Privacy Notice
Last updated: 11 September 2026
1. About this privacy notice
This Privacy Notice explains how JOANNE EASTON/ GUIDED BY GAIA TAROT (“I/Me”) collects, uses, stores and protects your personal information when you apply for, enquire about, or receive spiritual coaching from me.
I am committed to respecting your privacy and handling your personal information responsibly and in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as applicable in Scotland.
This notice applies particularly to information you provide through application forms, intake forms, consultation forms, questionnaires, emails, messages and during coaching sessions.
2. Who is responsible for your information?
The data controller responsible for your personal information is:
Joanne Easton, Guided by Gaia Tarot
130 Campbell Street, Wishaw, North Lanarkshire, ML2 8HU
07941 391406
If you have any questions about how your information is handled, please contact me using the details above.
3. What information may I collect?
Depending on the nature of your application and coaching, I may collect:
- your name and contact details;
- your date of birth or age, where relevant;
- information about your circumstances, goals, experiences and reasons for seeking coaching;
- information you provide about your spiritual, philosophical or religious beliefs or practices;
- information about your emotional or mental wellbeing, where you choose to share it;
- relevant health or wellbeing information that you voluntarily provide;
- information about previous coaching, counselling, therapy or other support, where relevant;
- emergency contact or safeguarding information, where appropriate;
- payment and booking information;
- correspondence between you and me;
- information arising from your coaching sessions; and
- any other information that you voluntarily provide as part of your application or coaching relationship.
You do not have to provide information that is not necessary for the coaching service. Please always provide information that you are comfortable sharing in line with your boundaries.
4. My lawful bases for processing
Under the UK GDPR, I need a lawful basis for processing your personal information.
Depending on the circumstances, I may rely on one or more of the following:
Contract / steps prior to entering into a contract
Where processing is necessary to provide the coaching service you have requested or to take steps at your request before entering into an agreement.
Legitimate interests
Where processing is necessary for legitimate business purposes, such as managing enquiries, maintaining appropriate records, administering my practice and protecting my business, provided that your interests and fundamental rights do not override those interests.
Legal obligation
Where I need to process information to comply with a legal obligation.
Consent
Where you have given valid consent for a particular purpose and no other lawful basis is more appropriate.
You can withdraw consent where processing is based on consent. Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.
5. Special category data
Where I process special category data, I will also identify an appropriate condition under Article 9 of the UK GDPR.
Where appropriate, this may include explicit consent, particularly where you voluntarily provide sensitive information as part of the coaching process.
I will only ask for sensitive information where there is a genuine reason for doing so, and I will take additional care to protect such information.
6. Who will I share your information with?
I will generally keep your personal information confidential and will not sell, rent or otherwise commercially share your personal information.
I may share information with trusted service providers where this is necessary to operate my coaching practice. For example, this may include providers of:
- booking and appointment systems;
- email and communication services;
- secure form or document storage;
- payment processing;
- accounting or bookkeeping services;
- IT, website or cloud-storage services.
Where appropriate, these providers will process information on my behalf and will be required to handle it securely and in accordance with applicable data protection requirements.
I may also disclose information where I am legally required or permitted to do so, or where disclosure is necessary to protect someone’s vital interests or safety.
7. Confidentiality and safeguarding
I will normally treat information you share with me as confidential.
However, confidentiality cannot be regarded as absolute. In exceptional circumstances, I may need to disclose information without your consent where I reasonably believe this is necessary to:
- prevent serious harm to you or another person;
- respond to an immediate safeguarding concern;
- comply with a legal obligation or court order; or
- protect my legal rights.
Where possible and appropriate, I will discuss such disclosure with you beforehand.
Spiritual coaching is not a substitute for medical care, psychological therapy, counselling or emergency services. If you disclose information indicating that you require specialist or emergency support, I may encourage you to contact an appropriately qualified professional or emergency service.
8. Technology and Data Security
I use reputable, password-protected digital services to run my coaching and tarot practice, including email, online forms, booking, payment and secure document storage. The main digital services I use are WhatsApp, Gmail, Messenger, Microsoft Teams, Fresha, and Woo Commerce. Personal information may be processed or stored by these providers on my behalf where necessary to provide the service.
I take reasonable steps to keep your information secure, including using strong passwords, device security, appropriate access controls and reputable service providers. Where a service provider processes information on my behalf, I take reasonable steps to ensure that appropriate data protection and security measures are in place.
Some technology providers may process or store information outside the UK. Where this happens, I will take appropriate steps to ensure that your information is protected in accordance with UK data protection law.
No online service or method of electronic transmission can be guaranteed to be completely secure. However, I will take reasonable and proportionate measures to protect your personal information against loss, misuse, unauthorised access or disclosure.
Use of AI tools
I may use AI tools, including ChatGPT, for general business, administrative and technical support, such as helping with website content, business processes, research, troubleshooting and drafting non-confidential materials.
I do not use AI tools to provide intuitive or spiritual readings, coaching, therapeutic guidance or other client-facing intuitive work. I also do not use AI to create artwork or other creative work on behalf of myself or clients. I will not knowingly enter your identifiable personal information, sensitive personal information, coaching disclosures or confidential session content into AI tools for these purposes
9. How long will I keep your information?
I will keep your personal information only for as long as reasonably necessary for the purposes for which it was collected.
Where you become a client, I will normally retain relevant client records for 6 years after the end of our coaching relationship. Information that is no longer necessary will be securely deleted sooner where appropriate.
If you enquire or apply but do not become a client, I will normally retain your information for 3 months, after which it will be securely deleted unless there is a legitimate reason to keep it for longer.
Certain financial records may need to be retained for longer to meet legal and tax requirements.
10. Your rights
Under UK data protection law, you may have rights including:
- the right to be informed about how your information is used;
- the right to access the personal information I hold about you;
- the right to ask for inaccurate information to be corrected;
- the right to ask for information to be erased in certain circumstances;
- the right to ask for processing to be restricted in certain circumstances;
- the right to object to certain processing;
- the right to data portability in certain circumstances; and
- the right to withdraw consent where processing is based on consent.
These rights are subject to certain legal exceptions and limitations.
If you would like to exercise a data protection right, please contact me using the details in section 2.
11. Complaints
If you have concerns about how I have handled your personal information, I would encourage you to contact me first so that I have an opportunity to address your concern.
You also have the right to complain to the Information Commissioner’s Office (ICO), which is the UK’s independent data protection regulator.
You can find information about making a complaint on the ICO’s website.
12. International transfers
Some of the technology and service providers I use may process personal information outside the UK.
Where personal information is transferred outside the UK, I will take appropriate steps to ensure that the transfer is lawful and that your information receives an appropriate level of protection under applicable data protection law.
13. Cookies and website information
If you access my website, information about cookies and similar technologies may be covered by a separate Cookie Notice.
Where applicable, this Privacy Notice should be read alongside my website’s Cookie Notice and Terms and Conditions.
14. Changes to this Privacy Notice
I may update this Privacy Notice from time to time to reflect changes to my services, the information I collect, or applicable legal requirements.
The latest version will be made available at www.guidedbygaiatarot.co.uk and will show the date it was last updated.
Last updated: 11 September 2026