Effective date: 29 September 2025

1) Who we are

Controller: Quantum Clarity Hypnosis – Alex Martin Bee (autónomo)
Registered/operating in: Canary Islands, Spain (EU)
Contact: [email protected]

We provide hypnotherapy/consultation services to clients worldwide. We are established in Spain, so the EU General Data Protection Regulation (GDPR) and Spain’s LOPDGDD apply to our processing.

2) What data we collect and how we get it

We only collect personal data that you choose to provide:

• Booking data (Calendly): name, email, time zone, session details you add, and scheduling metadata.
• Contact form data (website): name, email, message content.
• Session data (optional): if you proceed with a session, we may create session notes or recordings with your explicit consent. These may include sensitive information you voluntarily share for the purposes of guidance/healing.

We do not ask for or store payment card details on our systems. If you pay online, that is handled by a separate payment processor – Stripe.com

3) Purposes and legal bases

We process your data for:

• Scheduling, communication and performing the service (GDPR Art. 6(1)(b) contract; or Art. 6(1)(f) legitimate interests for general inquiries).
• Maintaining records, invoicing, and compliance (Art. 6(1)(c) legal obligation; Art. 6(1)(f) legitimate interests).
• Email updates/marketing (only if you opt in) (Art. 6(1)(a) consent—can be withdrawn any time).
• Special-category data in session notes/recordings (if any): processed only with your explicit consent (GDPR Art. 9(2)(a)). You can refuse consent; the core service can still be provided without recording.

4) Where and with whom data is processed (processors)

We use reputable service providers to run our business:

• Calendly (Calendly LLC, USA) – appointment scheduling.
• Google (Google Cloud/Workspace, USA/EU) – email, cloud storage, documents.
• Website host / CDN – to serve our website Zenbox.PL
• Video-conferencing provider (Zoom) – only when sessions occur online.

These providers act under data processing agreements and apply appropriate security controls.

5) International transfers

Some providers are outside the European Economic Area (EEA). When we transfer data internationally, we rely on Standard Contractual Clauses (SCCs) and/or adequacy mechanisms such as the EU-U.S. Data Privacy Framework, where applicable. Copies of the relevant safeguards can be made available upon request.

6) Retention periods

• Contact form inquiries: up to 12 months (to follow up and improve service), unless you ask us to delete sooner.
• Calendly booking records: generally 24 months from the date of the appointment.
• Invoices/tax records: kept for the period required by Spanish law (typically 5–6 years).
• Session notes/recordings (if any): normally 24 months unless you request deletion earlier or consent to a different period. You can withdraw consent for recordings at any time.

We keep data only as long as necessary for the purpose collected or required by law.

7) Your rights

You can exercise the following rights at any time: access, rectification, erasure, restriction, objection, data portability, and (where processing is based on consent) withdrawal of consent.
To exercise rights, contact us at [email protected]
You also have the right to lodge a complaint with the Agencia Española de Protección de Datos (AEPD) at www.aepd.es