Privacy Policy

Mindfulness Devon (“we”, “us”) is run by Sophia Roddan and Toni Wood. We are responsible for the personal information described in this policy, which explains what we collect, why, who we share it with, and the rights you have over it.

We collect only what we need to run the site, respond to you and deliver our services safely. We never sell your information.

Information we collect

When you contact us

If you use our Contact form, we collect your name, email address, subject and message, and your phone number if you choose to give it. The form is sent to our business email account, and the website sends you a short automatic acknowledgement.

If you message Sophia or Toni on WhatsApp, we will see your phone number, your WhatsApp profile name and your messages. WhatsApp is run by Meta, and its own privacy policy applies to how it handles your messages.

When you book a day

Bookings are made through Ticket Tailor, our booking provider. When you book, we receive your name and email address, your emergency contact details, any dietary requirements or allergies, any access needs you choose to tell us about, and how you heard about us. Payments are processed securely by Stripe. We never see or store your card details.

Health, dietary and access information

Allergies, dietary requirements and access needs can reveal information about your health, which the law treats as especially sensitive. We only ask for this so that we can keep you safe and adapt the day for you. Giving it is your choice, and we rely on your explicit consent to use it. We share it only with people who need it to keep you safe on the day, and we delete it after the event (see “How long we keep it”).

Working with children and young people

When we work with a child or young person, including through Drawing and Talking, we collect only the information we need to deliver sessions safely, with the consent of a parent or carer. Anything shared about a child’s wellbeing is treated as sensitive, kept securely, and shared only where safeguarding procedures require it. The website itself is aimed at adults, including parents and carers enquiring on behalf of a child, and we do not knowingly collect information directly from children through it.

Newsletter

If you tick the newsletter box on our Contact form, or sign up on our Newsletter page, we store your email address, the date and time you agreed, your IP address, and where you signed up. We only send newsletters if you have explicitly opted in, and you can unsubscribe at any time using the link in any newsletter or by emailing us.

Free and premium resources

Some resources ask for your email address and an access code before they unlock. We store your email address, the access code used, the date and your IP address, and set a cookie so you are not asked again on future visits.

Community forum

Our community forum lets members post using a name and email address. Your display name and anything you post are visible to other members, so please do not include sensitive personal information about yourself or anyone else.

Website analytics

If you accept analytics cookies, we use Google Analytics to understand how people use the site: which pages are visited, roughly where visitors are in the world, the type of device and browser used, and how people found us. This helps us improve the site. Google Analytics does not give us your name or contact details, and nothing is collected through analytics cookies unless you accept them.

Maps

The maps on our location pages are provided by OpenStreetMap. To show the map, your browser requests map images from OpenStreetMap’s servers, which means your IP address is shared with them. These maps do not set cookies.

Reviews

If you leave us a Google review, it is published publicly by Google under Google’s own terms and privacy policy.

Cookies

We use a small number of cookies:

• mdv_consent remembers whether you accepted or rejected analytics cookies. It is essential and lasts six months.
• mdv_premium_unlocked and mdv_hcp_unlocked remember that you have unlocked a resource. They are functional and last one year.
• _ga and _ga_ cookies are set by Google Analytics, only if you accept analytics cookies. They last up to two years.

We do not use advertising or cross-site tracking cookies. You can change your choice at any time using the “Cookie settings” link at the bottom of every page, or the button below.

How we use your information, and our legal basis

• Replying to enquiries and messages: our legitimate interest in responding to people who contact us.
• Taking bookings and delivering our services: to perform our contract with you, or to take steps you have asked for before one.
• Health, dietary and access information: your explicit consent.
• Sending newsletters: your consent, which you can withdraw at any time.
• Website analytics: your consent, given through our cookie banner.
• Keeping financial records: our legal obligations for tax and accounting.
• Safeguarding: our legal obligations and, where necessary, to protect someone’s vital interests.

Who we share it with

We share your information only with the service providers we need to run our business, who handle it on our behalf and under their own security obligations:

• GoDaddy, which hosts our website
• Fastmail, which provides our business email
• Brevo, which sends automatic emails from our website
• Ticket Tailor, which handles bookings
• Stripe, which processes payments
• Google, for website analytics (only if you accept analytics cookies) and our Google Business Profile
• Meta, if you contact us through WhatsApp
• OpenStreetMap, which provides the maps on our location pages

We may also disclose information where the law requires it, or where safeguarding procedures require us to share a concern.

International transfers

Some of these providers store or process information outside the UK. Where they do, we rely on UK adequacy regulations or on approved safeguards, such as the UK International Data Transfer Agreement or Addendum, so that your information remains protected.

How long we keep it

• Enquiries and messages: up to 12 months after our last contact with you.
• Booking and payment records: six years, to meet tax and accounting requirements.
• Health, dietary, access and emergency contact information: deleted within three months after the event, unless an incident means we need to keep it longer.
• Newsletter sign-ups: until you unsubscribe.
• Resource unlock records: until you ask us to delete them.
• Forum posts: until they are removed by you or by us.
• Analytics data: no longer than 14 months.

Keeping your information secure

We use reputable providers, secure connections and strong account security, and we limit access to your information to the people who need it.

Your rights

Under UK data protection law you have the right to:

• ask for a copy of the information we hold about you
• ask us to correct anything that is wrong
• ask us to delete your information
• ask us to limit how we use it, or object to us using it
• ask for your information in a portable format
• withdraw your consent at any time, where we rely on it

To use any of these rights, email us at contact@mindfulnessdevon.com. We will respond within one month. If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk.

Changes to this policy

We will update this policy when our services or the site change. The date at the top always shows the latest version.

Contact us

For any question about this policy or your personal information, email contact@mindfulnessdevon.com.