The Powerspot

Privacy Policy

  1. INTRODUCTION

Harmonised Spaces Consultancy (“we,” “our,” or “us”) is committed to protecting your privacy and ensuring compliance with applicable data protection laws. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our ecommerce (the “Service”).

By using our Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with our policies and practices, do not use our Service.

This Privacy Policy is designed to comply with the General Data Protection Regulation (GDPR) (EU) 2016/679 and the UK GDPR.

  1. INFORMATION WE COLLECT

We collect information that you provide directly to us and information that is automatically collected when you use our Service.

2.1 Information You Provide Directly

We may collect the following personal information when you interact with our Service:

  • Name
  • Email
  • Phone
  • Address
  • Payment info

In addition, we may collect:

  • Email address (for account creation, communications, and support)
  • Billing information (processed securely by payment providers such as Dodo, Stripe, or PayPal)
  • Account credentials (username, password, if you create an account)
  • Communications with our support team (emails, messages, feedback)

2.2 Automatically Collected Information

We may automatically collect certain information about your device and how you interact with our Service, including:

  • IP address
  • Browser type and version
  • Device information
  • Usage data and patterns
  • Referring website addresses
  • Date and time of visits

2.3 How We Collect Information

We collect information through the following methods:

  • Contact forms
  • Account signup
  • Newsletter
  • Checkout
  • User content
  • Website forms (contact forms, registration forms, checkout forms)
  • Account creation and profile management
  • Checkout and payment flow (processed by secure payment providers)
  • Cookies and tracking technologies (as described in our Cookie Policy)
  • Communications with us (emails, support tickets, feedback)
  1. HOW WE USE YOUR INFORMATION

We use the information we collect for the following purposes:

  • Providing services
  • Processing orders
  • Marketing emails
  • Customer support
  • Analytics
  • Legal compliance
  • Service delivery and improvement
  • Account management
  • Payments and billing
  • Fraud prevention and security
  • Analytics and performance monitoring

3.1 Legal Basis for Processing Personal Data (GDPR)

Under the GDPR, we process your personal data based on the following lawful bases:

  • Consent: Where you have given explicit consent for specific processing activities (e.g., marketing communications).
  • Contractual necessity: Where processing is necessary to perform a contract with you or provide requested services.
  • Legal obligation: Where processing is required to comply with applicable laws and regulations.
  • Legitimate interests: Where processing is necessary for our legitimate business interests and does not override your rights.
  1. SHARING YOUR INFORMATION

We may share your information with the following categories of third parties:

  • Payment processors
  • Analytics
  • CRM tools

4.1 Data Controller and Data Processors

We act as the data controller for the personal information we collect directly from you. Third-party services that we use (such as hosting providers, analytics services, or payment processors) act as data processors and may only process your data according to our instructions and applicable data protection laws.

We ensure that all data processors implement appropriate technical and organizational measures to protect your personal data.

4.2 Third-Party Services (Examples)

We may use third-party services to operate, analyze, secure, or market our Service. Examples include:

  • Google Analytics (analytics and performance)
  • Dodo / Stripe / PayPal (payment processing)
  • Cloudflare (security and CDN)
  • Google Ads, Meta Ads (advertising and attribution)

These examples are illustrative; your specific data flows depend on the features you use and the services we integrate.

4.3 International Data Transfers

Your personal data may be processed outside your country of residence, including in jurisdictions that may have different data protection laws. Where required, we use appropriate safeguards such as Standard Contractual Clauses (SCCs) or equivalent legal protections to protect your data.

  1. DATA RETENTION

We retain your personal information only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. Our retention periods are based on:

  • The nature of the data and the purpose for which it was collected
  • Legal, regulatory, or contractual requirements
  • The need to resolve disputes and enforce our agreements

Generally, we retain:

  • Account information: For as long as your account is active or as needed to provide services
  • Transaction records: For a minimum of 7 years as required by tax and accounting laws
  • Marketing data: Until you opt out or request deletion
  • Analytics data: Aggregated and anonymized data may be retained indefinitely
  • Logs and security data: 30–90 days, depending on security and compliance needs

When personal data is no longer needed, we will securely delete or anonymize it in accordance with our data retention policies.

  1. COOKIES AND TRACKING TECHNOLOGIES

We use various types of cookies and tracking technologies, including essential, analytics, and advertising cookies. For detailed information about our use of cookies, please refer to our Cookie Policy.

  1. YOUR RIGHTS AND CHOICES

You have the following rights regarding your personal information:

  • Right to view data: You can request to view data your personal information.
  • Right to download data: You can request to download data your personal information.
  • Right to request deletion: You can request to request deletion your personal information.
  • Right to opt out of marketing: You can request to opt out of marketing your personal information.

7.1 Additional Rights Under GDPR

If you are located in the European Economic Area (EEA) or United Kingdom, you have additional rights under the GDPR:

  • Right to Access: You can request a copy of the personal data we hold about you
  • Right to Rectification: You can request correction of inaccurate or incomplete data
  • Right to Erasure (“Right to be Forgotten”): You can request deletion of your personal data under certain circumstances
  • Right to Restrict Processing: You can request that we limit how we use your data
  • Right to Data Portability: You can request a copy of your data in a structured, machine-readable format
  • Right to Object: You can object to processing of your data for direct marketing or legitimate interests
  • Right to Withdraw Consent: Where processing is based on consent, you can withdraw consent at any time
  • Right to Lodge a Complaint: You have the right to file a complaint with your local data protection supervisory authority

To exercise any of these rights, please contact us using the information provided in the Contact section below. We will respond to your request within one month, though this period may be extended by two additional months if necessary.

7.2 Supervisory Authority

If you are located in the EEA or UK and believe we have not addressed your concerns, you have the right to lodge a complaint with your local data protection supervisory authority. A list of supervisory authorities can be found at: https://edpb.europa.eu/about-edpb/board/members_en

To exercise any of these rights, please contact us using the information provided in the Contact section below. We will verify your identity before processing your request. We aim to respond within 30 days (or 45 days where required by law). If you disagree with our response, you may request an appeal or lodge a complaint with your local supervisory authority.

  1. DATA SECURITY

We implement appropriate technical and organizational measures to protect your personal information against unauthorized access, alteration, disclosure, or destruction. These measures include:

  • Encryption of data in transit using SSL/TLS protocols
  • Secure storage of data with access controls
  • Regular security assessments and updates
  • Employee training on data protection
  • Incident response procedures

However, no method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee absolute security.

  1. CHILDREN’S PRIVACY

Our Service is not intended for children under the age of 13 (or 16 in the EEA/UK). We do not knowingly collect personal information from children under the applicable age. If you are a parent or guardian and believe your child has provided us with personal information, please contact us immediately. If we become aware that we have collected personal information from a child without parental consent, we will take steps to delete that information.

  1. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of any material changes by:

  • Posting the new Privacy Policy on this page
  • Updating the “Effective Date” at the top of this policy
  • Sending you an email notification (if we have your email address)

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information.

  1. CONTACT US

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email: rose@thepowerspot.uk
Location: United Kingdom

For GDPR-related inquiries, you can also contact our Data Protection Officer (if applicable) at the email address above.

Centre for Biofield Sciences · Accredited Handcrafted in Devon, UK Vibrationally imPrinted® Technology Trusted since 2009