Privacy Policy  
Soul Sovereignty — Geraldine Crane
Last updated: [15/09/26]  

1. Who We Are 
This Privacy Policy applies to geraldinecrane.com, geraldinecraneshub.newzenler.com, and any forms or questionnaires you complete with us via 17hats or otherwise, in connection with services provided by Geraldine Crane, trading as Soul Sovereignty ("we", "us", "our").  

Data Controller: Geraldine Crane, trading as Soul Sovereignty Address: 38 Oulton Lane, Woodlesford, Leeds, LS26 8NL
Email: hello@geraldinecrane.com Phone: 07837 960259  

We are committed to protecting your privacy and handling your personal data responsibly, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.  

2. What Personal Data We Collect 

Depending on how you interact with us, we may collect:  

- Contact details — name, address, phone number, email address
- Booking and payment information — service booked, invoice and payment details (processed securely via Stripe)
- Client intake information, including:
   - Occupation, and details of partner/children
   - Religion or spiritual belief
   - GP/doctor details and emergency contact details
   - Medication, disabilities and medical conditions (including childhood history)
   - Information about your relationship with alcohol or recreational drugs
   - Information about any history of thoughts of self-harm or suicide
   - Information about epilepsy or psychosis
   - Prior experience of hypnotherapy, fears/phobias, and what you hope to work on
- Communications — emails, messages, and any other correspondence with us
 - Website and technical data — such as IP address, browser type, and how you use our website, collected via cookies and analytics tools (see our Cookie Policy)
- Marketing preferences — such as whether you have opted in to receive emails from us

Special Category Data 
Some of the information above (health information, and religious or spiritual belief) is classed as "special category data" under UK GDPR.
We only collect this where it is necessary to deliver our services safely and appropriately (for example, screening for conditions where hypnotherapy is not suitable, or understanding your spiritual context for coaching purposes).
We rely on your explicit consent as the legal basis for collecting this data, given at the point you complete our intake form. You may withdraw this consent at any time, though this may affect our ability to safely provide certain services to you.  

3. How We Use Your Personal Data  

We use your personal data to:  

- Deliver the services you have booked, safely and appropriately
- Manage bookings, payments, and client records
- Communicate with you about your sessions or programmes
- Comply with our legal, insurance, and professional obligations (including safeguarding duties)
- Improve our website and services
- Send marketing communications, where you have consented to receive them  

Our legal grounds for processing include: performance of a contract with you, your explicit consent (for special category data and marketing), our legitimate interests in running our business safely and professionally, and compliance with legal obligations.  

4. How We Store and Protect Your Data  

Your data is stored securely using a combination of:  
- 17hats (client management, intake forms, contracts and invoicing)
- Google Workspace and secure cloud storage (email and document storage)
- Stripe (payment processing)  

We take reasonable technical and organisational measures to protect your personal data against loss, misuse, or unauthorised access. Access to your information is limited to those who need it to deliver your sessions.

 5. How Long We Keep Your Data 

We retain client personal data, including intake and session records, for 7 years, in line with our professional insurance and record-keeping requirements. After this period, data is securely deleted or anonymised, unless we are required by law to retain it for longer.  

6. Who We Share Your Data With  

We do not sell your personal data. We may share it in the following limited circumstances:  
- With trusted service providers who help us run our business (such as 17hats, Stripe, and our web/hub hosting providers), under appropriate data processing agreements
- With our professional supervisor, for the purposes of clinical/professional supervision — identifying details are removed
- With our accountant, insurer, or legal advisers, where necessary
- Where we are legally required to do so, including:
      - If ordered to testify in legal proceedings by a court of law
     - If we believe there is a risk of harm to a child or vulnerable adult (report to social services or police)
     - If we believe there is a risk connected to terrorism (report to police/relevant authorities)
     - If we believe you are at risk to yourself or of suicide (we may contact your GP, mental health practitioner, local crisis team, or the police)  

This aligns with the Confidentiality Policy set out in your Client Agreement.  

7. International Transfers 

Some of the platforms we use (such as our course hub, hosted via Zenler, and associated infrastructure providers) may store or process data outside the UK. Where this happens, we ensure appropriate safeguards are in place, such as standard contractual clauses or equivalent protections recognised under UK data protection law.  

8. Your Rights 

Under UK data protection law, you have the right to:  
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request erasure of your data (subject to our legal and insurance retention requirements)
- Object to or restrict certain processing
- Request that your data be transferred to another provider
- Withdraw consent at any time, where we rely on consent  

To exercise any of these rights, please contact us at hello@geraldinecrane.com. We will normally respond within one month.  

If you are unhappy with how we have handled your data, you have the right to complain to the Information Commissioner's Office (ICO): www.ico.org.uk.  

9. Cookies  

Our websites use cookies to improve your browsing experience and understand how our site is used. You can manage your cookie preferences through your browser settings or via the cookie banner on our sites.  

10. Age Restriction  

Our services are only available to individuals aged 18 or over.
We do not knowingly collect personal data from anyone under this age.  

11. Changes to This Policy  

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated revision date.  

12. Contact Us  

If you have any questions about this Privacy Policy or how we handle your personal data, please contact:  Geraldine Crane Email: hello@geraldinecrane.com Phone: 07837 960259 Address: 38 Oulton Lane, Woodlesford, Leeds, LS26 8NL