PRIVACY POLICY

Nurture & Harmony Ltd
Effective Date: 25/02/2026
Last Updated: 25/02/2026

Nurture & Harmony Ltd ("we", "us", "our") is committed to protecting your privacy and handling your personal data transparently and securely.

This Privacy Policy explains how we collect, use, store, and protect your personal data when you:

• Visit our website 
• Purchase physical or digital products 
• Join our membership programmes 
• Book spa or wellness services 
• Subscribe to our email communications
   

We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable UK data protection laws.

Company Name: Nurture & Harmony Ltd
Registered in: United Kingdom
Email: info@nurtureandharmony.com
Registered Address: Broxbournebury Mansion, White Stubbs Lane, Broxbourne, England EN10 7PY
Company Number: 14240088

For the purposes of data protection law, we are the Data Controller.

We may collect:

• Full name 
• Email address 
• Phone number 
• Billing and delivery address 
• Payment information (processed securely via third-party providers) 
• Account login details 
• Booking information 
• Health or wellness information relevant to spa treatments (where required) 
• Membership details 
• Communications sent to us
   

For spa and wellness services, we may collect limited health information (e.g., allergies, medical conditions, pregnancy status) to ensure treatments are safe and appropriate.

This data is processed:

• With your explicit consent 
• For health and safety purposes 
• In line with strict confidentiality obligations
   

We do not share health information except where legally required.

When you visit our website, we may collect:

• IP address 
• Browser type 
• Device information 
• Pages viewed 
• Time spent on pages 
• Cookie and tracking data
   

We use your data to:

• Process orders for physical products 
• Deliver digital downloads 
• Manage memberships 
• Process bookings 
• Provide spa and wellness services 
• Ensure treatment safety 
• Communicate about appointments 
• Send marketing emails (with your consent) 
• Improve our website and services 
• Prevent fraud 
• Comply with legal obligations
   

We rely on the following lawful bases:

• Contract – to fulfil orders, memberships, and bookings 
• Consent – for marketing emails and health information 
• Legal obligation – for accounting and regulatory compliance 
• Legitimate interests – improving services and website security
   

We may provide services to children under 18 only when accompanied by a parent or legal guardian.

We collect children’s personal data only:

• With parental or guardian consent 
• Where necessary for safe service delivery
   

Parents/guardians may request access to or deletion of their child’s data at any time.

All payments are processed securely via third-party payment providers. We do not store full card details.

Payment providers process your data in accordance with their own privacy policies and PCI-DSS security standards.

If you subscribe to our newsletter or marketing communications:

• You will only receive emails if you opt in 
• You can unsubscribe at any time via the link in our emails 
• We may use email marketing software to manage campaigns
   

We do not sell or rent your email address.

We use third-party booking software to manage appointments.

When you book a service, your information may be processed by that provider for scheduling and reminder purposes. These providers act as Data Processors and are contractually required to protect your data.

If you create a membership account:

• You are responsible for keeping login details confidential 
• We store account data securely 
• We retain account information while your membership remains active
   

Our website uses cookies to:

• Ensure website functionality 
• Analyse traffic 
• Improve user experience 
• Support marketing activities
   

You will be presented with a cookie banner where required.
You can manage cookie preferences via your browser settings.

We may share your data with:

• Payment processors 
• Booking software providers 
• Email marketing platforms 
• Website hosting providers 
• Accountants and professional advisers 
• Regulatory authorities (if legally required)
   

We do not sell personal data.

Some of our third-party providers may process data outside the UK.

Where this occurs, we ensure appropriate safeguards are in place, such as:

• UK International Data Transfer Agreements 
• Adequacy regulations 
• Standard contractual clauses
   

We retain personal data only as long as necessary for:

• Fulfilling contracts 
• Legal and tax obligations (typically 6 years for financial records) 
• Resolving disputes 
• Insurance requirements for treatment records
   

Health-related consultation forms may be retained in line with industry insurance requirements.

We implement appropriate security measures including:

• SSL encryption 
• Secure hosting 
• Password-protected systems 
• Restricted staff access 
• Secure storage of consultation records
   

You have the right to:

• Access your personal data 
• Correct inaccurate data 
• Request deletion 
• Restrict processing 
• Object to processing 
• Data portability 
• Withdraw consent 
• Lodge a complaint with the Information Commissioner’s Office (ICO)
   

ICO website: https://www.ico.org.uk

Before lodging a complaint, we encourage you to contact us so we can resolve your concern.

We may update this Privacy Policy from time to time. Updates will be posted on this page with a revised date.

Nurture & Harmony Ltd
Email: info@nurtureandharmony.com
Address: Broxbournebury Mansion, White Stubbs Lane, Broxbourne, England EN10 7PY

If you have questions about this Privacy Policy or your personal data, please contact us.