Privacy Policy - Spirit Baby Love

Last updated: 24 August 2026

1. Controller

The controller responsible for processing personal data on this website and in connection with the services offered is:

Marilena Bisaccia-Bijelic
trading as Spirit Baby Love
Reininghausstraße 86/513
8020 Graz
Austria

Email: hello@spiritbabylove.com
Website: https://spiritbabylove.com

In this Privacy Policy, “Spirit Baby Love”, “I”, “me” and “my” refer to the controller named above.

2. Scope of this Privacy Policy

This Privacy Policy explains what personal data I process when you:

visit my website,
contact me,
book a live session,
order a Personal Voice Message,
make a payment.

Personal data is information relating to an identified or identifiable person. Special categories of personal data include health data. Information about fertility, pregnancy, pregnancy loss, physical health or mental health may fall within this category.

3. Technical provision, hosting and security of the website

This website is operated with WordPress and WooCommerce and is provided using WordPress.com and Automattic services. When you access the website, technically necessary data is processed, including:

your IP address,
date and time of access,
pages or files requested,
browser type, operating system and device characteristics,
referring URL,
technical error and security data.

This processing is necessary to deliver the website, maintain its stability and security, prevent attacks and resolve technical errors. The legal basis is Article 6(1)(f) GDPR. My legitimate interest is the secure and reliable operation of the website.

Automattic may act as a processor or, for certain features used for its own purposes, as an independent controller. Please see the Automattic Privacy Policy and the Privacy Notice for Visitors to Automattic Users’ Sites for further information.

4. Cookies, language settings and audience measurement

4.1 Strictly necessary cookies

The website uses strictly necessary cookies and similar storage technologies. These are used, for example, to:

remember your language selection,
operate the shopping cart and checkout,
maintain a secure session,
provide booking and payment functions,
remember your cookie choices.

These technologies are required to provide website functions requested by you. Where personal data is processed, the legal basis is Article 6(1)(b) or (f) GDPR. Non-essential cookies or similar technologies are not used without your prior consent.

I use Complianz to manage cookie consent and control the loading of non-essential scripts. Complianz stores strictly necessary consent cookies on your device so that your selection can be remembered and applied. The legal basis is Article 6(1)(f) GDPR; my legitimate interest is operating a legally compliant consent mechanism. Further information is available in the Complianz Privacy Statement.

4.2 Jetpack statistics and performance measurement

If you consent through the cookie banner, I may use Jetpack Stats and related statistics and performance functions provided by Automattic. Depending on the function, this may involve the processing of full or shortened IP addresses, device and browser data, pages visited, referring pages, timestamps and interactions.

The purpose is to understand how the website is used and to improve its content and technical performance. The legal basis is your consent under Article 6(1)(a) GDPR. You may withdraw your consent at any time with future effect through the cookie settings. Withdrawal does not affect the lawfulness of processing before withdrawal.

Further information is available in the Automattic Cookie Policy.

5. Contact form and email communication

If you contact me using the contact form or by email, I process in particular:

your name,
your email address,
the contents of your message,
the time and technical metadata of the transmission.

This data is processed to answer your message and, where applicable, to take steps before entering into a contract. The legal basis is Article 6(1)(b) GDPR where your message relates to a booking or another pre-contractual request, and otherwise Article 6(1)(f) GDPR. My legitimate interest is the orderly handling of enquiries.

The contact form is provided through Jetpack Forms. Akismet may be used to prevent spam and abuse. Form data and technical data may be transmitted to Automattic for this purpose. The legal basis is Article 6(1)(f) GDPR; my legitimate interest is protecting the website and my communications against spam and abuse.

Business email is provided through Titan Mail. More information is available in the Titan Privacy Policy.

Please provide only the information required for your general enquiry. If you voluntarily provide information concerning fertility, pregnancy, pregnancy loss or health in the contact form, I process it only with your explicit consent under Article 9(2)(a) GDPR.

6. Booking live sessions through Bookly

I use Bookly as a booking system within my WordPress website for the live services “Time with Your Baby” and “Empowered Conception”. I process:

your name,
your email address,
the service booked,
the date, time and time zone of the appointment,
booking and payment status,
information you choose to provide,
technical booking data.

A telephone number is not required and is not collected for booking.

The data is processed to handle the booking, manage the appointment, communicate with you, process payment and perform the contract. The legal basis is Article 6(1)(b) GDPR. I also process tax-relevant booking and payment information under Article 6(1)(c) GDPR.

Google Calendar

Booked appointments are synchronised with my Google Calendar. The calendar entry contains your name and email address, the booked service, and the date and time. Free-text notes containing sensitive information are not transferred to the calendar.

Google Calendar is used to organise appointments and perform the contract. The legal basis is Article 6(1)(b) GDPR. Further information is available in the Google Privacy Policy.

7. Live sessions through Zoom and recordings

The live services “Time with Your Baby” and “Empowered Conception” take place through Zoom. Depending on how you use Zoom, Zoom processes in particular:

your display name,
your email address if you provide it to Zoom,
IP address and device and connection data,
audio and, where enabled, video data,
meeting metadata,
chat content if you use the chat function.

Zoom is required to conduct the booked online session. The legal basis is Article 6(1)(b) GDPR. Further information is available in the Zoom Privacy Statement.

Recording included as standard

A recording is included as a standard element of the live services. The session is recorded to the Zoom cloud and is then made available to you through a private link. The recording may contain your voice, image, the contents of the conversation and sensitive information that you voluntarily share.

The processing of general audio, video and conversation data is necessary to perform the booked service and is based on Article 6(1)(b) GDPR. To the extent that the recording contains special categories of personal data, such data is processed on the basis of your explicit consent under Article 9(2)(a) GDPR.

If you do not want a recording, please tell me by email before the session begins. The session can then take place without being recorded. Withdrawal of consent operates for the future and does not affect the lawfulness of processing carried out before withdrawal.

The cloud recording is deleted 30 days after the session. The private download link is intended to remain available for that period. Please download the file within this period if you wish to keep it permanently. Spirit Baby Love will not publish or otherwise use the recording without an additional, separate consent.

8. Personal Voice Message

If you order a Personal Voice Message, I process:

your order and contact details,
payment information and order number,
the text or question you voluntarily enter,
the audio file created for you,
dispatch and delivery information.

You may leave the free-text field empty. Please share only the information that you consider relevant to the creation of your message.

The data is processed to create and deliver the individually ordered service under Article 6(1)(b) GDPR. If your text or audio file contains information concerning fertility, pregnancy, pregnancy loss or health, I process it on the basis of your explicit consent under Article 9(2)(a) GDPR.

The audio file is sent through Titan Mail. Apple Mail Drop may be used for larger files. According to Apple, a Mail Drop link remains available for 30 days. More information is available in the Apple Privacy Policy and the Titan Privacy Policy.

My local working copy of the audio file is deleted 30 days after dispatch. Sensitive free-text information stored in WooCommerce for the purpose of creating the message is also removed from operational order data after 30 days, unless a legal obligation or a specific legal dispute requires longer retention. Tax-relevant order information remains stored without the sensitive free text in accordance with statutory retention obligations.

9. WooCommerce and orders

I use WooCommerce for the online shop and the Personal Voice Message. Orders are currently placed as guest orders; customer accounts are not offered. If you place an order, the following data is processed in particular:

your name and email address,
billing country and any other information required for billing,
order number, product, price, currency and payment status,
technical log and security data.

The data is processed to fulfil your order, communicate with you and comply with statutory record-keeping duties. The legal bases are Article 6(1)(b) and (c) GDPR.

10. Payments

Depending on the service, payments may be available through PayPal, Stripe, WooPayments and supported card or wallet methods such as Apple Pay or Google Pay. When you select a payment method, the relevant payment provider receives the information required to process the payment, such as your name, email address, billing information, amount, currency, order number, device data and fraud-prevention data.

I generally do not receive your full card number or security code. I receive payment confirmations, status information and information required for accounting, refunds and fraud prevention.

Payment processing is necessary to perform the contract and is based on Article 6(1)(b) GDPR. Payment records required by law are retained under Article 6(1)(c) GDPR. Payment providers may act as independent controllers for certain purposes, including identity verification, fraud prevention and compliance with financial regulation.

Further information:

11. Special categories of personal data

In connection with my services, you may voluntarily share information about fertility, pregnancy, pregnancy loss, grief, physical health or mental health. This information may constitute special categories of personal data under Article 9 GDPR.

I process such information only to the extent that you voluntarily provide it and explicitly consent to its processing for the requested or booked service. The legal basis is Article 9(2)(a) GDPR in conjunction with Article 6(1)(a) or (b) GDPR.

You may withdraw this consent at any time with future effect by emailing hello@spiritbabylove.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Because certain information may form an integral part of a recording or Personal Voice Message that has already been created, withdrawal cannot retroactively undo processing that has already occurred. Existing copies will, however, be deleted where legally and technically possible, unless a retention obligation or the establishment, exercise or defence of legal claims requires otherwise.

12. Recipients, processors and transfers outside the EEA

I disclose personal data only where this is necessary for the purposes described above, where you have consented or where disclosure is required by law. Recipients may include:

Automattic/WordPress.com, Jetpack, Akismet and WooPayments for hosting, website, form, shop, security, statistics and payment functions,
Google for appointment management in Google Calendar,
Zoom for live sessions and cloud recordings,
Titan for email communication,
Apple for Mail Drop and, if selected, Apple Pay,
Stripe and PayPal for payment processing,
Google if Google Pay is selected,
tax advisers, authorities, courts or other professional advisers where legally required or necessary for the establishment, exercise or defence of legal claims.

Some providers operate internationally and may process data outside Austria or the European Economic Area. Where there is no European Commission adequacy decision for the recipient country, appropriate safeguards are used depending on the provider and processing, such as the European Commission’s Standard Contractual Clauses or a valid certification under the EU-US Data Privacy Framework. Please refer to each provider’s privacy information linked above for details.

13. Retention periods

I retain personal data only for as long as it is required for the relevant purpose or to comply with legal obligations. The following standard periods are intended to apply:

Type of data	Standard retention period
General enquiries	up to 12 months after the enquiry is closed
Booking and contractual correspondence	generally up to 3 years after the service, unless a longer obligation or legal dispute applies
Google Calendar entries	generally up to 3 years after the appointment
Zoom cloud recording	30 days after the session
Local working copy of a Personal Voice Message	30 days after dispatch
Mail Drop file or link	30 days according to Apple
Sensitive free-text information for a Personal Voice Message	generally 30 days after dispatch
Tax-relevant invoice, order and payment records	generally 7 years under Austrian retention obligations; longer where proceedings are pending
Records of consent	for as long as required to demonstrate lawful processing, generally until relevant claims are time-barred

Technical logs and security data are deleted or anonymised in accordance with the settings and retention rules of the relevant providers. Where a specific legal dispute is threatened or pending, data required for that matter may be retained until it has been finally resolved.

14. Your data protection rights

Subject to the applicable legal conditions, you have the right to:

obtain access to your personal data,
rectify inaccurate or incomplete data,
request erasure,
restrict processing,
receive data in a portable format,
object to processing based on legitimate interests,
withdraw consent with future effect,
lodge a complaint with a data protection supervisory authority.

To exercise your rights, email hello@spiritbabylove.com. I may request additional information where necessary to confirm your identity.

15. Right to lodge a complaint

You may lodge a complaint with a data protection supervisory authority. The authority responsible for me is in particular:

Austrian Data Protection Authority
Barichgasse 40–42
1030 Vienna
Austria
https://www.dsb.gv.at

You may also contact the supervisory authority of your habitual residence in the European Economic Area.

16. Required information and automated decisions

Your name, email address and the booking, order and payment details required in each case are necessary to enter into and perform a contract. I cannot process the booking or order without this information.

Sensitive personal information is required only to the extent that you choose to make it part of your enquiry or session. The free-text field for a Personal Voice Message may be left empty.

I do not make decisions based solely on automated processing that produce legal or similarly significant effects. Payment providers may carry out their own automated fraud-prevention or payment-approval checks; their privacy policies apply to those activities.

17. Persons under 18

My online-bookable services are intended exclusively for persons aged 18 or over. I do not knowingly direct the website or services to minors and do not knowingly collect their personal data.

18. Data security

I use appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure or alteration. These measures include access restrictions, password-protected accounts, encrypted transmission, current software and limited retention periods. No electronic system can guarantee absolute security.

19. Changes to this Privacy Policy

I may update this Privacy Policy if my services, providers or legal requirements change. The version published on this website at the relevant time applies. Material changes will be highlighted separately where appropriate.