Privacy Policy

lydiahillcoaching.com · Lydia Hill

1. Controller and contact

1.1The controller responsible for the processing of personal data on this website is PranaSomatics SL, Ur. Eagles Village, 6 1 Pta. 6, Edif. El Nogal, La Quinta Golf, 29679 Benahavís (Málaga), Spain, CIF B88979703, email mail@pranasomatics.com, phone/WhatsApp +34 627 937 513 ("we").

1.2We are the controller for all of our websites (pranasomatics.com, kaihill.de, lydiahillcoaching.com and hillyoga.de). Each website has its own policy that describes the tools used there.

1.3We have not appointed a Data Protection Officer, because the law does not require it for our activities (Art. 37 GDPR, Art. 34 LOPDGDD). For any question about your data or to exercise your rights, write to mail@pranasomatics.com.

1.4This policy is based on Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD) and Law 34/2002 (LSSI-CE). It applies to this website and to the services offered through it. Personal data are any data relating to an identified or identifiable person.

2. Overview: purposes, data and legal bases

• Operating the website and keeping it secure (server logs): IP address, technical data. Legal basis: legitimate interest, Art. 6(1)(f) GDPR.
• Cookies and similar technologies that are not strictly necessary (analytics, marketing, embedded external content): consent, Art. 6(1)(a) GDPR and Art. 22(2) LSSI-CE.
• Answering your enquiries and booking calls: contact data, message. Legal basis: pre-contractual measures at your request or legitimate interest, Art. 6(1)(b) and (f) GDPR.
• Advertising measurement and audiences on Facebook and Instagram (Meta Pixel; IP address, device data, page and event data, cookie identifiers): consent, Art. 6(1)(a) GDPR and Art. 22(2) LSSI-CE, with Meta as joint controller (Art. 26 GDPR), see section 6.
• Newsletter and free resources: email address, name, sign-up and confirmation data, interaction with emails. Legal basis: consent, Art. 6(1)(a) GDPR and Art. 21 LSSI-CE.
• Contract, payment, invoicing and accounting: identification, contact, billing and payment data. Legal basis: performance of a contract, Art. 6(1)(b) GDPR, and legal obligations, Art. 6(1)(c) GDPR (tax and commercial law).
• Delivery of courses, sessions and training (accounts, progress, attendance, certification): Art. 6(1)(b) GDPR.
• Information about health that you give us so that we can work with you safely: special category data, only with your explicit consent, Art. 9(2)(a) GDPR.
• Defence of legal claims and prevention of fraud and abuse: Art. 6(1)(f) GDPR, and Art. 9(2)(f) GDPR where special-category data are concerned.
• Direct marketing to our existing customers for similar services of our own: Art. 6(1)(f) GDPR and Art. 21(2) LSSI-CE; you can object at any time.

3. Hosting and server log files (Squarespace)

3.1This website is hosted by Squarespace Ireland Limited, Le Pole House, Ship Street Great, Dublin 8, Ireland, which works with its group company Squarespace, Inc., USA. Each time you visit, Squarespace processes technical data in server log files: IP address, browser type and version, operating system, referrer URL, the pages you open, and date and time of access. We need these data to deliver the website, to ensure its stability and to detect and defend against attacks. Legal basis: our legitimate interest in a secure and working website (Art. 6(1)(f) GDPR). Squarespace processes these data on our behalf under a data processing agreement. Log data are deleted or anonymised after a short period set by Squarespace.

3.2The Squarespace website builder also stores data that are necessary for forms, the shopping cart and checkout and, where used, member areas. Where you submit a form on this website, the content is stored with Squarespace and forwarded to us by email.

4. Cookies and consent

4.1We use strictly necessary cookies without consent (Art. 22(2) LSSI-CE). All other cookies and embedded third-party content that stores information on your device or sends your data to the provider are used only after you have consented in our cookie banner (Art. 6(1)(a) GDPR). You can accept all, reject all, or choose by category. Rejecting is as easy as accepting. You can change or withdraw your choice at any time using "Cookie settings" in the footer, with effect for the future. Withdrawal does not affect the lawfulness of processing carried out before. We ask for your choice again after at most 24 months.

4.2Details on cookies, providers and durations are in our Cookie Policy (lydiahillcoaching.com/cookies).

5. Website statistics (Squarespace Analytics)

5.1If you consent, we use the analytics built into Squarespace to understand in aggregate how the website is used: pages visited, traffic sources, device type and approximate location. Squarespace sets analytics cookies for this purpose. We do not use the results to identify you. Legal basis: your consent (Art. 6(1)(a) GDPR).

6. Meta Pixel (Facebook / Instagram advertising measurement)

6.1Provider and consent. This website uses the Meta Pixel (pixel ID 811681580597305) of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland ("Meta"). The pixel is part of the marketing category of our cookie banner. It is loaded only after you have clicked "Accept all" or switched on the marketing category under "Manage cookies". Before that moment, and for as long as you reject marketing cookies or have not made a choice, the pixel script is not loaded and no data are sent to Meta through it. If you give your consent later during your visit, the pixel starts at that moment, without a reload of the page.

6.2Data and events. When the pixel is active, your browser transmits data to Meta: your IP address, browser and device data (for example browser type, language, screen and operating system), the address of the page you visit and the referring page, the time of the visit, identifiers stored in the cookies _fbp and, after a click on one of our Meta ads, _fbc, and events such as page views, clicks on buttons or booking links, the booking of a free info session through Calendly (event "Schedule"), the sign-up for a free resource (event "Lead") and, where applicable, the start of a checkout. Meta can match these data with your Facebook or Instagram account if you are logged in to it in the same browser.

6.3Purposes. We use the pixel for ad measurement and audiences: to measure how well our advertising on Facebook and Instagram performs (for example how many visitors book a call or buy after seeing an advertisement), to build audiences of people who visited our pages, and to show our advertising to those people and to people with a similar profile on Facebook and Instagram. We do not use the pixel to identify you by name, and we receive reports from Meta in aggregated form.

6.4Joint controllership (Art. 26 GDPR). We and Meta Ireland are joint controllers for the collection of the data by the pixel on this website and for their transmission to Meta (Art. 26 GDPR; judgment of the CJEU of 29 July 2019, C-40/17, Fashion ID). The arrangement is Meta's Controller Addendum, which forms part of the Meta Business Tools Terms we accepted and is published at https://www.facebook.com/legal/controller_addendum. We are responsible for informing you in this policy and for obtaining your consent in the cookie banner (the legal basis for the collection and transmission). Meta is responsible for the security of the joint processing and for requests concerning the data that Meta holds, as set out in the Controller Addendum. For the processing that Meta carries out after the transmission, for example to operate and improve its own products, Meta is the controller under Meta's Privacy Policy (https://www.facebook.com/privacy/policy/). You can exercise your rights against either of us; if you write to us at mail@pranasomatics.com, we will pass your request on to Meta where it concerns data that only Meta holds.

6.5Transfers to the USA. Meta may transfer the data to the USA and other countries. Meta Platforms, Inc. is certified under the EU-US Data Privacy Framework, so that the transfer is covered by the adequacy decision of the European Commission of 10 July 2023 (Art. 45 GDPR). Where a transfer does not fall under that decision, Meta relies on Standard Contractual Clauses (Art. 46 GDPR).

6.6Cookies and durations. The pixel uses the following identifiers: _fbp, a first-party cookie on our domain that recognises your browser on our website, with a duration of 90 days that Meta renews when you visit again; _fbc, a first-party cookie that stores the click identifier of a Meta ad that brought you to our website, with a duration of 90 days, set only after such a click; and fr, a cookie of Meta on facebook.com that Meta uses to deliver advertising and measure its relevance, with a duration of up to 3 months (90 days), which can be read when the pixel sends data to Meta. More details are in our Cookie Policy (lydiahillcoaching.com/cookies).

6.7Calendly. The booking page of Calendly (see section 9) may also use the Meta Pixel to measure booking conversions, for example the visit of the booking page, the choice of a date and time and the confirmation of a booked call. This happens only after you have consented to marketing cookies. The embedded booking widget on our pages is loaded only after your consent, and on Calendly's own booking page Calendly's cookie settings apply as well. The same Meta arrangement, purposes and transfers described in this section apply to these booking events.

6.8Legal basis and withdrawal. Legal basis: your consent (Art. 6(1)(a) GDPR; Art. 22(2) LSSI-CE; for visitors in Germany also § 25(1) TDDDG). You can withdraw your consent at any time with effect for the future under "Cookie settings" in the footer. After withdrawal, the pixel sends no further data and we remove its cookies on our domain where the browser allows it. Withdrawal does not affect the lawfulness of the processing before. You can also adjust the advertising settings of your Meta account (https://www.facebook.com/settings?tab=ads). Data collected through the pixel are kept by us in aggregated form; Meta's retention is governed by Meta's own policy.

7. Contact by email, form or WhatsApp

7.1If you contact us by email, through the contact form or by WhatsApp, we process your name, contact data and the content of your message to answer you and, where applicable, to prepare or perform a contract (Art. 6(1)(b) or (f) GDPR). We delete the data once the matter is closed, unless the law requires us to keep them (for example invoices). Email is handled through our email provider as processor.

7.2WhatsApp is provided by WhatsApp Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland. WhatsApp processes your phone number, profile and communication metadata under its own terms; the content of messages is end-to-end encrypted. Please do not send detailed health information by WhatsApp or email; if you need to share it, we will agree a suitable way with you.

7.3The contact form is protected against spam and misuse by technical measures of Squarespace; where it uses a captcha service, the service analyses your interaction with the form (Art. 6(1)(f) GDPR).

8. Newsletter and free resources (Kit)

8.1If you sign up for our newsletter or request a free resource, we send you emails with practices, invitations, information on our offers and updates. The emails are sent using Kit (Kit / ConvertKit LLC, USA), our email service provider and processor. We use double opt-in: you are subscribed only after you click the confirmation link in the email we send you. We store your email address, name (if given), the tags and lists that apply to you, the time of sign-up and confirmation, and the IP address used, in order to prove your consent. Kit records whether you open emails and click links so that we can understand what is useful. The same Kit account is used for several of our websites; your subscription is tagged with the website where you signed up.

8.2Legal basis: your consent (Art. 6(1)(a) GDPR; Art. 21 LSSI-CE). You can unsubscribe at any time using the link in every email or by writing to us. After you unsubscribe, we keep your address on a suppression list so that you receive nothing more (Art. 6(1)(f) GDPR). If you have bought from us, we may email you about similar offers of our own until you object (Art. 21(2) LSSI-CE).

8.3The signup form is embedded from Kit. Where Kit loads scripts or sets cookies for the form, it does so according to your cookie choice; if you prefer not to use the form, you can sign up by writing to us.

9. Booking calls and appointments (Calendly)

9.1Calls, info sessions and appointments are booked through Calendly (Calendly LLC, 115 E Main St, Ste A1B, Buford, GA 30518, USA). Calendly processes your name, email address, the chosen time, time zone, your answers in the booking form and technical data. We use them to confirm and manage the appointment (Art. 6(1)(b) GDPR). Calendly sends you confirmation and reminder emails and may add the appointment to our calendar. The Calendly widget embedded on our pages is loaded only with your consent; without consent you can open Calendly by following the direct link, in which case Calendly's own policy applies. Please do not enter health details in booking forms. If you have consented to marketing cookies, the booking page may also use our Meta Pixel to measure booking conversions (see section 6).

10. Online sessions and info sessions (Zoom)

10.1Online sessions, info sessions and live training take place on Zoom (Zoom Communications, Inc., 55 Almaden Blvd, San Jose, CA 95113, USA; for users in the EU, Zoom Video Communications also acts through its Irish and European group companies). Zoom processes your name, email address, IP address, device and connection data, and your image and voice if you switch them on. Other participants see your name and, if switched on, your camera image. Legal basis: performance of the contract or pre-contractual measures (Art. 6(1)(b) GDPR). If you attend a free info session, we process your data to run the session you registered for.

10.2Recordings. One-to-one and couples sessions are not recorded unless we agree this in writing in advance. Live group sessions, if any, are handled as described in the Terms.

10.3Other participants must not record sessions (see the Terms).

11. On-demand courses and library (Thinkific)

11.1Our on-demand courses and libraries are delivered on Thinkific (Thinkific Labs Inc., Vancouver, Canada; our school also appears as "Hill Campus"). Thinkific processes your name, email, login data, learning progress, quiz and discussion contributions and technical data so that we can provide your course (Art. 6(1)(b) GDPR). The European Commission has recognised Canada as providing adequate protection for commercial organisations; Thinkific may use sub-processors in the USA and elsewhere, under standard contractual clauses or the Data Privacy Framework. After a purchase through Stripe, your name and email address are passed on to Thinkific, and a student account is created or updated for you.

12. Embedded videos (YouTube)

12.1We embed videos from YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (group company Google LLC, USA), using the privacy-enhanced mode (youtube-nocookie.com) where possible. The videos are loaded only after you consent or click the video preview. When a video plays, Google receives your IP address, the address of the page, device and browser data and can set cookies and link the data to your Google account if you are logged in. Legal basis: your consent (Art. 6(1)(a) GDPR; Art. 22(2) LSSI-CE). You can withdraw it at any time under "Cookie settings".

13. Audio (Spotify) and audio files

13.1Some pages embed audio players from Spotify (Spotify AB, Regeringsgatan 19, 111 53 Stockholm, Sweden) or play audio files hosted by our course platform. The Spotify player is loaded only after your consent; Spotify then receives your IP address and technical data and may set cookies (Art. 6(1)(a) GDPR).

14. Payments (Stripe) and invoicing

14.1Payments are processed by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (group company Stripe, Inc., USA). Stripe processes your name, email address, billing address, payment method and transaction data; for instalment plans it also stores a recurring payment authorisation. We do not receive your full card details. Stripe is partly an independent controller (for example for fraud prevention and its legal duties) and partly our processor; see Stripe's privacy policy at stripe.com/privacy. When you tick the terms box at checkout, Stripe stores your acceptance (including time) as proof for us. Legal basis: Art. 6(1)(b) and (c) GDPR. We keep invoices and accounting records for 6 years (Art. 30 Spanish Commercial Code) and tax-relevant data for at least 4 years (Art. 66 General Tax Law). If you buy a course, your name and email are passed to our course platform so that we can give you access.

15. Sessions, coaching and health information

15.1For one-to-one, couples and young-person sessions, and for coaching, we process your contact, appointment and payment data and the notes we make about our sessions (Art. 6(1)(b) GDPR). Sessions often involve information about physical and mental health, trauma and relationships. Information about health is special-category data (Art. 9 GDPR). We process it only with your explicit consent, which we ask for in an intake form before the first session (Art. 9(2)(a) GDPR). You can withdraw your consent at any time with effect for the future; we may then be unable to continue the work. Nobody is obliged to give health data; but without information about relevant conditions we may not be able to work with you safely.

15.2Everything you share is confidential. We disclose information only with your consent, where the law requires it, or where it is necessary to protect someone's life or physical integrity (Art. 9(2)(c) GDPR). In couples sessions, what you say in front of your partner is known to both of you; information shared separately is handled as agreed at the start.

15.3Online sessions take place on Zoom (see above) and are not recorded unless we agree this in writing in advance. Session notes and health information are kept for up to 5 years after the last session and then securely deleted, unless you ask for earlier deletion and no legal duty to keep them applies. Persons under 14 need the consent of a parent or guardian for the processing of their data (Art. 7 LOPDGDD). For all clients under 18, a parent or guardian concludes the contract; what a young person says in sessions stays confidential, and parents are informed only as agreed with the young person, unless safety is at risk.

15.4WhatsApp support between sessions is optional; WhatsApp/Meta processes those messages. Please keep them short and practical and do not send detailed health information.

16. Testimonials and photos

16.1We publish testimonials, names, photos and quotations only with your written consent (Art. 6(1)(a) GDPR; if they contain health information, explicit consent under Art. 9(2)(a) GDPR). You can withdraw consent at any time; we will then remove the testimonial from our website, newsletters and materials under our control, though we cannot remove copies already shared by third parties.

17. Social media profiles and links

17.1We run profiles on Instagram and Facebook (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland). Apart from the Meta Pixel described in section 6, which runs only after your consent, our website only links to them and the links send no data to Meta until you click. If you visit our profiles or interact with them, Meta processes your data under its own terms, and for the page statistics (Page Insights) that Meta gives us, we are joint controllers with Meta (Art. 26 GDPR): https://www.facebook.com/legal/terms/page_controller_addendum. Please also see Meta's own privacy policy and your settings there.

18. Recipients and international transfers

18.1We share personal data only with the providers named in this policy, which act as our processors under data processing agreements (Art. 28 GDPR) or, where stated, as independent controllers, with our tax adviser and accountant, our email and IT service providers, professional advisers and insurers where needed, and with authorities, courts and other bodies where the law requires it.

18.2Some providers process data outside the European Economic Area, in particular in the USA and Canada. Such transfers are based on the EU-US Data Privacy Framework where the recipient is certified under it (adequacy decision of the European Commission of 10 July 2023), on the adequacy decision for Canada (commercial organisations) or, otherwise, on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) with additional measures where necessary. You can request a copy of the safeguards by writing to us.

18.3We do not sell your data.

19. How long we keep data

19.1We delete data once the purpose has ended. Where we are legally required to keep data, they are blocked and deleted when the retention period ends (Art. 32 LOPDGDD). In particular:

• server log data: short period set by Squarespace;
• enquiries: up to 12 months after the matter is closed;
• newsletter data: until you unsubscribe, then only the suppression entry;
• contract, payment and invoice data: 6 years from the end of the financial year (commercial and tax law), and longer where tax law requires;
• course accounts and learning data: for the duration of your access and then, as far as needed to prove the performance of the contract, for the limitation period;
• session notes and health data: up to 5 years after the last session, or earlier on request;
• consent records (for example opt-in, cookie and Stripe acceptance records): for as long as the consent is relied on and then for the limitation period to defend claims;
• data needed to defend or exercise legal claims: until the claim is time-barred.

20. Your rights

20.1You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object (Art. 21), at any time, free of charge. Where processing is based on legitimate interest or direct marketing, you can object at any time. Where processing is based on your consent, you can withdraw it at any time with effect for the future (Art. 7(3) GDPR). To exercise your rights, write to mail@pranasomatics.com. We may ask you to prove your identity. We answer within one month.

20.2Complaints. You have the right to lodge a complaint with a supervisory authority. The competent authority for us is the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, Spain, www.aepd.es (electronic office: sedeagpd.gob.es). You may also complain to the supervisory authority of your country of residence, place of work or the place of the alleged infringement.

21. Obligation to provide data, automated decisions, minors, security, changes

21.1Providing personal data is voluntary, but we cannot deliver a booked service, a newsletter or a booking without the data that are marked as required, or without the data needed for payment and invoicing.

21.2We do not use automated decision-making or profiling that has legal effects on you or similarly affects you (Art. 22 GDPR).

21.3Our offers are for adults, unless stated otherwise. We do not knowingly process data of persons under 14 without the consent of a parent or guardian (Art. 7 LOPDGDD). If you think that a child has given us data, please write to us and we will delete them.

21.4The website uses TLS encryption. We apply appropriate technical and organisational measures to protect personal data (Art. 32 GDPR), including access control, processor agreements and, for health information, restricted access. We keep a record of processing activities (Art. 30 GDPR). In the event of a data breach, we notify the AEPD and affected persons as the law requires.

21.5We update this policy when our services, the tools we use or the law change. The version on this page is current.

Last updated: 29 October 2026