Privacy Policy

Effective Date: 14 August 2025
Last Updated: 9 May 2026

Enchanted Life Ltd, trading as Enchanted Life by Maia, is committed to protecting your personal data. This Privacy Policy explains how we collect, use, disclose, store, and safeguard your information in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018, and applicable UK data protection law.

This Privacy Policy applies when you use our website, contact us, join our mailing list, book a service, attend an event, purchase a physical product, join a programme, complete a form, or otherwise interact with Enchanted Life by Maia.

1. Data controller and contact details

Data Controller: Enchanted Life Ltd, trading as Enchanted Life by Maia
Company number: 16407256
Registered office: 82a James Carter Road, Mildenhall, England, IP28 7DE
Email for privacy queries: [email protected]
Website: https://enchantedlifebymaia.com

For any questions about this Privacy Policy or how we handle your personal data, please contact us at [email protected].

2. Personal data we collect

We may collect and process the following categories of personal data, depending on how you interact with us.

Identity and contact data

This may include your name, email address, phone number, billing address, delivery address, and social media handle where relevant.

Booking, event, and service data

This may include appointment details, event bookings, attendance information, preferences, intake forms, consultation forms, questionnaire responses, programme participation, and information you share before, during, or after a session, ceremony, event, or mentorship container.

Session and consultation data

Where you book a consultation, attunement, mentorship, ceremony, or other spiritual or embodiment-based service, we may keep notes to support continuity of service, integration, safeguarding, and responsible client care.

These notes may include information you voluntarily share about your emotional wellbeing, physical health, nervous system, spiritual beliefs, life experiences, trauma history, relationships, personal circumstances, or goals.

Some of this may be classed as special category data under UK GDPR where it relates to health, religious or philosophical beliefs, sex life, sexual orientation, or other protected categories. We only process this type of information where you choose to share it and where we have a lawful basis and a special category condition to do so.

Product order and delivery data

If you purchase a physical product, such as Shakti Goddess Hair Serum, we may collect your name, email address, delivery address, billing details, order details, delivery status, customer service messages, return requests, and product feedback.

Transaction and payment data

This may include purchase history, order value, invoice details, payment status, refund records, and limited payment metadata.

Card payments are processed securely by third-party payment processors. We do not store your full card details.

Technical and usage data

When you use our website, we may collect technical information such as your IP address, browser type, device type, operating system, pages visited, time spent on the site, referral source, and website interaction data.

This may be collected through cookies, similar technologies, or built-in analytics tools provided by our website and CRM platform.

Marketing and communications data

This may include your email preferences, marketing consent status, mailing list sign-ups, unsubscribe records, email engagement, contact-form messages, replies, customer support messages, CRM messages, and messages exchanged with us through platforms such as WhatsApp where you choose to contact us there.

3. How we collect your data

We collect personal data in the following ways:

directly from you when you complete forms, book services, join events, purchase products, subscribe to emails, or contact us

through our website and CRM platform, Content Creator Machine

through Eventbrite when you book or register for events hosted through Eventbrite

through Stripe when you make payments

through cookies, similar technologies, and website analytics

through messages, emails, WhatsApp, social media, or other communication channels when you choose to contact us

during consultations, mentorship, ceremonies, workshops, programmes, or customer support interactions

4. How and why we use your data

We use your personal data only where we have a lawful basis to do so.

PurposePersonal data usedLawful basisTo respond to enquiriesIdentity, contact, communications dataLegitimate interests or steps before entering into a contractTo book and deliver consultations, sessions, mentorship, ceremonies, events, and programmesIdentity, contact, booking, service, session, and communications dataContract; legitimate interests; explicit consent where special category data is sharedTo process product orders and deliver physical productsIdentity, contact, product order, delivery, transaction dataContract; legal obligation where records must be keptTo manage event bookings and attendanceIdentity, contact, booking, event, payment, communications dataContract; legitimate interestsTo process payments, invoices, refunds, and accounting recordsIdentity, transaction, payment, invoice, order dataContract; legal obligationTo send booking confirmations, reminders, service updates, order updates, and event informationIdentity, contact, booking, order, communications dataContract; legitimate interestsTo maintain session records for continuity of service and safeguardingSession, consultation, service, communications dataLegitimate interests; explicit consent where special category data is includedTo send marketing emails and updatesIdentity, contact, marketing preferences, email engagement dataConsent, or legitimate interests where legally permittedTo improve our website, services, events, products, and customer experienceTechnical, usage, booking, order, feedback, communications dataLegitimate interestsTo protect our business, website, clients, community spaces, and legal rightsIdentity, contact, booking, transaction, technical, communications dataLegitimate interests; legal obligation where applicableTo comply with tax, accounting, legal, regulatory, or reporting dutiesIdentity, contact, transaction, invoice, order, booking dataLegal obligation

5. Special category data

Some information you voluntarily share with us may be classed as special category data under UK GDPR.

This may include information relating to your physical or mental health, trauma history, spiritual or philosophical beliefs, sex life, sexual orientation, or other sensitive personal matters.

We do not require you to share more than feels relevant or appropriate for the service you are receiving. Where this information is shared, we process it only to provide a safer, more informed, and more supportive service.

Where we rely on consent for special category data, we ask for your explicit consent. You may withdraw that consent at any time by contacting [email protected].

Withdrawing consent will not affect processing that has already taken place. It may also affect our ability to provide certain services safely or appropriately.

6. Marketing communications

We may send you marketing emails, updates, offers, event invitations, product launches, free resources, or service information where you have opted in or where we are legally permitted to do so.

You can unsubscribe at any time by clicking the unsubscribe link in our emails or by contacting [email protected].

If you unsubscribe, we may still send you non-marketing messages, such as booking confirmations, order updates, event information, legal notices, or customer service replies.

7. Cookies and analytics

Our website may use cookies and similar technologies for essential website functionality, performance, analytics, user experience, and security.

This may include cookies or tracking technologies provided through Content Creator Machine or other tools connected to our website.

Where required by law, we request consent through a cookie banner or similar mechanism.

You can manage or disable cookies through your browser settings. Please note that disabling some cookies may affect how the website functions.

For further details, please see our Cookie Policy if available on our website.

8. Sharing your data

We do not sell your personal data.

We may share limited personal data with trusted third-party service providers where necessary to operate our business, deliver services, process payments, manage bookings, host our website, send emails, or fulfil orders.

These may include:

Content Creator Machine

We use Content Creator Machine for website hosting, CRM, landing pages, forms, email marketing, booking flows, customer communication, and related business systems.

Eventbrite

We use Eventbrite to manage some event listings, ticketing, registration, attendee information, event communication, and event payments where applicable.

Stripe

We use Stripe to process card payments, payment links, refunds, transaction records, and related payment information. Stripe processes payments securely and we do not store your full card details.

Delivery and fulfilment providers

Where you purchase a physical product, we may share the information needed to deliver your order, such as your name, delivery address, contact details, and order details, with postal, courier, or fulfilment providers.

Professional advisers and legal obligations

We may share information with accountants, bookkeepers, legal advisers, insurers, regulators, tax authorities, or other professional bodies where necessary for legal, accounting, compliance, dispute resolution, or business protection purposes.

We may also disclose personal data where required by law or to establish, exercise, or defend legal claims.

9. International transfers

Some of the platforms and providers we use may process or store personal data outside the UK or European Economic Area.

Where this happens, we rely on appropriate safeguards under UK GDPR, such as:

the UK International Data Transfer Agreement

the UK Addendum to the EU Standard Contractual Clauses

adequacy regulations

or another lawful transfer mechanism under UK data protection law

10. Data retention

We keep personal data only for as long as reasonably necessary for the purposes it was collected, including to meet legal, accounting, tax, reporting, customer service, professional, safeguarding, or dispute-resolution requirements.

Indicative retention periods are:

Data typeRetention periodSession notes, consultation records, and mentorship recordsUp to 7 years after your last interactionEvent booking and attendance recordsUp to 6 years after the event, unless needed longer for legal, insurance, safeguarding, or dispute purposesProduct order, delivery, refund, and customer service recordsUp to 6 years after the end of the relevant financial yearTransaction, invoice, payment, and accounting records6 years from the end of the relevant financial yearMarketing dataUntil you unsubscribe, withdraw consent, or we determine your data is inactive and no longer neededGeneral enquiries and contact-form messagesUp to 24 months from last correspondence, unless needed longer for a live request, dispute, booking, or legal reasonWebsite analytics and cookie dataRetained according to the settings of the relevant platform or cookie tool

We review retention periodically and securely delete, anonymise, or minimise data when it is no longer required.

11. Data security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration, disclosure, or destruction.

These measures may include secure third-party platforms, access controls, password protection, strong authentication, encrypted connections where available, limited access to session notes, and using reputable providers for website hosting, payments, bookings, and communications.

No method of online transmission or electronic storage is completely secure, so we cannot guarantee absolute security. However, we take reasonable steps to protect your information.

12. Your rights

Under UK GDPR, you have rights in relation to your personal data, including the right to:

access your personal data and receive a copy

correct inaccurate or incomplete data

request erasure of your data, where no overriding lawful basis applies

restrict processing in certain circumstances

object to processing in certain circumstances, including direct marketing

request data portability where applicable

withdraw consent where processing relies on consent

complain to the Information Commissioner’s Office

To exercise your rights, contact [email protected].

We may need to verify your identity before responding to a request.

You also have the right to complain to the Information Commissioner’s Office if you believe your data protection rights have been infringed. You can find more information at https://ico.org.uk.

13. Third-party links and platforms

Our website, emails, event pages, or booking pages may contain links to third-party websites or platforms, including Eventbrite, Stripe, social media platforms, or other external services.

We are not responsible for the privacy practices, content, or security of third-party websites. When you use those platforms, their own privacy policies and terms may apply.

14. Children’s data

Our website, services, events, products, and programmes are intended for adults aged 18 and over.

We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact [email protected] so we can take appropriate steps to delete it.

15. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business, services, products, technology, legal obligations, or data practices.

Any changes will be posted on this page with an updated “Last Updated” date.

Where changes are material, we may notify you by email or through a notice on our website where appropriate.

16. How to contact us

Questions about this Privacy Policy or your data rights can be sent to:

Email: [email protected]
Company: Enchanted Life Ltd trading as Enchanted Life by Maia
Company number: 16407256
Registered office: 82a James Carter Road, Mildenhall, England, IP28 7DE
Website: https://enchantedlifebymaia.com