Privacy policy.

Last updated: August 2026

1. Who is responsible for your data

The person responsible for processing your personal data (the "data controller") is:

Adina Avram Consulting, 1068PM, Amsterdam, Netherlands. Email: adina.avram@soulmirrorstudio.org

If you have any questions about this policy or how your data is handled, you can contact me at the email above.

2. What this policy covers

This policy explains what personal data I collect when you visit my website or work with me, why I collect it, how it is used and protected, and the rights you have under the EU General Data Protection Regulation (GDPR).

3. What data I collect and why

Information you give me directly. When you fill in the contact form, book a session, or email me, I collect the details you provide — typically your name, email address, phone number, and any message or background you choose to share. I use this to respond to you, arrange a call, and provide the services you request. Legal basis: performance of a contract (or steps taken at your request before a contract), and your consent.

Photographs for energetic assessment. Some of my services involve working from a photograph you send as a reference point. A photograph of an identifiable person is personal data, and I treat it with particular care. I use your photograph solely to carry out the assessment you have requested; I do not share it, and I delete it within 30 days of completing your session, unless you ask me to keep it for ongoing work. You provide this photograph voluntarily and can withdraw your consent at any time. Legal basis: your explicit consent.

Booking and payment information. When you book or purchase a service, booking and transaction details are processed through the tools listed in Section 4. I do not store your full payment card details; these are handled by the payment provider. Legal basis: performance of a contract.

Website usage data. When you visit the site, limited technical information (such as your browser type, device, and general location) may be collected automatically, and cookies or similar technologies may be used. These are governed by my Cookie Policy / cookie banner, where you can manage your preferences. Legal basis: your consent, and my legitimate interest in operating and securing the site.

Newsletter (if you subscribe). If you sign up for my newsletter, I collect your email address to send you the updates you've asked for. You can unsubscribe at any time using the link in any email. Legal basis: your consent.

4. Tools and third parties I share data with

I use trusted third-party service providers to help me operate my website, manage bookings, process payments, communicate with clients, and run my business. These providers may process personal data on my behalf and only as necessary to provide their services.

  • Squarespace — I use Squarespace to host my website and process information submitted through website forms. This may include information such as your name, email address, and any information you choose to provide through a form. Squarespace is based in the United States. Where personal data is transferred outside the European Economic Area (EEA), appropriate safeguards are used, such as Standard Contractual Clauses.

  • Acuity Scheduling — I use Acuity Scheduling to manage appointments and bookings. When you book an appointment, Acuity may process information such as your name, email address, telephone number, appointment details, and any other information you provide during the booking process. Acuity Scheduling is a Squarespace service. Where personal data is transferred outside the EEA, appropriate safeguards are used.

  • Stripe — I use Stripe to securely process payments. When you make a payment, Stripe processes the information necessary to complete and manage the transaction, which may include your name, billing information, payment details, transaction information, and other information required for fraud prevention and payment processing. I do not receive or store your full payment card details. Stripe may process personal data outside the EEA and uses appropriate safeguards for international data transfers where required.

  • Google — I use Google services, including Gmail, for business communications and email correspondence. If you contact me by email or communicate with me in connection with my services, information such as your name, email address, message content, and related correspondence may be processed and stored using Google’s services. Google may process personal data outside the EEA and uses appropriate safeguards for international data transfers where required.

These service providers have their own privacy and data-protection obligations. I only use providers that I consider appropriate for the services they perform, and I do not sell your personal data to these providers.

5. International data transfers

Some of the providers above are located outside the European Economic Area (for example, in the United States). Where your data is transferred internationally, I rely on safeguards approved under GDPR, such as Standard Contractual Clauses or an adequacy decision, to ensure it remains protected.

6. How long I keep your data

I keep your data only as long as needed for the purpose it was collected, or as required by law (for example, tax and accounting rules may require keeping invoices for 7 years). Contact inquiries that don't lead to working together are deleted after one year. Photographs are deleted as described in Section 3.

7. How your data is protected

I take reasonable technical and organizational measures to keep your data secure and to prevent unauthorized access, loss, or misuse. No method of transmission over the internet is completely secure, but I work only with reputable providers and handle sensitive material (such as photographs) with care.

8. Your rights under GDPR

You have the right to:

  • access the personal data I hold about you

  • request correction of inaccurate data

  • request deletion of your data ("right to be forgotten")

  • restrict or object to certain processing

  • request a copy of your data in a portable format

  • withdraw consent at any time, where processing is based on consent

  • lodge a complaint with your local data protection authority

To exercise any of these rights, email me at adina.avram@soulmirorstudio.org. I will respond within the timeframe required by law (normally one month).

9. Changes to this policy

I may update this policy from time to time. The current version, with its date, will always be available on this page.