GDPR and Privacy Policy

Privacy Policy & GDPR Policy 

That Witch Amy Smith
Last updated: 19 October 2026

1. Introduction

Welcome to That Witch Amy Smith.

Your privacy, personal information and the trust you place in my work are incredibly important to me.

This Privacy Policy explains how I collect, use, store and protect personal information when you visit my website, book a spiritual reading, participate in mentoring, attend an event, purchase merchandise or communicate with my business.

I aim to handle your information respectfully, securely and transparently, in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

2. Who is responsible for your information?

Business: That Witch Amy Smith
Data Controller: Amy Smith
Website: www.thatwitchamysmith.com
Email: connect@thatwitchamysmith.com

I am responsible for determining how personal information is collected, used, stored and protected within my business.

For questions about your personal information or to exercise your data protection rights, please contact me using the email address above.

3. Information I collect

Depending on how you interact with my business, I may collect:

• Your name and contact details, including your email address and telephone number where necessary.

• Booking details, appointment dates and services purchased.

• Payment status, invoices and transaction information.

• Emails, enquiries and other business correspondence.

• Basic professional records relating to spiritual readings and mentoring.

• Information necessary to administer mentoring programmes, workshops and events.

• Merchandise orders and delivery information.

• Newsletter subscriptions and communication preferences.

• Website usage information and cookie data, where applicable.

I aim to collect only information relevant and necessary for the services I provide.

4. Spiritual readings and personal conversations

My spiritual readings focus on spiritual development, intuitive exploration, energetic awareness and personal reflection.

During a reading, clients may voluntarily discuss aspects of their lives, experiences or personal journeys. These conversations form part of the reading itself.

I do not routinely collect or retain detailed personal histories, medical information or sensitive personal disclosures as part of my professional records.

For business administration and insurance purposes, I maintain only essential appointment information and brief relevant professional notes where necessary.

I may take handwritten notes as part of my established reading practice.

I aim to handle personal information shared during sessions with care, respect and appropriate confidentiality.

Where sensitive information is voluntarily shared, I seek to avoid unnecessary recording or retention and apply appropriate safeguards where its processing is necessary.

5. Why I use your information

I use personal information for the following purposes:

Bookings and services: To arrange, provide, rearrange and administer spiritual readings, mentoring programmes, workshops and events.

Professional records: To maintain proportionate records of services provided and support professional and insurance-related requirements.

Payments and accounts: To manage payments, invoices, refunds, accounting and tax obligations.

Communications: To respond to enquiries, provide appointment information and send materials relating to services you have requested.

Mentoring and community activities: To administer programmes, online gatherings and private group communications.

Merchandise: To process purchases, fulfil orders and respond to customer enquiries.

Marketing: To send newsletters, updates and promotional communications where permitted by law.

Business administration and protection: To maintain security, manage complaints, respond to disputes and meet relevant legal obligations.

6. Lawful bases for processing personal information

Under UK GDPR, personal information must be processed on an appropriate lawful basis.

Depending on the purpose, I may rely on:

Contract: Where information is needed to provide a service, administer a booking or fulfil a purchase.

Legal obligation: Where information is required to meet applicable legal, accounting or tax obligations.

Legitimate interests: Where necessary and proportionate for routine business administration, appropriate professional records, security, responding to enquiries or managing potential disputes.

Consent: Where consent is required, including certain marketing activities or optional uses of personal information.

I do not routinely seek or retain sensitive personal disclosures as part of my professional reading records.

Where special-category personal information is processed, I recognise that an additional condition under Article 9 of UK GDPR may be required, alongside an appropriate lawful basis.

7. Professional records and retention

To support appropriate business administration and professional record-keeping, I maintain limited records of spiritual readings.

These may include:

• Client name.

• Appointment date.

• Service provided.

• Whether the client is new or returning.

• Brief relevant professional notes, where necessary.

Records may be maintained electronically or in handwritten form.

I do not routinely retain detailed accounts of clients' personal experiences, medical histories or sensitive disclosures.

Basic professional records are normally retained for seven years where necessary and justified by my insurance and professional record-keeping requirements.

Information relevant to an existing or anticipated complaint, dispute or claim may be retained for longer where appropriate.

Other records, including financial information and business correspondence, are retained according to their purpose and applicable legal requirements.

Information that is no longer required is securely deleted or anonymised where appropriate.

8. Zoom and online sessions

Zoom and Online Sessions

I use Zoom to provide online spiritual readings, mentoring and gatherings.

Moving forward, I maintain essential appointment information and brief professional notes where necessary. Individual spiritual readings are not routinely audio or video recorded.

9. Mentoring, WhatsApp and online communities

When you participate in a mentoring programme, workshop or private community, I may use your name, contact details and relevant participation information to administer the service.

Some programmes and gatherings use Zoom and WhatsApp.

When joining a WhatsApp group, your telephone number and profile information may be visible to other group members, depending on your privacy settings.

Participants are expected to respect one another's confidentiality and personal boundaries.

I do not use private group contributions or personal stories for public content without appropriate permission.

However, I cannot guarantee how other participants independently handle information they receive within a group.

10. My administrative assistant

I work with an authorised, self-employed administrative assistant who supports the day-to-day running and development of my business.

Her responsibilities may include managing spiritual reading bookings, appointment scheduling, payment reminders, client correspondence, events, marketing and general business administration.

My assistant may access relevant personal information, including client names, contact details, appointment information, payment status and business correspondence, where necessary to carry out these responsibilities.

Private spiritual reading notes and detailed session records are managed separately and are not routinely accessible to my assistant.

My assistant is subject to written confidentiality obligations and appropriate data protection arrangements.

Access to personal information is limited to what is reasonably necessary for her agreed responsibilities.

11. Third-party service providers

To operate my business, I use third-party services that may process personal information where necessary.

These may include:

• Wix: Website hosting, booking functionality and website services.

• Zoom: Online readings, mentoring sessions and gatherings.

• PayPal and other payment providers: Payment processing and transactions.

• WhatsApp: Voluntary mentoring and community communications.

• Patreon: Membership services and content.

• Teemill: Merchandise orders and fulfilment.

• Email and administration providers: Business communications and organisation.

• Secure storage providers: Electronic record-keeping.

• Accountants, insurers and professional advisers: Business administration and professional requirements.

These providers may process personal information in accordance with their own privacy policies and applicable data protection obligations.

Some services may process information outside the UK. Where applicable, I consider the safeguards required by UK data protection legislation.

12. Payments and financial information

Payment information is processed through the relevant payment providers.

I may retain transaction records, invoices and payment confirmations for accounting, tax and business administration purposes.

I do not need to store full payment-card details within my professional reading records.

13. Marketing and newsletters

If you subscribe to my newsletter or otherwise lawfully receive marketing communications, I may use your contact details to send updates, offers and information about my work.

You can unsubscribe from marketing communications at any time using the unsubscribe option provided or by contacting me directly.

Unsubscribing from marketing does not prevent necessary communications relating to an existing booking or service.

14. Website cookies

My website is hosted through Wix.

Cookies and similar technologies may be used for essential website functionality, security and performance.

Depending on the features enabled, additional cookies may be used for analytics or other optional purposes.

Where legally required, consent is requested before non-essential cookies are used.

Information about cookies and available preferences is provided through the cookie information and controls on my website.

Further general information about Wix cookies is available through Wix's privacy and cookie guidance.

15. Protecting your information

I take reasonable technical and organisational measures to protect personal information.

These include:

• Restricting access to authorised individuals.

• Using appropriately secured accounts and systems.

• Protecting electronic and handwritten records.

• Limiting the information collected and retained.

• Reviewing access permissions and security arrangements.

• Securely deleting information when no longer required.

• Maintaining confidentiality and data protection arrangements with those assisting my business.

No electronic system can be guaranteed completely risk-free, but I aim to take appropriate precautions to protect personal information.

16. How long information is kept

Different types of information are retained for different periods.

Professional reading records: Normally seven years where justified by professional and insurance requirements.

Financial and accounting information: In accordance with applicable legal and tax requirements.

Booking correspondence: For as long as reasonably necessary for administration, professional records or relevant disputes.

Marketing information: Until you unsubscribe or it is no longer appropriate to retain it, subject to necessary suppression records.

Mentoring, event and community information: For the period reasonably necessary to administer the service and meet relevant obligations.

Information is reviewed and securely deleted or anonymised when no longer required, unless continued retention is justified.

17. Your data protection rights

Depending on the circumstances, you may have the right to:

• Request access to personal information held about you.

• Request correction of inaccurate information.

• Request deletion of information.

• Request restriction of certain processing.

• Object to certain uses of your information.

• Request transfer of eligible personal information.

• Withdraw consent where processing relies on consent.

• Raise concerns about how your information is handled.

These rights are subject to applicable legal conditions and exceptions.

To make a request, please email connect@thatwitchamysmith.com.

You may also contact the Information Commissioner's Office (ICO) at www.ico.org.uk.

18. Children's information

Individual spiritual readings are intended for adults aged 18 and over.

Where information relating to children is processed in connection with events, purchases or other business activities, I aim to collect only what is necessary and apply appropriate safeguards.

19. Updates to this policy

I may update this Privacy Policy as my services, business arrangements, technology or legal obligations change.

The latest version will be available on my website.

Where changes materially affect how personal information is used, I will take appropriate steps to inform affected individuals.

20. Contact

For questions about privacy, personal information or this policy, please contact:

Amy Smith
That Witch Amy Smith
Email: connect@thatwitchamysmith.com
Website: www.thatwitchamysmith.com