Soul Studio

Last updated: 12 November 2026

1. Who We Are

Soul Studio is the trading name of Soulcraft Services Ltd, a company registered in England and Wales under company number 17106533.

We provide complementary therapies, spiritual and wellbeing services, workshops, courses, events and retail products.

Soulcraft Services Ltd is the data controller for personal information collected and processed through Soul Studio.

For questions about this Privacy Policy or how we handle your personal information, please contact:

Email: datacontroller@sarahssoulstudio.com

Website: https://www.sarahssoulstudio.com

2. Our Commitment to Your Privacy

We respect your privacy and are committed to protecting your personal information.

We collect and use personal information only where there is a legitimate reason to do so, and we aim to be clear about what we collect, why we need it, how we use it and how long we keep it.

We process personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection legislation.

3. What Information We Collect

Depending on how you interact with Soul Studio, we may collect the following information.

General Personal Information

• Your name
• Email address
• Telephone number
• Billing and delivery addresses
• Booking and purchase details
• Information you provide when contacting us
• Correspondence relating to our services
• Account information where you choose to create a website customer account

Health and Consultation Information

If you book a complementary therapy or healing treatment, we collect information relevant to providing that treatment safely and appropriately.

This may include:

• Relevant medical conditions and diagnoses
• Medication information
• Health history
• Information about symptoms or wellbeing
• Information you choose to share during consultation
• Consultation and treatment notes

This information is classed as special category personal data under UK GDPR and receives additional protection.

We do not request health information from customers purchasing retail products or attending activities where it is not necessary.

Payment Information

When you purchase products through our website, payments are processed by third-party payment providers, including Stripe.

We receive information necessary to identify and administer transactions, but we do not receive or store your full payment card details.

Our website shop uses WooCommerce to manage customer orders and accounts.

Bookings for treatments, workshops and other activities may be managed through external booking services, which process information in accordance with their own privacy notices.

Website and Technical Information

When you visit our website, certain technical information may be collected, including:

• IP address
• Browser and device information
• Website usage information
• Cookies and similar technologies

Further information is available in our separate Cookie Policy.

4. How We Collect Information

We collect personal information when you:

• Contact us by email, telephone, website or another communication channel
• Make a booking or enquiry
• Purchase a product
• Create a customer account
• Complete a consultation or health questionnaire
• Attend a treatment or participate in an activity
• Subscribe to our mailing list
• Interact with our website

Some information is collected directly by Soul Studio. Other information is received through service providers involved in delivering our services.

5. Why We Use Your Information and Our Lawful Bases

UK GDPR requires us to identify a lawful basis for processing personal information.

We use different lawful bases depending on the purpose.

Providing Products and Services

We use your contact, booking and purchase information to:

• Process bookings and orders
• Provide services you have requested
• Communicate about appointments and purchases
• Arrange deliveries where applicable
• Respond to enquiries relating to our services

Lawful basis: Article 6(1)(b) — performance of a contract, or steps taken at your request before entering into a contract.

Managing Our Business

We process information where reasonably necessary to:

• Maintain appropriate business records
• Respond to customer enquiries
• Manage customer relationships
• Maintain website and information security
• Handle complaints and disputes
• Protect our business and customers

Lawful basis: Article 6(1)(f) — legitimate interests, where those interests are not overridden by your rights and freedoms.

Legal and Financial Obligations

We retain and process certain records to meet applicable legal, accounting and tax obligations.

Lawful basis: Article 6(1)(c) — compliance with a legal obligation.

Marketing Communications

If you choose to join our mailing list, we use your contact details to send news, updates, events, offers and other Soul Studio communications.

Lawful basis: Article 6(1)(a) — consent.

You can withdraw your consent and unsubscribe at any time using the link included in our marketing emails or by contacting us.

We do not make subscribing to marketing communications a condition of receiving our services.

6. Health Information and Complementary Therapy Records

Some Soul Studio services require us to collect and process health information.

We collect this information so that practitioners can understand relevant health considerations, assess the suitability of a treatment and maintain accurate consultation records.

We request your explicit consent to process this special category information for the purposes of providing your treatment.

For this processing, we rely on:

• Article 6(1)(b): Performance of a contract
• Article 9(2)(a): Your explicit consent to the processing of health information

Before receiving a treatment, you will be asked to complete a consultation questionnaire and provide explicit consent to the necessary processing of your health information.

If you do not wish to provide the required information or consent, we cannot proceed with the treatment. If you have already paid for that treatment online, we will provide a full refund.

Your health information is accessed only by the practitioner providing your treatment and by anyone else who genuinely requires access for an authorised, lawful purpose.

Practitioners maintain separate access to their own clients’ treatment records. Records created through Soul Studio remain under the responsibility of Soulcraft Services Ltd.

We do not use your health information for marketing purposes.

7. Retention of Healing Consultation and Treatment Records

We retain completed health questionnaires, consultation records and treatment notes for five years from the date of your last attended treatment.

This retention period reflects our professional indemnity insurance requirements and our legitimate interest in maintaining appropriate evidence should a complaint, insurance claim or legal dispute arise concerning treatments provided.

If you withdraw your explicit consent to the processing of your health information, we will stop processing it for purposes dependent on that consent.

However, we may continue to retain records genuinely necessary for the establishment, exercise or defence of legal claims.

For this continued retention, we rely on:

• Article 6(1)(f): Legitimate interests
• Article 9(2)(f): Establishment, exercise or defence of legal claims

This does not mean we retain all health information automatically or use legal claims as a general justification for keeping information unnecessarily. We assess what is necessary and proportionate for the purpose.

Records retained for this reason are kept confidential, access is restricted, and they are not used for unrelated purposes.

At the end of the retention period, records are securely deleted unless a specific, documented legal reason requires longer retention, such as an ongoing claim or dispute.

You may request deletion of your information at any time. We will assess your request individually and explain where a lawful reason prevents immediate deletion of particular records.

8. How Long We Keep Other Personal Information

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected.

Our usual retention arrangements are as follows.

Enquiries

If you contact us but do not make a booking or purchase, we normally delete your enquiry information after 12 months, unless there is a specific reason to retain it longer.

General Customer Information

We retain customer information while you continue to have an active relationship with Soul Studio.

For general record-management purposes, we consider an account or relationship inactive after 12 months without a purchase, booking, enquiry or other contact.

We then review and delete information no longer needed, subject to any separate legal, financial or treatment-record retention requirements.

Orders and Financial Records

We generally retain financial and transaction records for six years, where necessary to meet tax, accounting and other applicable legal obligations.

Customer accounts and associated information are reviewed separately from financial records, which may need to be retained even after an account becomes inactive.

Mailing List

We retain your email address and relevant subscription information while you remain subscribed.

If you unsubscribe, we stop sending marketing emails.

Our mailing list provider may continue to hold your details in an unsubscribed state until they are removed during our administrative reviews.

Where necessary, we may retain minimal information to record your opt-out and prevent you from being added to marketing communications again without permission.

Other Records

Where another legal obligation, contractual requirement, dispute or legitimate purpose requires a different retention period, we will assess and document that requirement.

9. Who We Share Information With

We do not sell your personal information.

We share information only where necessary to operate our business, provide services, meet legal obligations or protect legitimate interests.

This may include:

Website hosting and technical support

Our website is hosted and technically supported by Bulletproof Monkey. The website server and its backups are located in the United Kingdom.

Google Workspace

We use Google Workspace for business communications, administration and certain forms and records.

WooCommerce

Our website shop uses WooCommerce to manage customer accounts, orders and associated information.

Stripe and other payment services

Payment providers process payment information and provide transaction details necessary for administering purchases and refunds.

Booking providers

External booking platforms may process information needed to arrange and manage appointments, workshops and events.

MailerLite

We use MailerLite to manage mailing list subscriptions and send marketing communications.

Professional advisers and authorities

We may share relevant information with insurers, legal or accounting advisers, regulators or other authorities where lawful and necessary.

We require service providers acting on our behalf to handle personal information appropriately and to provide the protections required by applicable data protection law.

10. Where Your Information Is Stored

Our website server and website backups are located in the United Kingdom.

We also use third-party services, including Google Workspace, MailerLite, Stripe and external booking providers.

Depending on the provider and service, information may be processed or accessed outside the United Kingdom.

Where personal information is transferred internationally, we take steps to ensure that appropriate protections are in place, including applicable adequacy arrangements or other lawful transfer safeguards where required.

Website hosting in the UK does not mean that every third-party service we use processes information exclusively within the UK.

11. How We Protect Your Information

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

These measures include, where appropriate:

• Password-protected accounts and devices
• Two-factor authentication for administrative access
• Restricted access according to staff and practitioner responsibilities
• Secure website hosting and backups
• Confidential handling of client records
• Limiting access to sensitive health information
• Reviewing information and deleting it when no longer required

Some treatment notes are currently maintained on password-protected devices without cloud synchronisation.

We review our working practices and security arrangements as our systems develop.

No electronic system can be guaranteed completely secure, but we take our responsibilities seriously and aim to minimise risks to the information entrusted to us.

12. Cookies

Our website uses cookies and similar technologies to support essential website functions and, where applicable, other purposes.

We use a cookie consent system to provide information about cookies and allow visitors to manage their preferences.

Where consent is required for non-essential cookies, we request it before using them.

You can find further information about the cookies used on our website, their purposes and how to manage your preferences in our:

Cookie Policy: https://www.sarahssoulstudio.com/cookie-policy/

13. Your Data Protection Rights

Under UK GDPR, you have rights relating to your personal information, subject to applicable legal conditions and exceptions.

These include:

• Right to be informed: To understand how your information is collected and used.
• Right of access: To request a copy of personal information we hold about you.
• Right to rectification: To request correction of inaccurate or incomplete information.
• Right to erasure: To request deletion of information in circumstances where this right applies.
• Right to restrict processing: To request limits on how your information is used in certain circumstances.
• Right to data portability: To receive certain information in a portable format where the relevant conditions apply.
• Right to object: To object to processing based on legitimate interests in certain circumstances.
• Right to withdraw consent: To withdraw consent at any time where consent is our lawful basis for processing.

Withdrawing consent does not affect processing that was lawful before withdrawal.

It also does not automatically require us to delete information that we have a separate lawful basis and applicable special category condition to retain, as explained in our section on treatment records.

To exercise your rights, contact:

datacontroller@sarahssoulstudio.com

We will respond in accordance with applicable data protection law, normally within one month.

We may need to verify your identity before fulfilling a request.

14. Complaints

If you have concerns about how we handle your personal information, please contact us first so that we can investigate and respond.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.

Website: https://ico.org.uk

Telephone: 0303 123 1113

15. Links to Other Websites

Our website may contain links to external websites, booking platforms, payment services and other third-party services.

We are not responsible for the privacy practices of independently operated websites.

We encourage you to read their privacy notices before providing personal information.

16. Changes to This Privacy Policy

We may update this Privacy Policy when our services, systems, legal obligations or data handling practices change.

The latest version will be published on our website with the date of its most recent update.

Where changes materially affect how we process your information, we will provide additional notice where required by law.

17. Contact Us

For any questions, concerns or requests relating to your personal information, please contact:

Soulcraft Services Ltd, trading as Soul Studio

Company number: 17106533

Email: datacontroller@sarahssoulstudio.com

Website: https://www.sarahssoulstudio.com