Privacy Policy
Koru Women.
Website: https://www.koruwomen.com
Privacy contact: info.koruwomen@gmail.com
Last updated: 16 August 2026
Scope of this notice
This notice covers personal data collected through the Koru Women website, its Squarespace forms and mailing list, Calendly bookings, Stripe payments and Squarespace Analytics. The website and booking forms are not used to collect health information, coaching notes or client health records.
1. Who we are
Koru Women is operated by Jo Neale as a sole trader. Jo Neale trading as Koru Women is the data controller for the personal data described in this notice. This means Koru Women decides why and how that information is used.
If you have a question, wish to exercise a data protection right or want to make a complaint, email info.koruwomen@gmail.com.
2. Information we collect
We collect only the information needed to operate the website, respond to visitors, manage bookings, take payments, send requested marketing emails and understand how the website is used.
Contact and enquiry information: your name, email address, telephone number (if supplied), message and any other information you choose to provide through a contact form or email.
Newsletter information: your email address, name if requested, the date and method of sign-up, subscription preferences and email engagement information made available through Squarespace Email Campaigns.
Booking information: your name, email address, appointment type, chosen date and time, time zone and any non-health information you enter in Calendly.
Payment and transaction information: your name, contact and billing details, amount paid, payment status, transaction identifiers, refunds or disputes. Stripe processes full payment-card details; Koru Women does not receive or store your complete card number or security code.
Website and device information: IP address and approximate location, browser and device type, pages viewed, referring page, interaction information and cookie identifiers. Non-essential Squarespace Analytics cookies are used only after you consent.
Please do not submit health information
The website, contact form and Calendly booking form are not intended for health information or coaching notes. Please do not include medical conditions, menopause symptoms or other sensitive health details in these fields. If such information is submitted unexpectedly, Koru Women will limit access and delete it when it is not needed.
3. How and why we use personal data
UK data protection law requires a lawful basis for each use of personal data. The main activities covered by this website are set out below.
Activity and data
Purpose and lawful basis
Typical retention
Contact forms and enquiries
To respond, provide requested information and take steps before entering a contract. Lawful basis: legitimate interests and, where relevant, steps at your request before a contract.
Usually up to 12 months after the enquiry is resolved, unless it becomes part of a client, legal or accounting record.
Newsletter sign-ups
To send news, wellbeing content and service updates requested by you. Lawful basis: consent. Electronic marketing is also sent in accordance with PECR.
Until you unsubscribe or consent is otherwise withdrawn. A minimal suppression record may be retained so we do not contact you again.
Calendly bookings
To offer available appointments, confirm or change bookings and send service reminders. Lawful basis: steps before a contract and performance of a contract.
Normally up to 24 months after the appointment, unless a longer period is needed for a dispute or linked financial record.
Stripe payments
To take payment, issue refunds, prevent fraud and maintain transaction records. Lawful basis: performance of a contract, legal obligation and legitimate interests in preventing fraud and managing disputes.
Transaction and accounting records are generally kept for up to six years, or longer if law or an active dispute requires it.
Squarespace Analytics
To understand website traffic and improve the site. Lawful basis: consent for non-essential cookies and the related analytics processing.
According to the relevant cookie duration and Squarespace settings; consent choices can be changed at any time.
Legal and security matters
To protect the website, establish or defend legal claims and comply with legal requests. Lawful basis: legitimate interests and legal obligation, depending on the circumstances.
Only for as long as reasonably necessary for the relevant legal, security or limitation period.
4. Newsletter and direct marketing
Koru Women sends newsletter emails only where you have actively subscribed or another lawful exception applies. You can withdraw consent at any time by using the unsubscribe link in an email or by contacting info.koruwomen@gmail.com. Withdrawing consent does not affect processing that was lawful before withdrawal.
Koru Women does not sell or rent mailing-list information. Newsletter sign-up is separate from booking a service and is not a condition of making an enquiry, booking an appointment or paying.
5. Cookies and Squarespace Analytics
The website uses cookies and similar technologies. Strictly necessary cookies support functions such as security, navigation and remembering cookie choices. They do not require consent where the legal exemption for essential technologies applies.
Squarespace Analytics and other non-essential analytics or performance cookies are blocked until you select Accept in the cookie banner. You can select Reject or change your preferences later through the website's cookie settings. Rejecting non-essential cookies does not prevent you from using the core website.
The cookie settings panel lets you review and change your consent choices. Browser settings can also remove or block cookies, although doing so may affect some website functions.
The Squarespace cookie list explains the platform cookies that may be used and their typical purposes. Cookies actually present depend on the site's configuration: The cookies Squarespace uses.
6. Who receives personal data
Koru Women keeps personal data confidential and shares it only where necessary with service providers acting under appropriate contractual and confidentiality obligations, or where disclosure is required by law.
Squarespace, including Squarespace Email Campaigns, hosts the website, stores website contacts and mailing-list information, provides forms, manages consent choices and supplies website analytics.
Calendly provides appointment scheduling and processes the booking details you submit.
Stripe processes payments, payment security, fraud checks, refunds and transaction information. Stripe may also act as an independent controller for some payment and regulatory purposes.
Google provides the Gmail account used to receive and respond to enquiries.
Professional advisers, insurers, courts, regulators or public authorities may receive information where reasonably necessary to obtain advice, protect legal rights or comply with law.
These providers may collect additional information under their own privacy notices when you interact directly with their services. Their current notices are available here:
7. International transfers
Squarespace, Calendly, Stripe and Google operate internationally. Personal data may therefore be processed in the United States or other countries outside the UK. Where a restricted transfer occurs, Koru Women relies on the safeguards made available through its provider contracts, such as UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where applicable), the UK International Data Transfer Agreement or the UK Addendum to approved Standard Contractual Clauses.
You may contact Koru Women for further information about the relevant safeguards. Provider privacy notices contain additional details about their transfer arrangements.
8. How we protect personal data
Koru Women uses reasonable technical and organisational measures appropriate to the limited information processed through the website. These include password-protected accounts, access limited to those who need the information, multi-factor authentication where available, secure hosted services, software updates and deletion or anonymisation when information is no longer needed.
No online service can guarantee absolute security. If a personal-data breach creates a legal notification obligation, Koru Women will notify the Information Commissioner's Office and affected individuals as required.
9. Your data protection rights
Depending on the circumstances and the lawful basis used, UK data protection law may give you the right to:
be informed about how your personal data is used;
request access to your personal data;
ask for inaccurate or incomplete data to be corrected;
ask for personal data to be erased in certain circumstances;
ask for processing to be restricted in certain circumstances;
receive certain data in a portable format or ask for it to be transferred;
withdraw consent at any time where processing relies on consent; and
complain to the Information Commissioner's Office.
Your right to object
You have the right to object at any time to the use of your personal data for direct marketing. You may also object to processing based on legitimate interests. Koru Women will stop direct marketing and will consider other objections in accordance with the law.
Koru Women does not use website information to make decisions about you based solely on automated processing that produce legal or similarly significant effects.
To exercise a right, email info.koruwomen@gmail.com. Koru Women may need to verify your identity and will normally respond within one month. Rights are not absolute, and an exemption may apply in some circumstances.
10. Complaints
Please contact Koru Women first at info.koruwomen@gmail.com so the concern can be investigated and addressed.
You may also complain to the Information Commissioner's Office (ICO) through ico.org.uk/make-a-complaint or by calling 0303 123 1113.
11. Children
Koru Women's website and services are intended for adults and are not directed to children. Koru Women does not knowingly collect personal data from anyone under 18 through the website. If you believe a child has submitted information, please contact Koru Women so it can be reviewed and deleted where appropriate.
12. Links to other websites
The website may link to websites or services operated by other organisations. Koru Women does not control those services and is not responsible for their privacy practices. Please read the privacy notice of any external service you use.
13. Changes to this notice
Koru Women may update this notice when its website, service providers or legal obligations change. The current version will be published on the website with a revised 'Last updated' date. Material changes will be highlighted where appropriate.WEBSITE PRIVACY NOTICE
Koru Women — Jo Neale, sole trader
Website: https://www.koruwomen.com
Privacy contact: info.koruwomen@gmail.com
Last updated: 16 August 2026
Scope of this notice
This notice covers personal data collected through the Koru Women website, its Squarespace forms and mailing list, Calendly bookings, Stripe payments and Squarespace Analytics. The website and booking forms are not used to collect health information, coaching notes or client health records.
1. Who we are
Koru Women is operated by Jo Neale as a sole trader. Jo Neale trading as Koru Women is the data controller for the personal data described in this notice. This means Koru Women decides why and how that information is used.
If you have a question, wish to exercise a data protection right or want to make a complaint, email info.koruwomen@gmail.com.
2. Information we collect
We collect only the information needed to operate the website, respond to visitors, manage bookings, take payments, send requested marketing emails and understand how the website is used.
Contact and enquiry information: your name, email address, telephone number (if supplied), message and any other information you choose to provide through a contact form or email.
Newsletter information: your email address, name if requested, the date and method of sign-up, subscription preferences and email engagement information made available through Squarespace Email Campaigns.
Booking information: your name, email address, appointment type, chosen date and time, time zone and any non-health information you enter in Calendly.
Payment and transaction information: your name, contact and billing details, amount paid, payment status, transaction identifiers, refunds or disputes. Stripe processes full payment-card details; Koru Women does not receive or store your complete card number or security code.
Website and device information: IP address and approximate location, browser and device type, pages viewed, referring page, interaction information and cookie identifiers. Non-essential Squarespace Analytics cookies are used only after you consent.
Please do not submit health information
The website, contact form and Calendly booking form are not intended for health information or coaching notes. Please do not include medical conditions, menopause symptoms or other sensitive health details in these fields. If such information is submitted unexpectedly, Koru Women will limit access and delete it when it is not needed.
3. How and why we use personal data
UK data protection law requires a lawful basis for each use of personal data. The main activities covered by this website are set out below.
Activity and data
Purpose and lawful basis
Typical retention
Contact forms and enquiries
To respond, provide requested information and take steps before entering a contract. Lawful basis: legitimate interests and, where relevant, steps at your request before a contract.
Usually up to 12 months after the enquiry is resolved, unless it becomes part of a client, legal or accounting record.
Newsletter sign-ups
To send news, wellbeing content and service updates requested by you. Lawful basis: consent. Electronic marketing is also sent in accordance with PECR.
Until you unsubscribe or consent is otherwise withdrawn. A minimal suppression record may be retained so we do not contact you again.
Calendly bookings
To offer available appointments, confirm or change bookings and send service reminders. Lawful basis: steps before a contract and performance of a contract.
Normally up to 24 months after the appointment, unless a longer period is needed for a dispute or linked financial record.
Stripe payments
To take payment, issue refunds, prevent fraud and maintain transaction records. Lawful basis: performance of a contract, legal obligation and legitimate interests in preventing fraud and managing disputes.
Transaction and accounting records are generally kept for up to six years, or longer if law or an active dispute requires it.
Squarespace Analytics
To understand website traffic and improve the site. Lawful basis: consent for non-essential cookies and the related analytics processing.
According to the relevant cookie duration and Squarespace settings; consent choices can be changed at any time.
Legal and security matters
To protect the website, establish or defend legal claims and comply with legal requests. Lawful basis: legitimate interests and legal obligation, depending on the circumstances.
Only for as long as reasonably necessary for the relevant legal, security or limitation period.
4. Newsletter and direct marketing
Koru Women sends newsletter emails only where you have actively subscribed or another lawful exception applies. You can withdraw consent at any time by using the unsubscribe link in an email or by contacting info.koruwomen@gmail.com. Withdrawing consent does not affect processing that was lawful before withdrawal.
Koru Women does not sell or rent mailing-list information. Newsletter sign-up is separate from booking a service and is not a condition of making an enquiry, booking an appointment or paying.
5. Cookies and Squarespace Analytics
The website uses cookies and similar technologies. Strictly necessary cookies support functions such as security, navigation and remembering cookie choices. They do not require consent where the legal exemption for essential technologies applies.
Squarespace Analytics and other non-essential analytics or performance cookies are blocked until you select Accept in the cookie banner. You can select Reject or change your preferences later through the website's cookie settings. Rejecting non-essential cookies does not prevent you from using the core website.
The cookie settings panel lets you review and change your consent choices. Browser settings can also remove or block cookies, although doing so may affect some website functions.
The Squarespace cookie list explains the platform cookies that may be used and their typical purposes. Cookies actually present depend on the site's configuration: The cookies Squarespace uses.
6. Who receives personal data
Koru Women keeps personal data confidential and shares it only where necessary with service providers acting under appropriate contractual and confidentiality obligations, or where disclosure is required by law.
Squarespace, including Squarespace Email Campaigns, hosts the website, stores website contacts and mailing-list information, provides forms, manages consent choices and supplies website analytics.
Calendly provides appointment scheduling and processes the booking details you submit.
Stripe processes payments, payment security, fraud checks, refunds and transaction information. Stripe may also act as an independent controller for some payment and regulatory purposes.
Google provides the Gmail account used to receive and respond to enquiries.
Professional advisers, insurers, courts, regulators or public authorities may receive information where reasonably necessary to obtain advice, protect legal rights or comply with law.
These providers may collect additional information under their own privacy notices when you interact directly with their services. Their current notices are available here:
7. International transfers
Squarespace, Calendly, Stripe and Google operate internationally. Personal data may therefore be processed in the United States or other countries outside the UK. Where a restricted transfer occurs, Koru Women relies on the safeguards made available through its provider contracts, such as UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework where applicable), the UK International Data Transfer Agreement or the UK Addendum to approved Standard Contractual Clauses.
You may contact Koru Women for further information about the relevant safeguards. Provider privacy notices contain additional details about their transfer arrangements.
8. How we protect personal data
Koru Women uses reasonable technical and organisational measures appropriate to the limited information processed through the website. These include password-protected accounts, access limited to those who need the information, multi-factor authentication where available, secure hosted services, software updates and deletion or anonymisation when information is no longer needed.
No online service can guarantee absolute security. If a personal-data breach creates a legal notification obligation, Koru Women will notify the Information Commissioner's Office and affected individuals as required.
9. Your data protection rights
Depending on the circumstances and the lawful basis used, UK data protection law may give you the right to:
be informed about how your personal data is used;
request access to your personal data;
ask for inaccurate or incomplete data to be corrected;
ask for personal data to be erased in certain circumstances;
ask for processing to be restricted in certain circumstances;
receive certain data in a portable format or ask for it to be transferred;
withdraw consent at any time where processing relies on consent; and
complain to the Information Commissioner's Office.
Your right to object
You have the right to object at any time to the use of your personal data for direct marketing. You may also object to processing based on legitimate interests. Koru Women will stop direct marketing and will consider other objections in accordance with the law.
Koru Women does not use website information to make decisions about you based solely on automated processing that produce legal or similarly significant effects.
To exercise a right, email info.koruwomen@gmail.com. Koru Women may need to verify your identity and will normally respond within one month. Rights are not absolute, and an exemption may apply in some circumstances.
10. Complaints
Please contact Koru Women first at info.koruwomen@gmail.com so the concern can be investigated and addressed.
You may also complain to the Information Commissioner's Office (ICO) through ico.org.uk/make-a-complaint or by calling 0303 123 1113.
11. Children
Koru Women's website and services are intended for adults and are not directed to children. Koru Women does not knowingly collect personal data from anyone under 18 through the website. If you believe a child has submitted information, please contact Koru Women so it can be reviewed and deleted where appropriate.
12. Links to other websites
The website may link to websites or services operated by other organisations. Koru Women does not control those services and is not responsible for their privacy practices. Please read the privacy notice of any external service you use.
13. Changes to this notice
Koru Women may update this notice when its website, service providers or legal obligations change. The current version will be published on the website with a revised 'Last updated' date. Material changes will be highlighted where appropriate.