PRIVACY
POLICY.

DATA CONTROLLER

The controller responsible for processing personal data through this website is:

PROCESSING PRINCIPLES

Personal data is processed lawfully, fairly and transparently. We collect only data that is relevant for clearly defined purposes, keep it accurate where necessary, retain it only as long as required and protect it with appropriate technical and organisational measures.

We do not sell personal data. Where a service provider processes data on our behalf, it is selected and contracted in accordance with applicable data-protection requirements.

HOSTING & SERVER LOGS

This website and its email services are hosted by STRATO GmbH, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. When the website is accessed, technical data may be processed in server log files, including IP address, date and time, requested page, referrer URL, browser, operating system, device information and response status. STRATO states that host names and IP addresses in customer access logs are anonymised.

The purpose is secure, stable and efficient website delivery, error analysis and protection against misuse. The legal basis is our legitimate interest in a secure and functional online service under Article 6(1)(f) GDPR. Where processing is necessary to provide a requested contractual service, Article 6(1)(b) GDPR may also apply.

ORDERS & DIGITAL PRODUCTS

When an order is placed, we process the data required for contract performance, payment allocation, invoicing, digital delivery and customer support. This can include name, email address, billing details, order information, purchased products, payment status, transaction reference and download delivery records.

The legal basis is performance of a contract or steps requested before entering into a contract under Article 6(1)(b) GDPR. Data required for tax, accounting or commercial-law obligations is processed under Article 6(1)(c) GDPR.

WordPress, Elementor and WooCommerce are used as self-hosted software on the STRATO server to operate the website, product catalogue, cart, checkout, order management and digital delivery. Complianz is used on this WordPress installation to manage consent choices and the cookie notice.

PAYMENT PROVIDERS

Payment information is transmitted to the payment provider selected during checkout to process the transaction, prevent fraud and meet regulatory obligations. We normally receive confirmation, transaction reference, payment status and limited customer and payment information, but do not store complete card details.

The legal basis is Article 6(1)(b) GDPR for contract performance and, where applicable, Article 6(1)(c) or (f) GDPR for legal compliance and fraud prevention.

CONTACT & SUPPORT

If you contact us by form or email, we process your contact details, message and related information to respond. Email communication is handled through the domain email service hosted by STRATO. The legal basis is Article 6(1)(b) GDPR for contract-related enquiries and Article 6(1)(f) GDPR for other enquiries.

COOKIES & SIMILAR TECHNOLOGIES

Cookies and similar technologies may store or access information on your device. Necessary technologies support functions such as security, cart, checkout, order processing and consent preferences. They are used only to the extent required for the requested service or our legitimate interest in secure operation.

No separate analytics or marketing service is currently listed in this policy. If a non-essential service is added, it will be activated only after consent where legally required. Consent can be rejected or withdrawn as easily as it was given through the permanent cookie settings control.

The current cookie names, providers, purposes and durations are documented in the Cookie Policy generated and maintained through Complianz. Cookie choices can be changed at any time using the cookie settings control.

SOFTWARE, CONSENT & SELF-HOSTED MEDIA

RECIPIENTS & INTERNATIONAL TRANSFERS

Recipients are limited to the providers required for the relevant service: STRATO GmbH in Germany for hosting and domain email; Stripe Payments Europe, Limited in Ireland for Stripe payments; PayPal (Europe) S.à r.l. et Cie, S.C.A. in Luxembourg for PayPal payments; and professional advisers or public authorities where disclosure is legally required. WordPress, WooCommerce, Elementor and Complianz are operated as software on the STRATO hosting environment.

Where Stripe, PayPal or their contracted service providers transfer personal data outside the European Economic Area, they use an applicable adequacy decision, the EU–US Data Privacy Framework where available, standard contractual clauses or another lawful transfer mechanism described in their privacy information.

RETENTION & DELETION

Personal data is stored only as long as necessary for the relevant purpose. Order, invoice and payment records are retained for the periods required by applicable tax and commercial law. Digital delivery records are retained only as long as necessary to provide the purchased files and handle related support or legal claims.

Contact messages are retained until the enquiry is resolved and, where necessary, for the applicable limitation period. Consent records are retained as evidence of compliance for as long as required to establish, exercise or defend legal claims. STRATO hosting access logs are available for up to six weeks. Payment providers retain transaction data in accordance with their own legal and regulatory duties.

YOUR RIGHTS

Subject to the legal conditions, you may request access to your personal data, rectification of inaccurate data, erasure, restriction of processing, data portability and objection to processing. You may also withdraw consent at any time and object to direct marketing.

You have the right not to be subject to a decision based solely on automated processing, including profiling, where it produces legal or similarly significant effects, unless a lawful exception applies. Shanti Frequency does not currently use such automated decision-making unless expressly disclosed here.

Send requests to hello@shantifrequency369.com. We may request information necessary to verify identity. Requests are handled without undue delay and normally within one month, subject to the extensions permitted by law.

COMPLAINTS, MINORS & POLICY UPDATES

Right to complain

You may lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos — AEPD) or another competent supervisory authority. Website: www.aepd.es.

Minors

This commercial website is not directed to children under 14 and we do not knowingly request their consent for data processing. Where parental or guardian consent is legally required, the appropriate verification measures must be used.

Updates

We may update this policy when services, providers or legal requirements change. The version published on this page applies from the date shown below.

LAST UPDATED: 2 OCTOBER 2026