Privacy Policy

1. Introduction

This Privacy Policy explains how Jemma Heydenrych, trading as Gentle Observations, collects, uses, stores, shares, and protects your personal information when you visit or use gentleobservations.com.

Gentle Observations is the data controller for the purposes of this Privacy Policy. We decide how and why your personal information is processed. This website is built and hosted on the Wix platform. Wix.com Ltd. acts as a data processor on our behalf, providing the hosting, security, and technical infrastructure that makes this website operate. For details of how Wix handles data at the platform level, please refer to the Wix Privacy Policy at wix.com/about/privacy.

We are committed to handling your personal information responsibly and in accordance with the Protection of Personal Information Act (POPIA) in South Africa, the General Data Protection Regulation (GDPR) for visitors in the European Union and United Kingdom, the California Consumer Privacy Act (CCPA/CPRA) for visitors in California, and applicable data protection laws in other jurisdictions where our users are located.

By using this website, accessing our resources, signing up for a membership, or purchasing from our shop, you acknowledge that you have read and understood this Privacy Policy. Our Terms and Conditions, available at gentleobservations.com/terms-and-conditions, also govern your use of this website. This Privacy Policy is permanently available at gentleobservations.com/privacy-policy. Please read both documents together.

2. Who We Are

Data Controller: Jemma Heydenrych, trading as Gentle Observations
Website: gentleobservations.com
Location: Cape Town, South Africa
Registered in: the Republic of South Africa and the State of New Mexico, United States of America
Privacy enquiries: hello@gentleobservations.com

3. What Personal Data We Collect

We collect personal information in the following categories, depending on how you interact with this website.

Information you provide directly

Contact enquiries: When you use our contact form, we collect your name, email address, and the content of your message.

Account registration: When you create a free account to access the Freebie Library, or a paid account for the Therapy Resource Library membership, we collect your name and email address. Your account is secured with a password, which is encrypted and not accessible to us.

Purchases: When you make a purchase through our shop, we collect your name, email address, and billing information including billing address. Payment card details are processed directly by PayPal and Stripe, our payment processors, and are not stored by Gentle Observations.

Membership subscriptions: When you subscribe to a paid membership tier via Wix Pricing Plans, we collect the same information as for purchases, plus your membership plan details and subscription history.

Email sign-ups: When you sign up for our newsletter or email list, we collect your email address and, where provided, your name.

Blog comments: When you post a comment on the Gentle Observations blog, your display name and comment text are published publicly on the site. Your email address and IP address are also collected at the point of submission but are not displayed publicly. This information is used to manage comments and prevent spam.

Information collected automatically

When you visit this website, certain information is collected automatically by the Wix platform and our analytics tools. This includes your IP address, browser type and version, device type and operating system, the pages you visit on this site, the time and duration of your visit, the website that referred you to this site, and general geographic location derived from your IP address.

Information from third-party tools

This website uses Wix Analytics, Google Analytics, and Facebook Pixel for analytics and marketing purposes, Wix Ascend for email marketing, and PayPal and Stripe for payment processing. These tools are described in Sections 8 and 9.

4. How We Collect Your Data

Contact form: When you submit an enquiry, your name, email address, and message are sent to us via the Wix platform.

Account registration: When you create an account in the Wix Members Area, the Wix platform collects and stores your registration details.

Shop checkout: When you purchase a digital product from our shop, personal and billing information is collected through the Wix Stores checkout process and passed to PayPal or Stripe for payment processing, depending on the method chosen at checkout.

Membership subscription: When you subscribe to a membership tier through Wix Pricing Plans, your details are collected at the point of payment.

Email sign-up: When you opt in to our email list through a sign-up form on the site, your email address is captured via Wix Ascend, our email marketing platform.

Blog comments: When you submit a comment on a blog post, your display name, comment content, email address, and IP address are collected through the Wix platform.

Automated data collection: The Wix platform, Google Analytics, and Facebook Pixel automatically collect technical and behavioural data when you visit the site, as described in Section 9.

5. Why We Collect Your Data

We collect and process your personal data only for specific, lawful purposes. The following sets out each category of data, why we collect it, the lawful basis under GDPR, and how long we keep it.

Name and email (contact form)

Purpose: To respond to your enquiry
Lawful basis: Legitimate interest
How long we keep it: 3 years from date of last contact, in line with the standard prescription period for civil claims under the Prescription Act 68 of 1969 (South Africa)

Account registration data

Purpose: To provide access to the Freebie Library or paid membership
Lawful basis: Contract
How long we keep it: Duration of active account. Accounts inactive for 24 months are flagged for deletion. Data is deleted within 90 days of account closure or confirmed inactivity.

Purchase and billing data

Purpose: To process your purchase, fulfil your order, and meet financial record-keeping obligations
Lawful basis: Contract / Legal obligation
How long we keep it: 7 years from date of transaction. South African law (Tax Administration Act 28 of 2011) requires a minimum of 5 years. US IRS requirements require 7 years. The higher standard applies.

Membership subscription data

Purpose: To manage your membership, process recurring payments, and provide access to resources
Lawful basis: Contract
How long we keep it: Duration of active subscription, plus 3 years after cancellation or lapse, covering the standard contractual dispute window under South African law. Financial records within this data are subject to the 7-year rule above.

Purpose: To send updates, resources, and promotional content you have opted into
Lawful basis: Consent
How long we keep it: Until you unsubscribe. Deleted within 30 days of unsubscribe. Consent records are retained for 3 years after unsubscribe as evidence of lawful processing.

Blog comment data (display name, email, IP address)

Purpose: To publish approved comments publicly and prevent spam
Lawful basis: Legitimate interest
How long we keep it: For the duration the associated blog post is published, plus 12 months after the post is removed. IP address data is deleted 12 months from submission date.

Technical and analytics data (IP address, device, behaviour patterns)

Purpose: To understand how visitors use the site and improve its performance; to measure the effectiveness of marketing
Lawful basis: Legitimate interest / Consent (for non-essential cookies)
How long we keep it: Wix Analytics: up to 14 months. Google Analytics: 14 months (configured in account settings). Facebook Pixel: governed by Meta’s data retention policies, available at facebook.com/privacy.

Retention periods are reviewed annually to ensure they remain appropriate and legally current. These periods are set with reference to the Prescription Act 68 of 1969, the Tax Administration Act 28 of 2011, IRS requirements, GDPR Article 5(1)(e), and POPIA Section 14.

6. How We Store and Protect Your Data

This website is hosted on the Wix platform. Your data is stored on Wix’s secure servers, which are protected by industry-standard security measures including encryption, firewalls, and access controls. Wix operates a global infrastructure and your data may be stored on servers located in the United States or other countries. For details of Wix’s security practices, please refer to the Wix Privacy Policy at wix.com/about/privacy.

Payments made through this website are processed by PayPal and Stripe, both of which adhere to the Payment Card Industry Data Security Standard (PCI-DSS). We do not store your full payment card details. Your card information is handled entirely by the relevant payment processor and is not accessible to Gentle Observations.

We take reasonable technical and organisational measures to protect your personal data from unauthorised access, loss, or misuse. No method of electronic transmission or storage is completely secure, but we do our best to protect your personal information.

In the event of a data breach that is likely to affect your rights or freedoms, we will notify you and, where required by applicable law, the relevant supervisory authority as soon as reasonably practicable.

7. How Long We Keep Your Data

We retain your personal data only for as long as is necessary for the purpose for which it was collected, or as required by applicable law. Specific retention periods for each data type are set out in the table in Section 5. These periods are set with reference to the Prescription Act 68 of 1969 and the Tax Administration Act 28 of 2011 in South Africa, Internal Revenue Service requirements in the United States, and the storage limitation principles under GDPR and POPIA.

When personal data is no longer needed, we delete or anonymise it. You may request deletion of your personal data at any time by contacting hello@gentleobservations.com, subject to any legal obligations we have to retain certain records. See Section 11 for how to exercise this right.

We do not sell your personal data to any third party. We share your data only with the following recipients where necessary to operate this website and deliver our services.

Wix.com Ltd.

Our website is built and hosted on the Wix platform. Wix processes data on our behalf as part of providing hosting, security, analytics, membership management, and payment infrastructure. Wix is bound by data processing agreements and is not permitted to use your data for its own commercial purposes. Wix Privacy Policy: wix.com/about/privacy

PayPal

PayPal processes payment transactions made through this site. When you pay via PayPal, your name, billing address, and payment details are transmitted securely to PayPal. We receive confirmation of successful payment but do not have access to your full card details. PayPal Privacy Policy: paypal.com/privacy

Stripe

Stripe processes card payment transactions made through this site. When you pay via Stripe, your name, billing address, and card details are transmitted securely to Stripe. We receive confirmation of successful payment but do not have access to your full card details. Stripe Privacy Policy: stripe.com/privacy

Wix Ascend

We use Wix Ascend to send email marketing campaigns, newsletters, and automated email sequences to subscribers. Your name and email address are stored within Wix Ascend when you subscribe. Wix Ascend operates as part of the Wix platform infrastructure.

Wix Analytics

Wix Analytics is enabled by default on all Wix-hosted websites and collects anonymised and aggregated data about site visitors including page views, session duration, device types, and general geographic location. This data is processed by Wix as part of the platform.

Google Analytics

We use Google Analytics, a web analytics service provided by Google LLC, to understand how visitors interact with this website. Google Analytics collects data including your IP address (anonymised), device type, browser, pages visited, session duration, and referral source. This data is transmitted to and stored on Google’s servers. Google may use this data in accordance with its own privacy policy. You can opt out of Google Analytics tracking by installing the Google Analytics opt-out browser add-on at tools.google.com/dlpage/gaoptout. Google Privacy Policy: policies.google.com/privacy

Facebook Pixel

We use the Facebook Pixel, a tool provided by Meta Platforms, Inc., to measure the effectiveness of our advertising and to understand how visitors use our website after seeing our ads on Facebook and Instagram. The Facebook Pixel collects data including your IP address, browser information, pages visited, and actions taken on the site. This data is transmitted to Meta and may be used to show you relevant advertising on Meta platforms. You can manage your advertising preferences through your Facebook settings or via the Digital Advertising Alliance opt-out tool at optout.aboutads.info. Meta Privacy Policy: facebook.com/privacy

Legal and regulatory authorities

We may disclose your personal data to law enforcement agencies, regulatory bodies, or courts if required to do so by applicable law, or where necessary to protect our legal rights, prevent fraud, or ensure the safety of our users.

Business transfers

In the event that Gentle Observations is sold, merged, or its assets transferred to another entity, your personal data may be transferred as part of that transaction. We will notify you of any such change and ensure your data continues to be protected in accordance with this Privacy Policy.

9. Cookies and Tracking Technologies

Cookies are small text files stored on your device when you visit a website. They help the website function correctly, remember your preferences, and collect information about how visitors use the site.

Essential cookies

All websites built on the Wix platform use essential cookies. These are placed by Wix automatically and are required for the site to function. They manage login sessions, maintain security, and ensure the platform operates correctly. These cookies cannot be switched off without breaking the site’s basic functionality and do not collect personal information for marketing purposes.

Analytics cookies

This site uses Wix Analytics and Google Analytics, which place cookies to collect information about how visitors use the site, including which pages are visited, how long visitors stay, and where they come from. Google Analytics uses cookies including _ga and _gid to distinguish users and sessions. This data is collected in anonymised form and used to improve the site.

Marketing and advertising cookies

This site uses the Facebook Pixel, which places cookies to track visitor behaviour across sessions and connect that behaviour to your activity on Meta platforms including Facebook and Instagram. This allows us to measure the effectiveness of our advertising and to show relevant ads to people who have visited our site. Facebook Pixel cookies include _fbp and _fbc.

This site has a cookie consent mechanism in place. For visitors in the European Union and United Kingdom, non-essential cookies including analytics and marketing cookies are not placed until you have given your consent through the cookie consent banner. You may withdraw your consent or update your preferences at any time through the banner settings.

Managing your cookies

You can also manage or disable cookies through your browser settings at any time. Most browsers allow you to refuse cookies, delete existing cookies, or be notified when cookies are set. Please note that disabling essential cookies will affect the functionality of this website. To opt out of Google Analytics specifically, use the browser add-on at tools.google.com/dlpage/gaoptout. To manage your Facebook advertising preferences, visit your Facebook settings or optout.aboutads.info.

10. Your Rights

Depending on your location, you have specific rights regarding your personal data. To exercise any of these rights, please contact us using the details in Section 11.

Rights under POPIA (South Africa — applies to all users of this site)

As a South Africa-registered business, POPIA is our primary data protection obligation. All users have the right to access the personal information we hold about them, to request correction of inaccurate or incomplete information, to request deletion of personal information where it is no longer required or has been collected unlawfully, to object to the processing of their personal information, and to submit a complaint to the Information Regulator of South Africa.

Information Regulator of South Africa: inforegulator.org.za | complaints.IR@justice.gov.za | +27 (0)10 023 5207

If you are located in the EU or UK, you have the following rights under GDPR: the right of access (request a copy of your personal data), the right to rectification (request correction of inaccurate data), the right to erasure (request deletion in certain circumstances), the right to restriction of processing, the right to data portability, the right to object to processing based on legitimate interests, the right to withdraw consent at any time without affecting the lawfulness of prior processing, and the right to lodge a complaint with your local supervisory authority. In the UK this is the Information Commissioner’s Office at ico.org.uk. In the EU it is the authority in your country of residence, listed at edpb.europa.eu.

We will respond to all GDPR rights requests within 30 days of receipt.

Rights under CCPA/CPRA (California residents)

If you are a California resident, you have the right to know what personal information we collect about you, the right to delete your personal information, the right to correct inaccurate personal information, the right to opt out of the sale or sharing of your personal information, and the right to non-discrimination for exercising any of these rights. We do not sell your personal information. We will respond to CCPA rights requests within 45 days of receipt.

11. How to Exercise Your Rights

To exercise any of your data rights, please contact us at hello@gentleobservations.com. Please include your name, the email address associated with your account if applicable, a clear description of the right you wish to exercise, and any details that will help us locate your data. We may need to verify your identity before processing your request.

We will acknowledge your request within 5 business days and aim to complete all requests within 30 days. Where a request is complex, we may extend this by a further 30 days and will notify you if this applies.

Some data cannot be deleted on request if we are legally required to retain it, for example financial transaction records within their statutory retention period. Where we cannot fulfil a deletion request in full, we will explain the specific reason in our response.

12. Marketing Communications

We use Wix Ascend to send email communications to subscribers who have opted in to hear from us. These may include new resource announcements, blog updates, membership news, and promotional offers relevant to mental health care professionals. We also use automated email sequences triggered by actions you take on the site, such as account creation, purchase confirmation, and membership welcome sequences.

You may unsubscribe from marketing communications at any time by clicking the unsubscribe link in any marketing email, or by contacting hello@gentleobservations.com. Opting out of marketing emails will not affect transactional and account-related emails. We only send marketing communications to people who have actively opted in and we do not purchase email lists.

13. Children’s Privacy

This website and its resources are intended for qualified mental health care professionals and adult practitioners. This site is not directed at children under the age of 18 and we do not knowingly collect personal data from anyone under 18. If you believe a child under 18 has provided personal information to us without appropriate consent, please contact hello@gentleobservations.com and we will take prompt steps to delete that information.

14. International Data Transfers

Gentle Observations is registered in both South Africa and the State of New Mexico, United States of America. Our website is hosted on the Wix platform, which operates a global infrastructure. Your personal data may be stored or processed in countries outside your country of residence, including the United States and other countries where Wix, Google, or Meta maintain servers.

For EU and UK users: Wix participates in the EU-US Data Privacy Framework, which provides an appropriate safeguard for transfers from the EU and UK to the United States. Google and Meta also participate in relevant data transfer frameworks for international processing. Where data is transferred to other countries, appropriate safeguards are applied as required by GDPR.

For South African users: Under POPIA, cross-border transfers of personal data are permitted where the recipient country has adequate data protection laws or where appropriate contractual safeguards are in place. We take reasonable steps to ensure that all international transfers of your data meet POPIA requirements.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, the tools we use, applicable laws, or our business operations. The Last Updated date at the top of this page will always reflect when the most recent version was published.

When we make material changes that meaningfully affect how we collect or use your personal data or the rights available to you, we will notify registered users and active subscribers by email in advance of those changes taking effect. Your continued use of this website after any updates constitutes your acceptance of the revised policy.

16. Contact and Complaints

If you have any questions, concerns, or requests relating to this Privacy Policy or how we handle your personal data, please contact us:

Jemma Heydenrych
Trading as Gentle Observations
Cape Town, South Africa
hello@gentleobservations.com

If you feel your privacy rights have not been adequately addressed, you have the right to escalate your complaint to the relevant supervisory authority for your jurisdiction.

Information Regulator of South Africa

inforegulator.org.za | complaints.IR@justice.gov.za | +27 (0)10 023 5207

Information Commissioner’s Office (UK)

ico.org.uk | 0303 123 1113

EU supervisory authority

Contact the authority in your country of residence. Full list at edpb.europa.eu.

California Privacy Protection Agency

cppa.ca.gov | For CCPA requests, contact hello@gentleobservations.com directly.