PRIVACY POLICY

This policy explains how PranaSomatics SL processes personal data when you use this website and our services. It is based on the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD) and Spanish Law 34/2002 (LSSI-CE).

1. Controller

PranaSomatics SL, Ur. Eagles Village, 6 1 Pta. 6, Edif. El Nogal, La Quinta Golf, 29679 Benahavís (Málaga), Spain. CIF B88979703. Email: mail@pranasomatics.com.

PranaSomatics SL is the controller for all its websites: pranasomatics.com, kaihill.de and lydiahillcoaching.com. For any question about your data, or to exercise your rights, please write to mail@pranasomatics.com.

2. Hosting and server log files (Squarespace)

This website is hosted by Squarespace Ireland Limited, Le Pole House, Ship Street Great, Dublin 8, Ireland, which works with its group company Squarespace, Inc. (USA). Each time you visit, Squarespace processes technical data in server log files: IP address, browser type and version, operating system, referrer URL, the pages you open, and the date and time of access. We need these data to deliver the website and keep it secure. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Squarespace processes these data on our behalf under a data processing agreement.

3. Cookies and consent

We use strictly necessary cookies without consent (Art. 22(2) LSSI-CE). We use all other cookies, and embedded third-party content that stores information on your device or sends your data to its provider, only if you have given your consent in our cookie banner (Art. 6(1)(a) GDPR). You can change or withdraw your consent at any time with the "Cookie settings" link in the footer. Withdrawing consent does not affect processing carried out before the withdrawal. Details are in our Cookie Policy.

4. Website statistics (Squarespace Analytics)

If you consent, we use the analytics built into Squarespace to understand in aggregate how our website is used: pages visited, traffic sources, device type and approximate location. Legal basis: your consent (Art. 6(1)(a) GDPR).

5. Fonts

This website loads fonts from Adobe Fonts (Adobe Systems Software Ireland Limited, 4-6 Riverwalk, Citywest Business Campus, Dublin 24, Ireland), through Squarespace, and from Google Fonts (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). When the fonts load, your browser sends your IP address to these providers. Legal basis: our legitimate interest in a consistent, readable presentation of our website (Art. 6(1)(f) GDPR), together with your consent where it is required (Art. 6(1)(a) GDPR).

6. Embedded videos (YouTube)

We embed videos from YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, in privacy-enhanced mode (youtube-nocookie.com). The videos load only with your consent. When you play a video, Google receives information such as your IP address, the page you are on and device data, and can link this to your Google account if you are logged in. Google may process data in the USA. Legal basis: your consent (Art. 6(1)(a) GDPR).

7. The survey ("The Ground")

You can complete the 16-area survey without giving any personal data. Your result is calculated in your browser and nothing is sent while you fill it in. If you choose "Send the letters", your email address and your 16 answers are sent to us through Formspree, a form service of Formspree, Inc. (USA), which processes them on our behalf. We use them to send you the four letters, to understand which areas matter to you, and to send you occasional related emails. Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw your consent at any time by writing to mail@pranasomatics.com or with the unsubscribe link in our emails. We delete your answers no later than 12 months after you send them, or earlier if you ask us to.

8. Booking calls (Calendly)

You can book calls and sessions through Calendly, a service of Calendly LLC, 115 E Main St, Ste A1B, Buford, GA 30518, USA. Calendly processes your name, email address, the time you choose and your answers in the booking form, on our behalf. Legal basis: taking steps at your request before a contract and performing it (Art. 6(1)(b) GDPR). If the Calendly widget is embedded on a page, it loads only with your consent; without consent you can still use the direct link to Calendly. Please do not enter health information in booking forms.

9. Coaching sessions

Coaching sessions take place by video call or in person. The video service's own privacy terms also apply to video calls. Everything you share in a session is confidential. Any notes we take serve only to support your sessions. If you share health information, we process it only with your explicit consent (Art. 9(2)(a) GDPR). Legal basis otherwise: performance of the contract (Art. 6(1)(b) GDPR).

10. Payments (Stripe)

Payments are processed by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Stripe processes your name, email address, billing address and payment details; for instalment plans it also stores a recurring payment authorisation. We do not receive your full card details. For fraud prevention and its own legal obligations, Stripe acts as an independent controller. Legal basis: performance of the contract and our legal obligations (Art. 6(1)(b) and (c) GDPR). We keep accounting records and invoices for six years (Art. 30 Spanish Commercial Code), and tax-relevant data for the periods required by tax law.

11. Online courses (Thinkific)

Our on-demand courses are delivered on Thinkific, a service of Thinkific Labs Inc., Vancouver, Canada. Our online school there is called "Hill Campus". Thinkific processes your name, email address, login data and learning progress on our behalf so that you can access your course. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Canada has an EU adequacy decision; Thinkific may use service providers in the USA.

12. Shop

If you order a product through the Squarespace shop on this website, Squarespace Commerce processes your order data (name, email address and, where needed, address) on our behalf to process the order (Art. 6(1)(b) GDPR).

13. Contact by email, contact form or WhatsApp

If you contact us, we process the details you give us (such as name, email address, phone number and your message) to answer your enquiry. Legal basis: steps taken at your request before a contract, or our legitimate interest in answering enquiries (Art. 6(1)(b) and (f) GDPR). We delete enquiries once they have been dealt with, unless a contract follows or the law requires us to keep them. WhatsApp is provided by WhatsApp Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland, which processes your phone number and metadata under its own terms. If you prefer, write to us by email instead. Please do not send detailed health information by WhatsApp.

14. Social media

We maintain profiles on Instagram and Facebook, services of Meta Platforms Ireland Limited, Merrick Road, Dublin 4, Ireland. Our website only links to these profiles: no data is sent to Meta until you click a link. When you visit our profiles, Meta processes your data under its own privacy policy. For the page statistics that Meta provides to us (Page Insights), we are joint controllers with Meta under Art. 26 GDPR (see facebook.com/legal/terms/page_controller_addendum). Legal basis: our legitimate interest in communicating with you (Art. 6(1)(f) GDPR). We do not use the Meta Pixel or other advertising trackers on this website.

15. Recipients and transfers outside the EU

We share personal data only with the service providers named in this policy, who process it on our behalf under data processing agreements or, where stated, as independent controllers. We also share it with our tax and accounting advisers, and with public authorities where the law requires it. Some providers process data in the USA. Such transfers take place on the basis of the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023), where the provider is certified under it, and otherwise on the basis of the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Transfers to Canada are based on the European Commission's adequacy decision.

16. How long we keep data

We delete personal data as soon as it is no longer needed for its purpose. Where the law requires us to keep data, we block it (Art. 32 LOPDGDD) and delete it when the retention period ends. As a guide: enquiries are kept for up to 12 months after they have been dealt with; newsletter data until you unsubscribe; contract and invoice data for six years after the end of the calendar year in which the contract ended.

17. Your rights

You have the right to access your data (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on legitimate interest or for direct marketing (Art. 21). You can withdraw any consent at any time with effect for the future (Art. 7(3)). To exercise your rights, write to mail@pranasomatics.com; we may ask you to confirm your identity. You also have the right to lodge a complaint with a supervisory authority, in particular the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, or with the authority in your EU country of residence.

18. Automated decisions

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

19. Minors

Our offers are for adults unless we expressly state otherwise. We do not knowingly process data of persons under 14 without the consent of a parent or legal guardian (Art. 7 LOPDGDD).

20. Security

This website uses TLS encryption. We take appropriate technical and organisational measures to protect your data (Art. 32 GDPR), and we take particular care with health information.

21. Changes

We update this policy when our services or the law change. The current version is always available on this page.

Last updated: 26 October 2026