GDPR Privacy Notice

1. Data Controller

She Who Returns is the data controller responsible for your personal data. We are based in Italy and can be contacted at:

2. Legal Bases for Processing

We process your personal data on the following legal bases under Article 6 of the GDPR:

3. Categories of Personal Data

We process the following categories of personal data:

• Identity Data: Name, username/handle, profile photos, avatar
• Contact Data: Email address, city, country
• Spiritual & Astrological Data: Date of birth, time of birth, birth location, zodiac sign, Human Design type, Saturn Return phase, quiz responses
• Financial Data: Subscription tier, payment history (processed by Stripe — we do not store card details)
• Communication Data: Community posts, comments, chat messages, direct messages, booking notes
• Technical Data: IP address, browser type, device data, cookies
• Usage Data: Page views, feature interactions, video watch history, content engagement
• Profile Data: Bio, interests, spiritual practices, profile completeness, privacy preferences

4. Special Categories of Data

We may process data relating to your spiritual beliefs and practices, which may constitute special category data under Article 9 of the GDPR. This data is processed based on your explicit consent (Art. 9(2)(a)), which you provide when you voluntarily submit this information through your profile, quiz responses, or interactions with our spiritual tools. You may withdraw this consent at any time by deleting the relevant information from your profile or contacting us.

5. Your Rights Under GDPR

As an EEA/UK data subject, you have the following rights:

• Right of Access (Art. 15): Request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete data. You can update most information directly through your profile settings.
• Right to Erasure (Art. 17): Request deletion of your personal data ("right to be forgotten"). You can delete your account through Account Settings, or contact us for a complete data erasure request.
• Right to Restriction (Art. 18): Request that we limit processing of your data in certain circumstances.
• Right to Data Portability (Art. 20): Request a machine-readable copy of data you have provided to us.
• Right to Object (Art. 21): Object to processing based on legitimate interests, including profiling for compatibility matching.
• Right to Withdraw Consent (Art. 7(3)): Withdraw consent at any time without affecting the lawfulness of prior processing.
• Right to Lodge a Complaint: File a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or your local supervisory authority.

To exercise any of these rights, email us at privacy@shewho-returns.com. We will respond within 30 days. We may request identity verification before processing your request.

6. International Data Transfers

As our service providers may be located outside the EEA, your data may be transferred internationally. We ensure adequate protection through:

• EU Adequacy Decisions: Transfers to countries the European Commission has determined provide adequate data protection.
• Standard Contractual Clauses (SCCs): EU-approved contractual clauses with our service providers.
• EU-US Data Privacy Framework: For applicable US-based providers certified under the framework.

7. Data Retention Periods

• Account Data: Retained while your account is active and for 30 days after deletion request.
• Transaction Records: Retained for 10 years as required by Italian tax law.
• Community Content: Removed upon account deletion (except where required by law).
• Analytics Data: Anonymized and retained indefinitely for aggregate analysis.
• Communication Logs: Retained for the duration of your membership plus 90 days.
• Cookies: Essential cookies expire at session end; others as specified in our cookie settings.

8. Automated Decision-Making

We use automated processing for member compatibility matching and personalized content recommendations. These features use your profile data and preferences to suggest connections and content. This processing does not produce legal effects and does not significantly affect you. You can object to automated processing by contacting us or adjusting your privacy settings.

9. Data Protection Officer

For any data protection inquiries or to exercise your GDPR rights, please contact:

10. Supervisory Authority

If you are not satisfied with our handling of your data, you have the right to lodge a complaint with: