This policy reflects the current website enquiry stack, including HubSpot and Vercel. The operating legal entity, registered address, governing law, processing-country details, and final non-image record-retention schedule still require formal confirmation.
1. Who is responsible
Rainbow Sanctuary (operating legal entity to be confirmed), trading as Rainbow Sanctuary, is responsible for the personal information described here. Registered address: to be confirmed before launch.
2. What we collect
Information you choose to send
- your name, email address, and WhatsApp number;
- the general reason for your enquiry and the programme or session you select;
- the message or application context you choose to provide;
- for an adult Private Healing application only, a recent headshot when you give the separate image consent shown on the form;
- booking, attendance, payment, or account information only if those services are added and explained before collection;
- communications and preferences when you correspond with us.
Technical information
The production host may create limited security and access logs such as IP address, browser type, requested page, date, and time. The current site does not use analytics, advertising pixels, profiling, or automated decision-making.
Sensitive information
Please do not send medical records, diagnoses, government identifiers, financial details, or unnecessary information about a child through the consultation form. A Private Healing headshot is used only to review and, if accepted, support that request; it is not used for medical diagnosis, biometric identification, or identity verification. If other sensitive information is volunteered, we will limit its use to the enquiry, ask for an appropriate basis where required, or securely remove it when it is not needed.
3. How and why we use information
- to respond to an enquiry and suggest a suitable next step;
- to review a Private Healing application for which separate image consent was provided;
- to take steps you request before entering an agreement;
- to arrange and deliver a confirmed service;
- to maintain site security, prevent misuse, and keep necessary records;
- to meet legal, safeguarding, accounting, and regulatory duties;
- to send marketing only when you have made a clear choice to receive it.
Depending on your location and the activity, the legal basis may be consent, steps before or performance of a contract, compliance with law, protection of vital interests, or a legitimate interest that does not override your rights.
5. Children’s privacy
This website is for adults and is not designed to collect information directly from children. A parent or legal guardian must make enquiries about a child. Children should not submit the consultation form or a Private Healing headshot.
Information about a child is treated as sensitive and collected only when necessary for a specific program, with age-appropriate explanation and the required parent or guardian authorization. Photos, video, or audio of a child require a separate, specific permission process; participation is not conditioned on publicity consent.
6. Retention and security
We keep enquiry information only as long as needed to respond, manage any resulting relationship, meet legal duties, and resolve disputes. A Private Healing intake headshot is configured for automatic permanent deletion from HubSpot after 30 days. A longer-lived image would require a new purpose-specific consent and an approved case-record process. Other enquiry and paid-service records may require different operational or legally mandated periods.
We use proportionate administrative and technical safeguards and limit access to people who need the information. Private Healing headshots are restricted to private CRM attachments and are not placed in public folders or the general Rainbow CRM payload. No internet transmission or storage system can be guaranteed completely secure.
7. Your choices and rights
Depending on where you live, you may be entitled to ask for access, correction, deletion, restriction, portability, or an objection to certain processing; withdraw consent without affecting earlier lawful use; and complain to your local data-protection authority. We may need to verify your identity before acting on a request.
You can unsubscribe from optional marketing at any time. The current site does not run an email newsletter or behavioral advertising.
8. Contact and changes
Send privacy questions or requests to the privacy contact listed before launch. We will update this policy when the site’s forms, providers, payments, analytics, or services change and will revise the date above.
Contact-channel information
The enquiry form also requires a WhatsApp number with country code. Rainbow Sanctuary uses it, together with your email address, to review and respond to your request through the contact channel most suitable for direct follow-up. Providing a WhatsApp number for an enquiry does not by itself subscribe you to marketing messages.