Privacy Policy

Effective date: 1 January 2025
Last updated: 2 October 2026

Dawn Morgan Hypnotherapy ("I", "me", "my") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how I collect, use, store and share your personal data when you visit my website, buy from my store, interact with me digitally or make use of my services.

I am based in Spain and work with people in the EU, the UK, the United States, Canada and other regions. This Policy is intended to comply with, and be interpreted in line with, in particular:

  • The EU General Data Protection Regulation (EU GDPR)
  • Spain's data protection law (LOPDGDD)
  • The UK General Data Protection Regulation (UK GDPR), where applicable
  • The Privacy and Electronic Communications Regulations (PECR), where applicable
  • Applicable privacy laws in the United States and Canada, as described below

If you have any questions about this Policy, please contact me using the details in the Contact section below.

Who I Am

Dawn Morgan Hypnotherapy
Address: Calle Cruces 23, Galera, 18840 Granada, Spain
Tax number (NIF): Y8785422B
Email: [email protected]

I am the data controller for the purposes of EU GDPR and, where applicable, UK GDPR.

Data I Collect

I may collect and process the following categories of personal data when you use my website, store or services, or communicate with me:

Identity Data

  • Name, title

Contact Data

  • Email address
  • Phone number
  • Postal address (where relevant for in-person work, invoicing or administration)

Transaction Data

  • Payment details (amounts, dates, products or services purchased)
  • Limited billing information

Payments are processed by Stripe. I do not see or store your full card details.

Purchase and Download Data (for digital products bought from my store)

  • Your name, email address and billing country
  • What you bought, when, and the amount paid
  • A record that your download link was sent

Technical Data

  • IP address
  • Browser type and version
  • Device type and operating system
  • General location data (for example country or city, where available)

Usage Data

  • Pages visited, links clicked, time spent on the site
  • Interaction with emails (opens, clicks) where permitted by your email provider

Communication and Marketing Data

  • Your preferences for email, text message or other communications
  • Records of communications and of your consent or opt-out choices

Session and Client Information (for hypnotherapy and coaching work)

  • Information you choose to share about your goals, wellbeing and relevant background
  • Session notes I make to support continuity and quality of care

Health and wellbeing information. If we work together, you may choose to tell me about your health and wellbeing. I only record and use this information with your explicit consent, which I ask for before we begin, and only to support you safely in our work. You can withdraw that consent at any time. Buying a book or recording from the store does not involve any health information.

How I Collect Data

Directly from you

  • When you complete contact, enquiry or booking forms
  • When you buy or download a digital product (ebook, workbook, cards or audio recording) from my store
  • When you email, message or call me
  • During consultations, sessions or programmes
  • When you sign up for newsletters or free resources

Automatically

  • Through cookies and similar technologies on my website
  • Through basic analytics tools that help me understand how the website is used

From third parties

  • Stripe, my payment processor
  • Booking or scheduling platforms
  • Email or marketing systems

Where third-party tools are used, I aim to ensure they comply with applicable data protection laws.

How I Use Your Data and Lawful Bases

I process personal data only where I have a lawful basis under EU GDPR and UK GDPR. These are:

Performance of a Contract

  • To provide hypnotherapy, coaching and related services
  • To deliver digital products you have bought or requested, and to send your download link and receipt
  • To manage bookings, rescheduling and client support

Consent

  • To send newsletters, updates or marketing communications where you choose to opt in
  • To send text messages where you have agreed to receive them
  • For cookies and analytics that are not essential
  • For any health and wellbeing information you share with me (explicit consent)

Legitimate Interests

  • To respond to enquiries
  • To improve my services and website
  • To maintain appropriate records of sessions and client interactions
  • To help protect against fraud, misuse or security issues

Legal Obligations

  • To comply with tax, accounting and other legal requirements
  • To retain transaction and invoicing records

You may withdraw consent at any time where processing is based on consent (for example email marketing). This does not affect the lawfulness of anything done before you withdrew it.

Text Messages (SMS)

If you give me your phone number and agree to receive text messages, I may use text messages or similar channels to:

  • Confirm or remind you of appointments
  • Share brief updates relevant to your sessions
  • Send occasional promotional messages, only where you have clearly agreed to these

Agreeing to receive text messages is never a condition of buying anything from me. Message frequency varies. Reply STOP to stop messages at any time, or HELP for help. Message and data rates may apply.

I do not share or sell mobile phone numbers or text messaging consent to third parties or affiliates for marketing or promotional purposes.

Cookies and Analytics

My website uses cookies and similar technologies to:

  • Help the site function properly (for example the shopping cart)
  • Improve performance and usability
  • Understand how visitors use the site
  • Support security and error monitoring

Analytics tools may collect aggregated information about how the site is used (for example pages visited, time on site, approximate location).

Managing cookies. When you first visit, a banner asks whether you are happy for me to use cookies that are not essential. Nothing beyond the essential cookies is set unless you agree, and you can change your mind at any time. You can also limit or block cookies in your browser settings, although some parts of the site may not work as well.

Sharing Your Data

I do not sell or rent your personal data. I share it only with:

  • HighLevel (LeadConnector), the platform that runs my website, store, booking calendar, contact forms, emails and text messages
  • Stripe, which processes payments securely
  • Website, email or IT service providers involved in hosting, security or maintenance
  • Professional advisers (such as accountants) where required for legal and tax purposes

These providers are required to handle your data securely and only in line with my instructions and applicable data protection laws.

In exceptional circumstances, I may also need to share limited personal data:

  • Where required by law, regulation or court order
  • Where necessary to protect your vital interests or those of another person (for example in an emergency or a serious safeguarding concern), in line with professional and legal obligations

International Transfers

Some of the online tools I use operate globally, so your personal data may be transferred outside the EU, the EEA or the UK.

Where this happens, I take steps to ensure appropriate safeguards, such as:

  • Standard Contractual Clauses approved by the European Commission or UK authorities
  • Transfers to countries recognised as providing an adequate level of data protection

If you would like more detail about international transfers of your data, please contact me using the details in the Contact section below.

Data Retention

I keep your personal data only for as long as is reasonably necessary for the purposes described in this Policy and to meet legal, tax or regulatory requirements.

  • Client and transaction records (including invoices and store purchases): usually up to 6 to 7 years after the end of the relevant financial year, in line with tax and accounting rules.
  • Client session notes: kept for as long as needed for continuity of care and for legal and professional requirements. This is typically up to several years after the end of our work, unless a different period is required or justified.
  • Marketing lists: until you unsubscribe or withdraw consent, or until I remove inactive contacts.
  • Website analytics data: according to the retention periods set by the analytics provider, usually in aggregated or pseudonymised form.

When data is no longer needed, it is securely deleted or anonymised.

Your Rights (EU and UK Residents)

If you are in the EU or the UK, you have the following rights under GDPR, subject to certain conditions and exceptions:

  • Access: to request a copy of the personal data I hold about you.
  • Rectification: to have inaccurate or incomplete data corrected.
  • Erasure: to request deletion of your data where there is no good reason for me to continue processing it.
  • Restriction: to ask me to limit how your data is used in certain circumstances.
  • Objection: to object to processing based on legitimate interests or for direct marketing.
  • Portability: to receive certain data in a commonly used, machine-readable format, or have it transferred to another provider.
  • Withdrawal of consent: where processing is based on your consent, to withdraw it at any time.

To exercise any of these rights, email [email protected]. I will reply within one month.

You also have the right to complain to your data protection authority if you believe your rights have been infringed. In Spain this is the Agencia Española de Protección de Datos (www.aepd.es). In the UK it is the Information Commissioner's Office (ico.org.uk).

If You Live in the United States

I do not sell your personal information, and I do not share it with other companies for their own advertising.

Wherever you live in the United States, you can ask me to:

  • tell you what personal information I hold about you
  • correct anything that is wrong
  • delete your personal information, unless I need to keep it for legal or tax reasons
  • stop sending you marketing emails or text messages

I will not treat you differently for making any of these requests. Email me using the details in the Contact section and I will reply within 45 days. I may need to confirm your identity first.

My work is not medical treatment, and I am not a healthcare provider covered by HIPAA. I still treat anything you tell me as confidential.

If You Live in Canada

I handle your personal information in line with the principles of Canadian privacy law (PIPEDA). I only send marketing emails or text messages to people in Canada who have agreed to receive them, and every message includes a way to unsubscribe.

You can ask to see the personal information I hold about you and ask me to correct it. Your information is stored and processed outside Canada, including in the European Union and the United States, where it may be subject to the laws of those countries.

If you have a concern I have not been able to resolve, you can contact the Office of the Privacy Commissioner of Canada.

If You Live Elsewhere

Wherever you are, you can ask what personal data I hold about you, ask me to correct or delete it where that is legally possible, and opt out of marketing at any time.

Security

I take appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration or loss. These include:

  • Secure devices and password protection
  • Access to client data limited to what is needed
  • Use of reputable, security-conscious third-party providers

No method of transmission or storage is completely secure, and I cannot guarantee the absolute security of information sent over the internet.

Children

My website and store are intended for adults. I do not knowingly collect personal information online from children under 16 (or under 13 in the United States).

My one-to-one services are mainly for adults, but I may also work with children and young people under 18, with appropriate consent and safeguards in place. When working with children:

  • I require consent from a parent or legal guardian (or as otherwise permitted under applicable law).
  • A parent, guardian or responsible adult may be required to attend or be available during sessions, depending on the child's age and needs.
  • I collect and process only the personal and health-related information needed to provide the service safely and effectively.

If you are a parent or guardian and have questions about how I handle your child's data, or you believe I have collected personal data from a child without appropriate consent, please contact me promptly so I can address your concerns and, where necessary, update or delete the information.

Changes to this Policy

I may update this Privacy Policy from time to time to reflect changes in the law, my services or how I process your data. Any updated version will be posted here with a new "Last updated" date. For significant changes I will let you know by email if I hold your address.

Contact

If you have any questions, requests or complaints about this Privacy Policy or how your personal data is handled, please contact:

Dawn Morgan Hypnotherapy
Calle Cruces 23, Galera, 18840 Granada, Spain
Email: [email protected]