Purpose of Processing

Responding to inquiries sent via our contact form or email

Data Used

Name, email, message content

Lawful Basis (GDPR)

Legitimate Interests (to respond to prospective clients) or Contractual Necessity (pre-contractual steps)

4. Cookies and Squarespace Analytics

Our Site uses cookies—small text files placed on your device—to function properly and to help us understand how visitors interact with our pages.

• Strictly Necessary Cookies: Squarespace uses essential cookies to securely serve our website to you, prevent cross-site request forgery, and remember your cookie banner preferences. These are always active.

• Analytics and Performance Cookies (Squarespace Analytics): With your consent, we use Squarespace Analytics to collect information about site traffic and visitor activity. This helps us learn which pages are most popular and how visitors move around the Site.

• Managing Your Cookie Preferences: When you first visit our Site, you can choose to accept or decline non-essential cookies via our Cookie Banner. You can also block or delete cookies at any time through your web browser settings.

5. Who We Share Your Data With

We do not sell or rent your personal data to third parties. We only share your information with trusted third-party service providers ("Data Processors") who help us operate our business and website, under strict data protection agreements:

• Squarespace, Inc.: Our website is hosted on Squarespace. They provide the online platform, content delivery network, form submission routing, and Squarespace Analytics that allow us to run our Site.

• Email & Productivity Providers: We use Titan to receive and respond to your emails, and Squarespace Email Campaigns to manage our mailing list.

• Legal & Regulatory Authorities: We may disclose your data if required to do so by law, court order, or to protect our legal rights.

6. How We Store, Secure, and Transfer Your Data

• Storage & Security: Your data is stored through Squarespace's data storage, databases, and the general Squarespace application on secure servers behind a firewall, protected by SSL/TLS encryption in transit. We limit access to your personal data to those who have a genuine business need to know it.

• International Transfers: Because Squarespace is headquartered in the United States, your personal data may be transferred to, stored, and processed in the US or other countries outside the UK/European Economic Area (EEA). Where such transfers occur, they are protected by legally recognized safeguards, including the EU-US Data Privacy Framework (and UK Extension) and Standard Contractual Clauses (SCCs).

• Data Retention: We retain your personal data only for as long as necessary to fulfill the purposes we collected it for:

  • General inquiries: Retained for 12 months after our last communication so we can follow up or assist you properly, then securely deleted.

  • Marketing list data: Retained until you unsubscribe or request deletion.

7. Your Data Protection Rights

Depending on your location (including under the UK and EU GDPR), you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you.

• Right to Rectification: Ask us to correct inaccurate or incomplete information.

• Right to Erasure ("Right to be Forgotten"): Ask us to delete your personal data where there is no legal reason for us to keep it.

• Right to Restrict or Object to Processing: Ask us to suspend or stop processing your data in certain circumstances.

• Right to Data Portability: Request that we transfer your data to you or another service provider in a structured format.

• Right to Withdraw Consent: Where we rely on your consent (such as for cookies or marketing emails), you may withdraw that consent at any time.

To exercise any of these rights, please contact us at heal@sun-and-moon-acupuncture.co.uk. We will respond to all legitimate requests within one month.

Right to Complain: If you are unhappy with how we have handled your data, please contact us first so we can resolve it. You also have the right to lodge a complaint with your local data protection authority (for example, the Information Commissioner's Office (ICO) at ico.org.uk in the UK, or your local EU supervisory authority).

8. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. Any updates will be posted on this page with a revised "Last Updated" date at the top.