← Back to Homepage
Legal

Privacy Policy

Last Updated: 9 September 2026

This privacy notice explains how Tunbridge Wellness collects, uses, and protects your personal data when you use our directory, community platform, journal, and events initiative, including Tunbridge Wellness Afterdark.

1. Who We Are (The Data Controller)

For the purposes of the UK General Data Protection Regulation (UK GDPR), the Data Controller is [INSERT LUCY'S ENTITY NAME/SOLE TRADER NAME], operating as Tunbridge Wellness and Tunbridge Wellness Afterdark. You can contact us regarding your data at tunbridgewellness@gmail.com or by writing to [INSERT POSTAL ADDRESS].

2. What Information We Collect

We only collect data that is relevant and necessary for operating our platform and hosting community events. This includes:

  • Mandatory Account Data: Your name and email address when you create a Seeker or Practitioner account on our daytime directory. (Note: Browsing Afterdark and reading journal articles does not require an account).
  • Event Registrations & Ticket Data: Contact details (such as your name, email address, and ticket selections) collected when you register or purchase tickets for in-person events (such as Conscious Sessions or community circles). Full payment card transactions are processed directly and securely by our third-party ticketing and payment providers (including Ticket Tailor and Stripe); we never store your payment card numbers on our servers.
  • Dispatches & Newsletter Subscriptions: Your email address when you voluntarily subscribe to our daytime newsletter or The Night Dispatch.
  • Practitioner Inquiries & Collective Expressions of Interest: Details submitted when inquiring to list on the directory or join the Nocturnal Collective (including your name, email, modality/craft, location, and website or social links).
  • Seeker Demographics & Preferences: Optional data you choose to provide, such as age bracket, gender, session availability, and general wellness interests (e.g., Yoga, Meditation). We do not collect "Special Category" sensitive health data.
  • Practitioner Public Data: Information practitioners submit for their public directory listings, including business names, bios, service pricing, social media links, location, and self-declared qualifications.
  • Platform Usage: Records of saved events, venues, and practitioners, as well as explicit opt-ins for our confidential matchmaking service.
  • Technical & Session Data: Essential session tokens, IP addresses, and basic device information required to authenticate your account.

3. Our Lawful Basis for Processing

Under UK GDPR, we process your data under the following legal bases:

  • Contractual Necessity: To fulfill event ticket reservations, manage attendee guestlists, create directory accounts, and provide core services.
  • Consent: For sending marketing dispatches, newsletters, and facilitating our manual matchmaking service based on your explicit opt-ins. You may withdraw this consent at any time.
  • Legitimate Interests: To maintain platform security, organize safe in-person events, prevent fraud, and analyse basic site usage to improve our offerings.
  • Legal Obligation: To maintain necessary financial and accounting records for ticket sales and practitioner subscriptions.

4. How We Handle Matchmaking

We do not use automated decision-making or algorithmic profiling. If a Seeker opts-in to matchmaking, our administrative team manually reviews their stated wellness interests and may confidentially introduce them to relevant local practitioners via email.

5. Third-Party Data Processors

We use secure, industry-standard third-party providers who process data under strict agreements: Some of these processors (such as Google and Stripe) may transfer and store your data on servers outside of the UK. Where this occurs, we ensure your data is protected by relying on UK government-approved Standard Contractual Clauses or equivalent adequacy decisions.

  • Ticket Tailor: For processing event ticket reservations, admissions, and attendee guestlists for Conscious Sessions and gatherings.
  • Google Firebase: For secure database hosting, account authentication, and storing public profile images.
  • Substack: For managing our newsletter distribution.
  • Formspree, Tally.so & Web3Forms: For capturing newsletter signups, application forms, and site inquiries.
  • Stripe: For securely processing payments. We never store full payment card details on our servers.
  • Netlify: For website hosting and secure server operations.

6. Data Retention

We retain your personal data only for as long as your account is active. If you request account deletion, we will remove your personal data from our active databases within 30 days, subject to any legal requirements to retain financial or compliance records.

7. Your Data Rights

Under UK GDPR, you have the right to access, rectify, or request the erasure of your personal data. You may also object to processing, request data portability, or withdraw consent at any time. To exercise these rights, please email us at tunbridgewellness@gmail.com.

If you believe we have not handled your data appropriately, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, or via their website: ico.org.uk.

8. Age Restrictions

Tunbridge Wellness is designed and intended strictly for adults. We do not knowingly collect personal data from anyone under the age of 18. If we become aware that we have inadvertently collected personal data from a minor, we will take immediate steps to delete that information from our servers.