Privacy Policy

This Privacy Policy explains how The Spiral LTD collects, uses, stores and protects personal data when you:

• visit flowingchangework.com;
• create an account;
• purchase a digital product or membership;
• use the HypnoQiGong Session Studio;
• generate or access personalised sessions;
• participate in our online community;
• subscribe to our emails;
• contact our support team; or
• otherwise interact with Flowing ChangeWork or HypnoQiGong.

We process personal data in accordance with the EU General Data Protection Regulation (“GDPR”), applicable Bulgarian data-protection legislation and other applicable privacy and electronic-communications laws.

The controller responsible for your personal data is:

The Spiral LTD
Company number: 202682740
Registered office:
Ul. Dimitar Blagoev 4
9500 General Toshevo
Bulgaria

Email: support@flowingchangework.com

In this Privacy Policy, “we”, “us” and “our” refer to The Spiral LTD.

“Services” includes the Flowing ChangeWork website, HypnoQiGong content, memberships, communities, digital products, the Session Studio and associated services.

The personal data we collect depends on how you interact with us.

3.1 Account and identity information

When you create an account, purchase a Product or join a Membership, we may collect:

• first and last name;
• email address;
• billing address;
• telephone number, if provided;
• username and account identifier;
• encrypted account credentials;
• preferred language;
• membership level;
• account status; and
• communication preferences.

3.2 Order and membership information

When you make a purchase or begin a trial, we may collect:

• products or memberships purchased;
• order number;
• purchase date;
• price, currency and applicable taxes;
• trial starting and ending dates;
• billing frequency;
• renewal and cancellation status;
• payment status;
• refunds and chargebacks; and
• discount or affiliate information connected with the transaction.

3.3 Payment information

Payments are processed through external payment providers.

We do not ordinarily receive or store your complete payment-card number, security code or full payment credentials. The payment provider may supply us with limited information such as:

• payment status;
• transaction identifier;
• payment method type;
• card brand;
• last digits of a payment card;
• payment country; and
• information required to process a refund or investigate fraud.

The payment provider shown at checkout processes payment information under its own privacy policy.

3.4 Session Studio and personalisation information

When you use the HypnoQiGong Session Studio or another personalisation tool, we may process:

• selected session goals or themes;
• selected movements;
• preferred music or audio settings;
• selected difficulty level;
• generated session history;
• date and time of session generation;
• technical information needed to assemble or deliver a session; and
• text or preferences you voluntarily enter.

Some session goals or information you enter could reveal information about your health, emotional state or other sensitive circumstances.

Please do not enter medical records, diagnoses or unnecessary sensitive personal information into free-text fields.

If we intentionally request or process special-category personal data, such as health information, we will identify an appropriate legal basis and, where required, request your explicit consent.

3.5 Service usage and technical information

When you use the Site or Services, we may automatically collect:

• IP address;
• browser and device type;
• operating system;
• approximate location derived from your IP address;
• login dates and times;
• pages and features accessed;
• session and video activity;
• error and diagnostic information;
• referring website;
• cookie identifiers; and
• security and fraud-prevention information.

We use this information to operate, secure and improve the Services.

3.6 Communications

When you contact us, we may collect:

• your name and contact details;
• the content of your message;
• attachments you choose to send;
• support history;
• complaints, cancellation or withdrawal requests; and
• our responses to you.

3.7 Marketing information

If you subscribe to marketing communications or otherwise lawfully receive them, we may process:

• your name and email address;
• language and areas of interest;
• subscription source and date;
• consent records;
• messages sent, delivered, opened or clicked;
• unsubscribe status; and
• campaign engagement information.

3.8 Community information

When you participate in a community, we may process:

• your display name;
• profile information;
• posts, comments and reactions;
• content you upload;
• moderation reports; and
• information relating to community-rule enforcement.

Information you publish in a community may be visible to other members. Do not post sensitive or confidential information unless you are comfortable sharing it with those members.

3.9 Reviews and testimonials

If you provide a review, feedback or testimonial, we may collect:

• your name;
• your written, audio or video feedback;
• your image or voice, if provided;
• your profession or location, if voluntarily supplied; and
• your permission concerning publication.

We will not publish an identifiable testimonial in marketing materials without an appropriate legal basis, such as your consent or a clear agreement with you.

You may withdraw consent for future use of an identifiable testimonial. This will not make earlier lawful processing unlawful, and it may not always be possible to retrieve material that has already been lawfully printed or independently shared by others.

We receive personal data:

• directly from you;
• automatically through your use of the Site;
• from payment processors;
• from membership, hosting, analytics and communication providers;
• from an affiliate or referral link you use;
• from social-media or advertising platforms where permitted;
• from a person purchasing something on your behalf; or
• from publicly available sources where lawful and relevant.

If another person provides us with your information, they are responsible for ensuring that they have permission to do so.

We process personal data only where we have a valid legal basis.

5.1 Performance of a contract

We process data where necessary to:

• create and manage your account;
• process an order or membership;
• provide trial or membership access;
• generate and deliver sessions;
• process payments and refunds;
• manage renewals, cancellations and upgrades;
• provide customer support;
• provide included membership benefits; and
• communicate important service information.

Without the required information, we may be unable to provide the Product or Service you requested.

5.2 Legal obligations

We process data where necessary to:

• maintain accounting and tax records;
• comply with consumer-protection obligations;
• respond to lawful requests from authorities;
• handle statutory withdrawal requests;
• comply with fraud-prevention and financial obligations; and
• establish compliance with applicable laws.

5.3 Legitimate interests

Where your rights do not override our interests, we may process data to:

• secure the Site and user accounts;
• prevent fraud, abuse and unauthorised access;
• maintain and improve the Services;
• understand how customers use our Products;
• troubleshoot errors;
• protect our intellectual property;
• enforce our Terms and Conditions;
• maintain records of customer service communications;
• defend or establish legal claims;
• measure general business performance; and
• communicate with existing customers about closely related Products where legally permitted.

When relying on legitimate interests, we consider the nature of the data, the reasonable expectations of the person involved and the potential effect of the processing.

5.4 Consent

We may rely on your consent for:

• non-essential analytics or marketing cookies;
• certain email marketing;
• publishing identifiable testimonials;
• processing special-category personal data where explicit consent is required; and
• other optional processing clearly explained when consent is requested.

You may withdraw consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

5.5 Legal claims and substantial interests

Where legally permitted, we may process information necessary to establish, exercise or defend legal claims or protect someone’s vital interests.

The Session Studio may automatically combine your selected goals, movements, audio preferences and other settings to produce a personalised session.

This processing is used to provide the Service you request. It does not ordinarily make a legal decision or another decision that produces a similarly significant effect about you.

We do not use Session Studio selections to diagnose a medical or psychological condition.

Where third-party technology is involved in generating or processing content, we take reasonable steps to limit the personal information transmitted to what is necessary for the relevant purpose.

We may send:

• transactional emails relating to purchases, memberships and accounts;
• service announcements;
• security notifications;
• support communications;
• requested downloads or information; and
• marketing communications where permitted.

Transactional and essential service messages are not marketing messages and may still be sent when you have opted out of promotional email.

You may unsubscribe from marketing by:

• clicking the unsubscribe link in an email;
• changing available account preferences; or
• contacting support@flowingchangework.com.

We may retain a minimal suppression record after you unsubscribe to ensure that we respect your preference.

Unsubscribing from marketing does not automatically cancel a paid membership.

We use cookies and related technologies to:

• operate the Site;
• keep you signed in;
• remember choices and preferences;
• secure accounts and transactions;
• manage shopping-cart and checkout functions;
• analyse Site performance;
• understand how the Services are used; and
• support advertising and campaign measurement where consent has been provided.

Essential cookies may be used without consent where they are strictly necessary to provide a Service you requested.

Non-essential analytics, personalisation and advertising cookies will be used only where permitted by law and, where required, after you have provided consent.

You can manage non-essential cookies through the cookie controls available on the Site. You may also restrict cookies through your browser, although blocking essential cookies can prevent parts of the Site from working.

Further details about individual cookies, providers and retention periods should be provided in the Site’s Cookie Policy or cookie-preference panel.

We do not sell personal data.

We may share limited personal data with service providers that help us operate the business, including:

• website and database hosting providers;
• membership and account-management providers;
• payment processors;
• email delivery and customer-communication providers;
• analytics and cookie-consent providers;
• cloud-storage and content-delivery providers;
• video, audio and community platforms;
• customer-support and security providers;
• professional advisers such as accountants, lawyers and auditors;
• contractors working under confidentiality obligations; and
• authorities where disclosure is legally required.

These parties may act as processors acting on our instructions or, in some cases, as independent controllers with their own legal responsibilities.

We require processors to use personal data only for agreed purposes and to provide appropriate confidentiality and security protections.

We may also disclose data:

• to investigate fraud, abuse or security incidents;
• to enforce our agreements;
• to protect our rights or the safety of others;
• in connection with a merger, restructuring or sale of all or part of the business; or
• when required by law, court order or a competent authority.

We do not provide personal data to unrelated third parties for their own direct-marketing purposes.

Some service providers may process personal data outside Bulgaria or outside the European Economic Area.

Where personal data is transferred outside the European Economic Area, we use a legally recognised transfer mechanism where required, such as:

• an adequacy decision adopted by the European Commission;
• European Commission Standard Contractual Clauses;
• another legally permitted safeguard; or
• a specific GDPR derogation where applicable.

Additional technical or organisational safeguards may be applied where appropriate.

You may contact us for further information about the safeguards relevant to your personal data.

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected.

Retention is determined by:

• the duration of your account or membership;
• the need to provide purchased Products or Services;
• statutory tax, accounting and consumer-protection requirements;
• limitation periods for legal claims;
• fraud and security considerations;
• the nature and sensitivity of the data; and
• whether you have withdrawn consent or requested deletion.

In general:

• account data is retained while the account is active and for a reasonable period afterwards;
• purchase, invoice and payment records are retained for the period required by Bulgarian tax and accounting law;
• support and complaint records are retained for as long as necessary to resolve the matter and protect legal rights;
• Session Studio data is retained while needed to provide generated-session functionality or maintain your session history;
• marketing data is retained until you unsubscribe, withdraw consent or the data is no longer useful, subject to maintaining a minimal suppression record;
• cookie and analytics data is retained according to the periods displayed in the cookie controls or applicable provider settings;
• community content may remain visible while the community operates unless it is deleted or removal is legally required; and
• consent records may be retained for as long as necessary to demonstrate compliance.

We may anonymise data so it can no longer be linked to you. Anonymised information may be retained for statistics, research and service improvement.

We use appropriate technical and organisational measures designed to protect personal data from:

• unauthorised access;
• unlawful processing;
• accidental loss;
• alteration;
• disclosure; and
• destruction.

Measures may include access controls, secure connections, restricted administrative access, backups, monitoring and contractual confidentiality obligations.

No internet-based system can be guaranteed completely secure. You are responsible for using a strong password and protecting your login details.

If we become aware of a personal-data breach, we will investigate and notify the relevant authority and affected individuals where legally required.

Depending on the circumstances, you may have the right to:

• receive information about how your data is processed;
• request access to your personal data;
• correct inaccurate or incomplete data;
• request deletion of personal data;
• restrict certain processing;
• object to processing based on legitimate interests;
• object to direct marketing;
• receive certain data in a structured, commonly used and machine-readable format;
• request transfer of eligible data to another controller;
• withdraw consent at any time;
• obtain information about applicable international-transfer safeguards; and
• lodge a complaint with a supervisory authority.

These rights are not absolute. For example, we may need to retain certain transaction information to comply with legal obligations or defend legal claims.

To exercise a right, contact:

support@flowingchangework.com

We may request reasonable information to verify your identity. We will respond within the period required by applicable law, normally within one month. More time may be required for complex or multiple requests, in which case we will inform you.

We do not ordinarily charge a fee. A reasonable fee may be charged, or a request may be refused, if it is manifestly unfounded or excessive as permitted by law.

Please contact us first if you have a concern about how we process your personal data:

support@flowingchangework.com

You also have the right to complain to the Bulgarian supervisory authority:

Commission for Personal Data Protection
2 Prof. Tsvetan Lazarov Blvd.
1592 Sofia
Bulgaria

Email: kzld@cpdp.bg
Website: www.cpdp.bg

If you live in another EEA country, you may also contact the data-protection authority in your country of residence.

The Services are intended for people aged 18 or older.

We do not knowingly collect personal data from children through the Services. If you believe that a child has provided us with personal data, contact us so that we can investigate and delete it where appropriate.

The Site may contain links to third-party websites or integrate external services.

Those parties may process personal data under their own privacy policies. We are not responsible for the privacy practices of services we do not control. You should review their policies before providing information.

If The Spiral LTD or part of its business is sold, merged, reorganised or transferred, relevant personal data may be disclosed to professional advisers and prospective or actual acquirers.

Any recipient will be required to protect the information and use it only for purposes consistent with applicable law and this Privacy Policy, unless you are informed otherwise.

We may update this Privacy Policy to reflect:

• changes to our Services;
• new technology or service providers;
• changes in our processing activities;
• legal or regulatory developments; or
• improvements to clarity and transparency.

The latest version will always be published on this page with an updated revision date.

Where a change materially affects how we use your personal data, we will provide additional notice where required.

For privacy questions, requests or complaints, contact:

The Spiral LTD
Ul. Dimitar Blagoev 4
9500 General Toshevo
Bulgaria

Email: support@flowingchangework.com