Privacy Policy -

Academy

Privacy Policy

Effective Date: 12 August 2026
Data Controller: Kimberley Stapleton trading as Mind Body Soul Academy
Business Address: Skye, Etna Street, Mellieħa, Malta
Contact Email: support@mindbodysoulacademy.org
Website: www.mindbodysoulacademy.org

Mind Body Soul Academy respects your privacy and is committed to handling personal information responsibly and transparently.

This Privacy Policy explains how we collect, use, store and share personal data when you visit our website, purchase digital products or services, create an account, join a mailing list, complete a form, participate in training or membership programmes, or work with us through private sessions or related services.

We process personal data in accordance with the EU General Data Protection Regulation (GDPR), the Malta Data Protection Act (Chapter 586) and other applicable data-protection and electronic-communications legislation.

1. Who Is Responsible for Your Data?

For the purposes of data-protection law, the data controller is:

Kimberley Stapleton trading as Mind Body Soul Academy
Skye, Etna Street
Mellieħa, Malta

Email: support@mindbodysoulacademy.org

This means that we determine why and how personal information collected through Mind Body Soul Academy is processed.

2. Information We May Collect

The information we collect depends upon how you interact with Mind Body Soul Academy.

Identity and Contact Information

This may include:

your name;
email address;
postal or billing address;
telephone number where voluntarily supplied; and
account or profile information.

Purchase and Transaction Information

This may include:

products or services purchased;
order history;
subscription information;
billing information;
transaction status;
refunds or payment disputes; and
invoices and accounting records.

Payment-card details are processed by our payment providers. We do not normally receive or store your complete card number or security code.

Website and Account Information

Depending upon the Services you use, this may include:

account details;
course or programme participation;
downloads and product access;
form submissions;
membership activity; and
customer-support communications.

Email and Communication Information

When you receive emails from us, we may process information such as:

email delivery status;
subscription preferences;
unsubscribes;
and, where enabled, email opens or link clicks.

This information helps us operate transactional communications, maintain mailing preferences and understand engagement with our communications.

Private Session and Intake Information

If you choose to work with us privately, you may voluntarily provide information through intake forms, questionnaires, correspondence or sessions.

Depending upon the nature of the service, this may include information about:

personal circumstances;
wellbeing;
emotional or somatic experiences;
goals or concerns;
session notes; and
other information that you choose to disclose.

Some of this information may constitute special-category personal data, including health-related information, under Article 9 GDPR.

Where special-category information is processed, we will only do so where an appropriate lawful condition under Article 9 GDPR applies, which may include your explicit consent where appropriate.

Please only provide information that is reasonably relevant to the service you are requesting.

Technical Information

When you use our website, our website systems and service providers may automatically process technical information such as:

IP address;
browser and device type;
operating system;
pages visited;
referring website;
approximate location derived from technical information;
date and time of visits; and
security or anti-spam information.

We do not intentionally collect precise GPS location information through the ordinary use of the Mind Body Soul Academy website.

3. How We Collect Information

We may collect information:

directly from you when you make a purchase, create an account or contact us;
through forms completed using Fluent Forms;
through purchases and account activity using SureCart;
through our FluentCRM customer and email-management system;
when you voluntarily subscribe to practitioner updates or other newsletters;
through private-session intake forms and communications;
through website cookies and technical logs; and
through security and anti-spam tools such as Cloudflare Turnstile.

Cloudflare provides a separate privacy framework for data processed through Turnstile and its services.

4. Why We Use Your Personal Information

Under the GDPR, personal information must have a lawful basis for processing.

Depending upon the circumstances, we rely upon the following bases.

Performance of a Contract

We process information where necessary to:

process an order;
provide a digital download;
give you access to a customer account;
provide a course, membership or training programme;
manage a subscription;
provide a booked session or service; or
respond to matters directly connected with your purchase.

Consent

We rely upon consent where appropriate, including for:

marketing newsletters and practitioner updates;
certain non-essential cookies or tracking technologies; and
special-category information where explicit consent is the appropriate Article 9 basis.

You may withdraw consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

Legitimate Interests

Where appropriate, we may process information for legitimate business interests such as:

protecting the website and customer accounts;
preventing fraud and misuse;
responding to customer enquiries;
maintaining business records;
improving our services;
administering our website; and
establishing, exercising or defending legal claims.

Where we rely upon legitimate interests, we consider those interests against the privacy rights and reasonable expectations of the individual concerned.

Legal Obligations

We may process and retain information where necessary to comply with obligations relating to:

taxation;
accounting;
financial records;
consumer law;
regulatory obligations; or
lawful requests from public authorities.

5. Transactional Emails and Marketing Emails

We distinguish between transactional/service communications and marketing communications.

Transactional Communications

If you purchase from us or create an account, we may send emails necessary to administer that relationship, including:

order confirmations;
payment information;
account-access information;
digital-download information;
password or security communications;
subscription administration; and
important service-related information.

These communications are not dependent upon subscribing to our marketing newsletter.

Marketing Communications

We will only add you to Mind Body Soul Academy marketing or practitioner-update lists where we have an appropriate lawful basis.

Our current signup process allows you to actively choose whether you would like to receive marketing communications.

Purchasing a product does not automatically subscribe you to marketing emails.

You may unsubscribe at any time using the unsubscribe link contained in marketing emails or by contacting:

support@mindbodysoulacademy.org

Individuals have the right to object to processing of their personal information for direct marketing.

6. Cookies and Similar Technologies

Our website may use cookies and similar technologies necessary for functions such as:

website security;
account sessions;
checkout operation;
customer preferences;
form security; and
website functionality.

We may also use optional analytics, marketing or similar technologies where these are enabled.

Where consent is legally required for non-essential cookies or similar technologies, these will not be activated until the required consent has been obtained.

Further information may be provided through our cookie notice or cookie-preference controls.

7. How We Use FluentCRM, Fluent Forms and MailerSend

FluentCRM and Fluent Forms operate within our WordPress environment and are used to manage customer information, forms, audience lists, tags, communication preferences and certain email automations.

MailerSend provides email-delivery infrastructure used to send transactional and other authorised emails.

MailerSend acts as a data processor in relation to customer data processed on our behalf under its Data Processing Addendum.

Where enabled, email systems may record delivery, opens, clicks, bounces and unsubscribe activity.

8. Payments and E-Commerce

Our website uses SureCart to administer online purchases and digital-product access.

Payments may be processed by authorised third-party payment providers, such as Stripe, or another payment method displayed at checkout.

Payment providers may independently process information required to:

authorise transactions;
prevent fraud;
comply with financial regulations;
handle refunds;
deal with payment disputes; and
meet legal obligations.

Stripe’s current privacy documentation explains that it processes personal data for payments, fraud prevention and related financial services and provides mechanisms for international data transfers where applicable.

We do not normally receive or store your complete payment-card credentials.

9. Canva Resources

Certain Mind Body Soul Academy products may provide access to editable resources hosted through Canva.

When you follow a Canva template link or use Canva’s platform, Canva may process information independently in accordance with its own privacy policy and account settings.

Canva states that information may be processed internationally and describes the safeguards it uses for international transfers.

We recommend reviewing Canva’s own privacy settings where you choose to use its services.

10. Who We May Share Information With

We do not sell your personal information to third parties.

We may disclose information where reasonably necessary to trusted service providers involved in operating Mind Body Soul Academy, including:

website hosting and technical providers;
e-commerce providers;
payment processors;
email-delivery providers;
CRM and form systems;
security and fraud-prevention providers;
accountants and professional advisers; and
authorities where disclosure is required by law.

We only share information that is reasonably necessary for the relevant purpose.

Where a provider processes personal data on our behalf, appropriate contractual and data-protection arrangements are used where required.

11. International Data Transfers

Some technology providers used by Mind Body Soul Academy operate in multiple countries.

As a result, personal information may occasionally be processed outside Malta or the European Economic Area.

Where GDPR-protected data is transferred to a country outside the EEA, we use or rely upon an appropriate lawful transfer mechanism where required, which may include:

a European Commission adequacy decision;
Standard Contractual Clauses;
an applicable Data Privacy Framework mechanism; or
another lawful safeguard recognised by data-protection legislation.

The GDPR contains specific safeguards governing transfers of personal data outside the EEA.

12. How Long We Keep Personal Information

We do not aim to retain personal data indefinitely.

Information is kept only for as long as reasonably necessary for the purpose for which it was collected and to meet applicable legal, accounting, contractual, professional or dispute-resolution requirements.

For example:

purchase, invoice and financial information may be retained for the period required by applicable Maltese tax and accounting obligations;
customer-account information may be retained while the account or purchased access remains relevant;
marketing information is retained until you unsubscribe or until it is no longer reasonably required;
support correspondence may be retained for a reasonable period after the matter has been resolved; and
private-session or intake records will be retained only for an appropriate period taking account of the nature of the service, legal obligations, professional requirements and the sensitivity of the information.

When information is no longer required, it will be deleted, anonymised or securely disposed of where reasonably practicable.

13. Data Security

We take reasonable technical and organisational measures designed to protect personal information against:

unauthorised access;
accidental loss;
misuse;
alteration; and
inappropriate disclosure.

Measures may include access controls, secure passwords, HTTPS/TLS website connections, security tools, backups and the use of specialist payment providers rather than storing full card credentials ourselves.

No internet or electronic-storage system can be guaranteed to be completely secure, and we therefore cannot promise absolute security.

14. Your Data-Protection Rights

Subject to the GDPR and any applicable exemptions, you may have the right to:

Access personal information we hold about you;
Rectify inaccurate or incomplete information;
Erase personal information in appropriate circumstances;
Restrict processing in certain circumstances;
Object to certain processing;
Withdraw consent where processing relies upon consent;
Data portability in circumstances where that right applies; and
object to direct marketing at any time.

These rights arise under the GDPR and are subject to the conditions and exceptions set out in that legislation.

To exercise a privacy right, contact:

support@mindbodysoulacademy.org

We may need to take reasonable steps to verify your identity before completing a request.

We will respond within the timeframe required by applicable data-protection law.

15. Complaints

If you have a concern about how we process your information, we encourage you to contact us first so that we can try to resolve the issue.

You also have the right to lodge a complaint with Malta’s supervisory authority:

Information and Data Protection Commissioner (IDPC), Malta

The IDPC confirms that individuals may lodge a complaint where they believe their data-protection rights have been infringed.

You may also have the right to complain to another competent EU supervisory authority where applicable.

16. Automated Decision-Making

Mind Body Soul Academy does not currently use personal information to make solely automated decisions that produce legal effects, or similarly significant effects, about individuals.

If this changes, this Privacy Policy will be updated and any additional disclosures required by law will be provided.

17. Children’s Privacy

Mind Body Soul Academy’s general products and services are intended for adults.

We do not knowingly collect personal information from children through our general shop, practitioner resources or mailing lists.

If we offer a service specifically intended for younger participants in the future, appropriate privacy information and consent arrangements will be provided.

18. Third-Party Websites

Our website and resources may contain links to third-party websites and services.

We are not responsible for the privacy practices of independent third-party websites. We recommend reviewing their privacy information before submitting personal information to them.