Privacy Policy

Last updated: April 2026

1. Who we are

This website is operated by Carmen Belle White, a sole trader based in the United Kingdom. Throughout this policy, “we”, “us” and “our” refer to Carmen Belle White.

We can be contacted at:

Website: www.carmenbellewhite.com

For any privacy-related enquiries, please use the contact form on our website.

2. What this policy covers

This Privacy Policy explains how we collect, use, store and protect your personal data when you visit carmenbellewhite.com or interact with us through our website. It applies to all visitors and customers.

We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

3. Data we collect and how we collect it

3.1 Data you provide directly

When you use our website, you may provide us with personal data in the following ways:

  • Contact form – your name and email address

  • Mailing list sign-up – your email address

  • Purchasing products or services – your name, email address, billing address and payment details (processed securely by Squarespace and their payment providers)

3.2 Data collected automatically

When you visit our website, certain data is collected automatically by Squarespace (our website platform) and third-party services, including:

  • IP address and approximate location

  • Browser type and version

  • Pages visited and time spent on the site

  • Referring website or search engine

  • Device type and operating system

3.3 Third-party services

Our website integrates with the following third-party services which may collect data independently under their own privacy policies:

  • Spotify – embedded music player (Spotify AB, Sweden / Spotify Ltd, UK)

  • Instagram – links to @CarmenBelleWhite and @SherborneGongs (Meta Platforms Ireland Ltd)

  • Squarespace – website hosting and e-commerce platform (Squarespace Ireland Ltd)

We encourage you to review the privacy policies of these third parties if you have concerns about how they handle your data.

4. Legal basis for processing

We process your personal data on the following legal grounds under UK GDPR:

  • Consent – where you have actively signed up to our mailing list or submitted a contact form

  • Contract – where processing is necessary to fulfil a purchase or booking you have made

  • Legitimate interests – for website analytics and security, where our interests do not override your rights

5. How we use your data

We use the personal data we collect for the following purposes:

  • To respond to enquiries submitted via the contact form

  • To send you newsletters, event updates and exclusive content where you have opted in

  • To process purchases and manage transactions

  • To improve the website and understand how visitors use it

  • To comply with legal obligations

6. Cookies

Our website uses cookies – small text files stored on your device – to help us understand how the site is used and to enable certain features. These are managed by Squarespace and any third-party services embedded on the site.

You may control cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the website.

7. Sharing your data

We do not sell or rent your personal data to third parties. We may share your data in the following limited circumstances:

  • With Squarespace, our website and e-commerce platform, solely to operate this website

  • With payment processors (such as Stripe or PayPal), to facilitate secure transactions

  • With our email marketing provider, where you have subscribed to our mailing list

  • Where we are required to do so by law, or to protect the rights, property or safety of ourselves or others

8. How long we keep your data

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

  • Mailing list subscribers – until you unsubscribe or request deletion

  • Contact form enquiries – up to 2 years unless a longer retention period is required

  • Purchase records – up to 7 years in line with HMRC requirements

9. Your rights

Under UK GDPR, you have the following rights regarding your personal data:

  • The right to access – you may request a copy of the data we hold about you

  • The right to rectification – you may ask us to correct inaccurate or incomplete data

  • The right to erasure – you may ask us to delete your personal data in certain circumstances

  • The right to restrict processing – you may ask us to limit how we use your data

  • The right to data portability – you may request your data in a structured, machine-readable format

  • The right to object – you may object to processing based on legitimate interests or for direct marketing

  • The right to withdraw consent – where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, please contact us using the form on our website. We will respond within one calendar month.

10. Mailing list

If you subscribe to our mailing list, your email address will be used to send you updates about music, events, sound healing sessions and exclusive content. You may unsubscribe at any time by clicking the “unsubscribe” link in any email, or by contacting us directly.

11. Data security

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. Our website is hosted by Squarespace, which maintains industry-standard security practices.

However, no method of transmission over the internet is entirely secure. Whilst we strive to protect your data, we cannot guarantee absolute security.

12. International transfers

Some of the third-party services we use (such as Squarespace and Spotify) may transfer your data outside the United Kingdom. Where this occurs, we ensure that appropriate safeguards are in place in accordance with UK GDPR, such as standard contractual clauses or transfers to countries with an adequacy decision.

13. Children’s privacy

Our website is not directed at children under the age of 13. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will take steps to delete it.

14. Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK’s data protection supervisory authority.

ICO website: www.ico.org.uk

ICO helpline: 0303 123 1113

We would, however, appreciate the opportunity to address your concerns directly before you approach the ICO. Please contact us in the first instance.

15. Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with a revised “Last updated” date. We encourage you to review this policy periodically.