We use essential cookies to make our site work and improve user experience. Cookies can be deleted in your internet browser settings after using the website and will not impact future use. By clicking “Accept”, you agree to our website’s cookie use as described in our Cookie Policy.
Privacy Policy
Last updated 16 September 2026.
This notice explains what personal data Holistic Land collects when you use this website, why, who else receives it, how long we keep it and what you can ask us to do with it. It covers holistic.land, customer accounts, the partner (seller and practitioner) panel and the practitioner directory.
Who we are
Holistic Land is operated by Holistic Wellness Group Ltd, a company registered in England and Wales (company number 15280875), whose registered office is Suite A, 82 James Carter Road, Mildenhall, Suffolk, IP28 7DE, United Kingdom. For the personal data described here we are the controller under UK data protection law. You can reach us about anything in this notice through our contact page or at hello@holistic.land.
Holistic Land is a platform. Products, events and sessions are sold by independent partners, not by us. When you buy from or book with a partner, that partner also receives the details they need to fulfil your order, and handles them as a separate controller (see Partners you buy from).
What we collect
- Account details: your name, email address and password. We store the password only as a one-way hash, so nobody, including us, can read it.
- Order details: billing and delivery addresses, telephone number, what you bought or booked, prices and order status.
- Payment details: we do not receive or store card numbers. Card details go straight from your browser to Stripe, our payment provider.
- Messages: what you send us or a partner through the contact form, product questions, reviews and return requests.
- Partner details, if you sell or practise on Holistic Land: your business name and address, contact details, profile text, the location you list, qualification documents you upload, and your payout account (held by Stripe).
- Technical data: your IP address, browser type, the pages you request and when. Our servers record these for security and to diagnose faults.
- Searches: what you type into site search and practitioner search, including any location.
How we use it, and our lawful basis
| Purpose | Lawful basis |
|---|---|
| Running your account, taking payment, passing your order to the partner, handling delivery, returns and refunds | Contract |
| Keeping order and accounting records | Legal obligation (UK tax law) |
| Protecting the site against fraud, spam and misuse, and keeping server logs | Legitimate interests |
| Measuring how the site is used (Google Analytics) | Consent, given through the cookie notice |
| Sending newsletters and offers | Consent. You can unsubscribe at any time |
| Publishing a partner's profile, events and listed location | Contract with that partner |
We do not sell personal data, we do not use advertising or retargeting cookies, and we do not make automated decisions about you that have legal or similarly significant effects.
Partners you buy from
When you place an order or make a booking, the partner concerned receives your name, delivery address, contact details and what you ordered, so that they can fulfil it and answer questions about it. They must use those details only for that purpose. Partners can also see page-view and link-click statistics for their own listings (how often visitors opened their pages or followed a link to their own booking page or website), drawn from Google Analytics; these are totals, not information about individual visitors.
Some partners connect their own online shop to Holistic Land. If you bought from a partner there, the order, including your name, delivery address, telephone and email, is copied into Holistic Land so the partner can fulfil it here. That platform remains responsible for your relationship with it, but we answer any request you make to us about the copy we hold.
Who else receives your data
We use these service providers. Each receives only what is described.
| Provider | What they do | What reaches them |
|---|---|---|
| Amazon Web Services (London) | Hosts the website, database and backups | All data held on the site |
| Stripe | Card payments and partner payouts | Your card details, entered directly into Stripe; the amount and order reference; partner identity and bank details for payouts |
| Migadu (Switzerland) | Sends and receives our email | Email address and message content |
| Google Analytics | Site usage statistics, only after you allow cookies | Pages viewed, device and browser details, approximate location from your IP address |
| Google reCAPTCHA | Spam and abuse protection on the contact, review, newsletter and account forms | Your IP address and how you interact with the page |
| Google Fonts | Supplies the typefaces the site uses | Your IP address, as your browser downloads the fonts |
| Google Maps | Maps on event, venue and partner address pages | The address being shown, and your IP address as the map loads |
| OpenStreetMap Foundation (Nominatim) | Turns a location into map coordinates | The location a practitioner lists, or the location you type into practitioner search. No name, account or contact details |
| European Commission (VIES) | Checks a partner's VAT number | The VAT number and its country code |
| Connected sales channels | A partner's own online shop, when they connect one | Product listings, prices and stock sent out; orders placed on that channel copied in |
We may also disclose data where the law requires it, for example to HMRC or the police, or if the business is sold, in which case the buyer would take on this notice.
Transfers outside the UK
The website and its backups are hosted by Amazon Web Services in London, with a disaster-recovery copy in the European Union. Email is handled in Switzerland. Both are covered by UK adequacy regulations. Google and Stripe may process data in the United States; where they do, the transfer is covered by the UK Extension to the EU-US Data Privacy Framework or by standard contractual clauses.
How long we keep it
| Data | How long |
|---|---|
| Orders, invoices and partner payout records | 6 years from the end of the accounting year they fall in, as UK tax law requires |
| Customer accounts with no orders | Deleted 24 months after your last sign-in |
| Customer accounts with orders | Until you ask us to close the account; the order records stay for the 6 years above |
| Abandoned baskets | 90 days |
| Messages and support correspondence | 2 years after the matter is closed |
| Newsletter consent | While you are subscribed, and 2 years after you unsubscribe, as a record that we respected your choice |
| Server logs | 90 days |
| Backups | 30 days, then deleted automatically |
How we protect it
All connections to the site are encrypted, and data is also encrypted where it is stored, including backups. Access is limited to the two people who run the platform, with multi-factor authentication. Our servers accept administrative connections only by key and from a single address. If a breach puts your data at risk, we will tell you and, where required, the Information Commissioner's Office.
Your rights
You can ask us to:
- give you a copy of the personal data we hold about you;
- correct anything that is wrong;
- delete your data. We will delete what we can; order records inside the 6-year tax period have to be kept, and we will tell you exactly what was kept and why;
- restrict how we use your data, or object to a use based on legitimate interests;
- give you the data you provided in a machine-readable format;
- stop sending you marketing. This takes effect immediately.
Where we rely on consent, you can withdraw it at any time. Send any request through our contact page or to hello@holistic.land. We reply within one month. We may ask you to confirm the request from the email address on your account, but we will not ask for more personal data than we need to identify you.
If you are unhappy with how we have handled your data, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put it right first.
Cookies and similar storage
When you first visit, a notice asks whether you allow cookies. Until you do, the site sets only the cookies it needs to work. Google Analytics is not loaded until you allow it. Google reCAPTCHA, Google Fonts and Google Maps are loaded where a page needs them, so Google receives your IP address on those pages whatever you choose.
| Name | Purpose | Lasts |
|---|---|---|
| PHPSESSID | Keeps you signed in and holds your basket during your visit | 30 days |
| form_key | Protects forms against cross-site request forgery | 30 days |
| mage-cache-sessid, section_data_ids, private_content_version | Keep the basket, account links and messages up to date on cached pages | 30 days (private_content_version: up to 400 days) |
| mage-messages | Shows a confirmation or error message after an action | Removed once shown |
| user_allowed_save_cookie | Remembers your cookie choice | 1 year |
| _ga, _ga_PWH761T2YF | Google Analytics: distinguishes visitors so visits can be counted. Only set after you allow cookies | 400 days |
The site also stores recently viewed products and a copy of your basket and account links in your browser's local storage, so pages can show them without asking the server again. This stays on your device. You can clear cookies and local storage in your browser settings; the basket and sign-in will not work without the essential cookies.
Emails
We send emails about your orders, bookings, returns and account because the service needs them. We send newsletters and offers only if you have asked for them, and every one has an unsubscribe link.
Changes to this notice
We will update this page when what we do with personal data changes, and change the date at the top. If a change is significant, we will also tell account holders by email before it takes effect.
Contact us
Contact Us or email hello@holistic.land.
Privacy Menu
