
• Marketing and communications data: whether you have asked to hear from us, which kinds of email you chose, the wording you agreed to and when, whether you have unsubscribed, and messages you send us.
• Technical and usage data: your internet protocol (IP) address, browser type and version, device type, time zone, the pages you view, what you search for on our site and how you move through it. Like most websites, our servers keep a log of the requests they receive.

We don't ask for, and don't need, any special category information about you, such as details of your health, religious or spiritual beliefs, or sexual orientation. Please don't include this kind of information in a gift message, and think carefully before sharing it in the forum or community, where other people can see it.

We also use aggregated information, such as how many people visited a page. It can't identify you, so it isn't personal information.

Where we need personal information to fulfil your order, for example a delivery address, and you don't provide it, we won't be able to supply what you ordered.

3. How we collect it

• Directly from you, when you create an account, place an order, check out as a guest, add a gift message, join our mailing list, claim an offer, post in the forum or community, fill in a form or email us.
• Automatically, as you use our site, through cookies, server logs and similar technologies. See section 7.
• From other organisations: Stripe tells us whether your payment succeeded; our fulfilment partner and carriers tell us when your parcel has been sent and delivered; and, only if you accept the relevant cookies, Google and Meta give us statistics about how our site and our adverts are performing.

4. How we use it, and our legal basis

We only use your personal information when the law allows us to. The table below sets out what we do with it and the legal basis we rely on. "Legitimate interests" means our interest in running and improving our business in a way you would reasonably expect, balanced against your own rights and interests. We don't use your information for anything where your interests override ours.

We will only use your personal information for the purpose we collected it for, unless we reasonably consider that we need to use it for another reason that is compatible with the original purpose. If we need to use it for an unrelated purpose, we will tell you and explain the legal basis that allows us to. We don't make any decision about you by wholly automated means that would have a legal or similarly significant effect on you.

5. Marketing

We only send you marketing emails if you have asked us to: by ticking a box when you create an account or claim an offer, or by joining our mailing list. We keep a record of what you agreed to and when.

• You can choose which emails you receive: offers, new arrivals and discount codes, or the Well In Spirit Journal, or both.
• You can unsubscribe at any time using the link at the foot of every marketing email, or by emailing hello@wellinspirit.com. A discount code you have already been sent still works after you unsubscribe.
• Our emails may record whether they were opened and which links were followed, so we can see which messages are useful.
• Unsubscribing from marketing doesn't stop messages about an order you have placed or about your account.

We never sell your personal information, and we never share it with another organisation for that organisation's own marketing.

6. The forum and community

• What you post in the forum or community feed, together with your display name and profile picture, can be seen by other people using our site. Please don't post anything you would rather keep private.
• The community feed shows activity such as someone joining, buying a ritual or becoming a member. These cards say "Someone" unless you choose to be named, in which case they show your first name and initial. You can make that choice when you register and change it at any time from the community page. Switching it off also removes your name from earlier cards.
• Photos you upload are resized in your browser before they are sent to us, which removes hidden information stored in the file, such as the location where the picture was taken.
• Email notifications about replies and comments are off until you switch them on, and every notification email includes a link to stop them.
• You can edit or remove your own posts. If you would like us to remove something you can't remove yourself, or something about you that someone else has posted, email us.

7. Cookies and similar technologies

A cookie is a small text file that a website stores in your browser. Our site also uses your browser's local storage in a similar way. Some of these are strictly necessary for our site to work. Everything else is switched off until you agree to it.

The first time you visit, we ask what you are happy with. You can accept everything, reject everything that isn't essential, or choose category by category, and you can change your mind whenever you like: open cookie preferences. Until you accept analytics cookies, Google Analytics receives only basic, cookieless signals that don't identify you or your device.

You can also set your browser to refuse all or some cookies. If you block strictly necessary cookies, parts of our site, including the basket, checkout and sign-in, won't work.

8. Who we share it with

We share your personal information only with the people and organisations who need it to help us run our business, and only as much as they need:

• Our fulfilment partner and carriers. Your order is packed and dispatched from our UK fulfilment partner's warehouse and delivered by Royal Mail or a courier. They receive your name, delivery address and what is in your parcel, and use it only to deliver your order.
• Stripe, which processes your card payment and carries out fraud checks. Stripe is responsible in its own right for the card details you give it: see Stripe's privacy policy.
• Our website platform, hosting and IT support providers, who host our site and its database and help us maintain it, and Cloudflare, which protects our site and speeds it up, and through which traffic to our site passes.
• Our email delivery provider, which sends our emails for us.
• Google, for reCAPTCHA spam protection and, only if you accept analytics cookies, Google Analytics.
• Meta, only if you accept advertising cookies, to measure how our adverts on Facebook and Instagram perform.
• Professional advisers, such as our accountants, lawyers and insurers, where they need it to advise us.
• HM Revenue & Customs, regulators, courts and law enforcement, where the law requires it or to protect our rights, our customers or our community.
• A buyer of our business. If we sell, transfer or merge all or part of our business, the new owner may use your personal information in the same way as set out in this policy.

We require everyone who processes personal information for us to keep it secure, to use it only on our instructions and for the purposes we specify, and to treat it in accordance with the law.

9. Transfers outside the UK

Our site, its database and the files we hold for you are hosted in the United Kingdom. Some of the providers listed in section 8, including Stripe, Google, Meta and Cloudflare, are based in, or use systems in, the United States and other countries outside the UK. Where your personal information is transferred outside the UK, we make sure it is protected to the standard UK law requires, either because the country has been recognised by the UK government as providing adequate protection (which includes US organisations certified under the UK Extension to the EU-US Data Privacy Framework) or because the provider has signed contract terms approved for use in the UK. Email us if you would like more detail.

10. Keeping it secure

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, or used, accessed, altered or disclosed without authorisation. Our site is served over an encrypted connection, passwords are stored in a protected form we can't read, card details never reach our servers, and the files you have paid for are kept where they can't be reached without signing in. Access to your personal information is limited to the people who need it to do their job, who act only on our instructions and are under a duty of confidentiality.

We have procedures to deal with any suspected personal data breach, and we will tell you and the Information Commissioner's Office about a breach where we are legally required to.

11. How long we keep it

We keep your personal information only for as long as we need it for the purposes we collected it for, including to meet legal, tax, accounting and reporting requirements.

• Orders and payments: six years after the end of the financial year of the order, as tax law requires.
• Your account: for as long as it is open. You can ask us to close it at any time. We will then delete or anonymise your account details, apart from the order records described above.
• Forum and community posts: until you or we remove them. If you close your account, tell us whether you would like your posts removed too.
• Marketing: until you unsubscribe. We then keep just enough, your email address and the fact that you unsubscribed, to make sure we don't email you again.
• Questions and complaints: up to two years after the matter is closed, or longer if it relates to an order.
• Analytics: Google Analytics data is kept for up to 14 months.

12. Your legal rights

Under data protection law you have the right to:

• Request access to your personal information (commonly known as a "data subject access request"). This lets you receive a copy of the personal information we hold about you and check that we are using it lawfully.
• Request correction of any incomplete or inaccurate information we hold about you. You can correct most of it yourself in your account.
• Request erasure of your personal information where there is no good reason for us to keep using it. We may not always be able to do this in full, for example where we have to keep order records for tax purposes. If so, we will tell you why.
• Object to processing that we carry out on the basis of our legitimate interests, where you feel it affects your fundamental rights and freedoms. You have an absolute right to object to direct marketing at any time.
• Request restriction of processing, which means asking us to pause using your information, for example while its accuracy is checked.
• Request the transfer of the personal information you gave us, to you or to someone else, in a structured, commonly used, machine-readable format. This applies to information we process by automated means on the basis of your consent or a contract with you.
• Withdraw consent at any time where we rely on it, such as for marketing emails, cookies or being named in the community feed. This doesn't affect anything we did before you withdrew it.

To use any of these rights, email hello@wellinspirit.com.

• No fee is usually required. You won't have to pay to access your personal information or to use any of your other rights. We may charge a reasonable fee, or refuse to act, if a request is clearly unfounded, repetitive or excessive.
• What we may need from you. We may ask you for information to help us confirm who you are. This is a security measure to make sure personal information isn't given to anyone who has no right to it.
• How long we take. We try to respond to every legitimate request within one month. Occasionally it may take longer if your request is particularly complex or you have made several. If so, we will let you know and keep you updated.

13. Questions and complaints

If you are unhappy with how we have used your personal information, please tell us first at hello@wellinspirit.com. We will acknowledge your complaint within 30 days and do our best to put things right.

You also have the right to complain at any time to the Information Commissioner's Office (ICO), the UK regulator for data protection: ico.org.uk/make-a-complaint or 0303 123 1113.

14. Changes to this policy

We keep this policy under review and will update this page when it changes. The date at the top shows when it was last updated. If we make a significant change to how we use your personal information, we will tell you by email or with a notice on our site.

It is important that the information we hold about you is accurate and current. Please keep your details up to date in your account, or let us know if they change.