1. Who We Are

SHSUK Ltd (trading as Sound Healing School UK) is a company registered in England and Wales. We are a sound healing training school operating a network of affiliated training hubs across the UK.

Registered address: Grive House, 45 Walton Street, Walton on the Hill, Surrey, KT20 7RR

Email: info@soundhealingschooluk.com

ICO Registration Number: ZB988241

For this policy, 'we', 'us' and 'our' refer to SHSUK Ltd in its capacity as a data controller under UK GDPR and the Data Protection Act 2018.

2. What This Policy Covers

This policy explains how SHSUK Ltd collects, uses, stores and shares your personal data when you:

• make an enquiry about one of our courses via our website or by contacting us directly;

• enrol on a course and become a student;

• sign up to our mailing list;

• make a payment through our website;

• interact with us in any other way.

This policy covers all personal data collected through SHSUK Ltd and its trading names, including Sound Healing School UK and Heron Moon.

3. Enquiry Data

3.1 What we collect

When you submit an enquiry about a course, we collect:

• your name;

• your email address;

• your telephone number;

• the course or topic you are enquiring about;

• any additional information you choose to include in your message.

3.2 Why we collect it and our legal basis

We collect and use this data to respond to your enquiry and to take steps, at your request, prior to entering into a contract with you. Our legal basis is Article 6(1)(b) UK GDPR (processing necessary for the performance of a contract or to take steps prior to entering into a contract).

3.3 Sharing with affiliated training hubs

SHSUK Ltd operates a network of affiliated training hubs. These are independent trainers who deliver SHSUK courses in various locations. Where your enquiry relates to a course delivered by one of our affiliated training hubs, we will pass your name, email address and telephone number to the relevant hub trainer so that they can respond to your enquiry and assist with your booking.

Important: Affiliated training hubs are independent data controllers. Once your data has been passed to them, their use of that data is governed by their own privacy policy and they are responsible for their own compliance with data protection law. We are not responsible for how they use your data after it has been shared with them.

We will not pass your data to any affiliated hub without your prior agreement. By submitting an enquiry through our website and ticking the consent checkbox, you confirm that you have read and agree to this policy.

Legal basis for sharing: Article 6(1)(b) UK GDPR, as above. Passing your enquiry to the hub trainer who delivers the course you are interested in is necessary to take steps, at your request, towards a potential booking.

4. Student Data

4.1 What we collect

When you enrol on a course and throughout your time as a student, we may collect and hold:

• your name, address, email address and telephone number;

• your application form and any supporting information submitted;

• course enrolment records, including the course(s) enrolled on and dates;

• records of attendance and progress;

• assessment records and results;

• payment and financial records, including payment plans and transaction records;

• certificates and qualifications awarded;

• correspondence between you and SHSUK Ltd.

4.2 Why we collect it and our legal basis

We use student data for the following purposes:

• To fulfil our obligations under your enrolment contract — including delivering your course, recording your progress and issuing certificates. Legal basis: Article 6(1)(b) UK GDPR.

• To manage payment plans and financial records — including pursuing outstanding payments where necessary. Legal basis: Article 6(1)(b) UK GDPR.

• To maintain qualification records — we are required to keep records of qualifications awarded in order to verify these if requested in future. Legal basis: Article 6(1)(f) UK GDPR (legitimate interests — maintaining the integrity of our qualification records).

• To communicate with you about your course — including course updates, changes and logistics. Legal basis: Article 6(1)(b) UK GDPR.

4.3 Sharing student data

Where your course is delivered by one of our affiliated training hubs, we may share relevant course records with that hub trainer in order to coordinate the delivery of your training. Affiliated hub trainers are independent data controllers — see section 3.3 above. We do not sell or share your student data with any third party for marketing or commercial purposes.

5. Mailing List

If you sign up to our mailing list, we will use your email address and name to send you news, updates and information about our courses and events.

Legal basis: Article 6(1)(a) UK GDPR — your consent. You can withdraw your consent and unsubscribe at any time by clicking the unsubscribe link in any email we send you, or by emailing us at info@soundhealingschooluk.com.

Our mailing list is managed using Wix's built-in email marketing platform. Wix acts as a data processor on our behalf. You can view Wix's privacy policy at wix.com/about/privacy.

6. Payments

Payments on our website are processed through Wix Payments. When you make a payment, Wix Payments collects and processes your payment card details and transaction information. We do not store your full payment card details.

Legal basis: Article 6(1)(b) UK GDPR — processing necessary for the performance of a contract.

Wix Payments acts as a data processor on our behalf. You can view Wix's privacy policy at wix.com/about/privacy.

7. Cookies

We do not use tracking, analytics or marketing cookies on our website. Wix may set strictly necessary cookies to make the site function — for example, to keep you logged in or to process a payment. These are essential to the operation of the site and do not require your consent.

We do not currently use Google Analytics or any other analytics or advertising cookies. This will be reviewed as our website develops. If tracking or marketing cookies are added in future, we will update this policy and add a cookie consent notice to the site before doing so.

8. Our Data Processors

We use the following third-party services to operate our business. These providers act as data processors — they handle data on our behalf in accordance with our instructions and are bound by data processing agreements:

• Wix.com Ltd — website hosting, contact forms, email marketing and payment processing.

• Wix Payments — online payment processing.

We do not transfer your personal data outside the UK or the European Economic Area except where adequate safeguards are in place.

9. How Long We Keep Your Data

We keep personal data only for as long as is necessary for the purpose for which it was collected, or as required by law.

Enquiry data (where the enquiry does not lead to enrolment) We are currently reviewing our retention period for enquiry data. In the interim we retain this data and are working to establish a defined deletion schedule. This will be updated once our Data Retention Policy is in place.

Enquiry data (passed to an affiliated training hub) We retain a record that data was passed for 12 months. The hub trainer's retention of your data is governed by their own privacy policy.

Student enrolment and course records 6 years from the end of the student's last enrolment, in line with the Limitation Act 1980.

Qualification and certificate records Indefinitely, to enable verification of qualifications awarded.

Payment records 6 years from the date of the transaction, in line with HMRC requirements.

Mailing list data Until you unsubscribe, after which your email address is removed within 30 days.

10. Your Rights

Under UK GDPR, you have the following rights in relation to your personal data:

• Right of access — you can request a copy of the personal data we hold about you.

• Right to rectification — you can ask us to correct any inaccurate or incomplete data.

• Right to erasure — you can ask us to delete your data where we no longer have a lawful basis to hold it.

• Right to restrict processing — you can ask us to limit how we use your data in certain circumstances.

• Right to data portability — where our processing is based on your consent or on a contract with you, you can ask us to provide your data in a portable format.

• Right to object — you can object to our processing where it is based on legitimate interests.

• Right to withdraw consent — where we rely on your consent (for example, for our mailing list), you can withdraw it at any time without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, please contact us at info@soundhealingschooluk.com. We will respond within one calendar month.

If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

11. Changes to This Policy

We review this policy regularly and will update it when necessary. The version number and date at the top of this page will always reflect the current version. If we make significant changes that affect how we process your data, we will notify you by email where we hold your contact details.

12. Contact Us

If you have any questions about this policy or about how we handle your data, please contact us:

By email: info@soundhealingschooluk.com

By post: Grive House, 45 Walton Street, Walton on the Hill, Surrey, KT20 7RR