The Crafty Herbalist Academy Privacy policy

Last updated: 4th September 2026

This policy explains what personal information The Crafty Herbalist Academy collects, why we collect it, what we do with it, and what rights you have over it.

Please read it before you join the Academy, sign up to our mailing list, or send us your details.

1. Who we are

The Crafty Herbalist Academy is operated by Kristine De Block, trading as The Crafty Herbalist Academy.

We are the data controller for the information described in this policy. That means we decide what information is collected and what happens to it.

Our contact details are:

Kristine De Block The Crafty Herbalist Academy 94 Sunnyside Road Chesham Buckinghamshire HP5 2AP United Kingdom

Email: kristine@thecraftyherbalist.org.uk

We are registered with the Information Commissioner’s Office, registration number ZA371672.

We are not required to appoint a Data Protection Officer. Any question about your personal information should be sent to the email address above and will be dealt with by Kristine.

2. What this policy covers

This policy covers the Academy website, the membership portal, our mailing list, our live classes and community forum, and any correspondence between us.

It does not cover third-party websites we link to, which have their own policies.

This policy also does not cover Kristine’s herbal practice, which is separate from the Academy. If you are a client of the practice, the information held about you is governed separately and is not part of the Academy’s records.

3. The information we collect

Depending on how you interact with us, we may collect:

Information you give us

your name
your email address
your postal address, where we need it for invoicing
your payment details, which are collected and processed by our payment providers and are never seen or stored by us
your display name, camera image and voice if you take part in a live class
assignments, quiz answers, practical write-ups and photographs you submit
posts, comments and messages you write in the community forum
anything you tell us by email, through a contact form, in a survey, or on social media

Information we collect automatically

your IP address, browser type, device information and time zone
which pages you visit, how long you spend on them, and how you arrived
your login records and activity within the membership portal
your marketing preferences, and whether you open our emails

4. How we use your information, and our legal basis

Under UK data protection law we must have a lawful basis for each use. Ours are:

To provide the Academy to you – setting up your account, giving you access to course material, marking your assignments, running live classes and the forum, and answering your questions. Legal basis: performance of our contract with you.

To take payment and manage your subscription – processing payments, handling renewals, chasing failed payments. Legal basis: performance of our contract with you.

To send you emails about your membership – class dates, module releases, changes to the Academy, account and payment notices. Legal basis: performance of our contract with you.

To send you our newsletter and information about our courses and offers. Legal basis: your consent, or our legitimate interest in telling existing members about our own similar courses. You can unsubscribe at any time.

To improve the website and understand how it is used. Legal basis: your consent, given through our cookie banner.

To advertise the Academy – showing our adverts to people on Facebook, and measuring how well those adverts work. This uses the Meta pixel on our website. Legal basis: your consent, given through our cookie banner.

To keep proper business records – orders, invoices, tax records and correspondence. Legal basis: compliance with our legal obligations.

To protect the Academy – investigating misuse of materials, account sharing, or breaches of our Terms, and bringing or defending legal claims. Legal basis: our legitimate interest in protecting our business, our teaching materials and our members.

5. Health information and other sensitive information

Some information gets extra protection under data protection law. Health information is the kind most likely to come up here.

We do not ask you for health information as part of joining the Academy.

However, members sometimes share health information voluntarily – in a forum post, in an assignment about a remedy they made, or by speaking during a live class. Where you choose to share health information in this way, we process it on the basis of your explicit consent, given by the act of sharing it in a setting where you know it will be visible.

Please think before you share. Our Terms and Conditions ask members to avoid sharing private health information during recorded classes, and to respect the confidentiality of anything another member shares.

You can ask us to remove health information you have shared at any time, and we will do so wherever it is reasonably possible.

We do not use health information members share for marketing, and we do not build profiles from it.

6. Who we share your information with

We do not sell your personal information, and we do not share it with third parties for their own marketing.

We do share it with the service providers who help us run the Academy. They act on our instructions and are not permitted to use your information for their own purposes. These currently include:

MailerLite, our email provider, which stores your name and email address and sends our emails
MemberPress, our membership platform, which manages your account, course access and progress
No Hassle Websites, our website host
Stripe and PayPal, our payment providers, which process your payments
Zoom, which we use to run live classes
Google Analytics, our website analytics provider
Meta, where you have consented to advertising cookies, so that we can show and measure our Facebook adverts
our professional advisers, where this is necessary

We may also disclose information where the law requires it, or where it is necessary to establish, exercise or defend a legal claim.

7. Information sent outside the UK

Some of our providers store or process information outside the UK, including in the United States and the European Economic Area.

Where that happens, we rely on safeguards approved under UK data protection law, such as the UK International Data Transfer Agreement or an adequacy decision covering the country concerned.

You can ask us for more detail about the safeguards that apply to a particular provider.

8. How long we keep your information

We keep information only as long as we need it.

Course progress, submitted assignments and tutor feedback. We keep these while you are an active member. When your membership ends, these learning records are normally retained for up to six months, so that you can return and continue your studies. After that they may be permanently deleted.

Certification records. Where you have been awarded a Foundation Certificate, we keep a permanent record of the award and the work it was based on, so that we can verify the certificate if you or another organisation asks us to.

Account and membership records. Kept for the duration of your membership and for two years afterwards.

Payment and tax records. Kept for six years after the end of the relevant tax year, as required by HMRC.

Mailing list. We keep your details until you unsubscribe.

Correspondence. Emails and enquiries are kept for two years, or longer where they relate to a complaint or a legal matter.

Forum posts. As explained in our Terms, forum posts are not automatically deleted when a membership ends, because threads form part of a shared conversation. You can ask us to remove or anonymise yours.

9. Marketing, and how to stop it

Every marketing email we send has an unsubscribe link at the bottom. Clicking it stops marketing emails, usually within 24 hours.

You can also email kristine@thecraftyherbalist.org.uk and ask to be removed.

Unsubscribing from marketing does not stop emails about your membership itself – payment notices, class dates and account information – because we need to send those to provide the service you have paid for.

10. Your rights

You have the following rights over your personal information. There is normally no charge, and we will respond within one month.

Access. You can ask for a copy of the personal information we hold about you.
Correction. You can ask us to correct information that is wrong or incomplete.
Erasure. You can ask us to delete your information. This right is not absolute – we may need to keep some records for legal or accounting reasons, and we cannot delete information we need to provide a membership you still hold.
Restriction. You can ask us to pause our use of your information while a question about it is resolved.
Objection. You can object to us using your information where we rely on legitimate interests, and you can object to direct marketing at any time.
Portability. You can ask us to provide certain information in a portable format, or send it to another provider.
Withdrawing consent. Where we rely on your consent, you can withdraw it at any time. This does not affect anything we did before you withdrew it.

To exercise any of these, email kristine@thecraftyherbalist.org.uk. We may ask you to confirm your identity first.

Complaints. If you are unhappy with how we have handled your information, please tell us first so that we can put it right. You also have the right to complain to the Information Commissioner’s Office:

Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Helpline: 0303 123 1113 Website: ico.org.uk

11. Keeping your information secure

We take reasonable steps to protect your information, including keeping our website and membership platform updated, using strong passwords and secure connections, and limiting who can see member information. In practice, that is Kristine and any tutor who needs access to mark your work.

No system is completely secure, and we cannot guarantee that information sent over the internet is safe in transit.

If a breach occurs that is likely to put your rights at risk, we will tell you and the Information Commissioner’s Office as required by law.

12. Children

The Academy is intended for people aged 18 or over. We do not knowingly collect information from children.

If you believe a child has given us their information, please contact us and we will delete it.

13. Cookies

Cookies are small files stored on your device when you visit a website. They let a site remember things about you – that you are logged in, what you have in your basket, or which pages you have looked at.

Some of ours are essential and cannot be turned off. The rest are only used where you have given consent through our cookie banner.

Essential cookies. These make the website and membership portal work. They keep you logged in, remember your display preferences, let you complete a purchase securely, and protect against fraud. They are set by WordPress, MemberPress, Stripe and PayPal. Without them the site cannot provide the service you have asked for, so they do not require consent. If you block them, parts of the site will stop working.

Functional cookies. These remember choices you have made, such as your details when you leave a comment on the blog, so that you do not have to enter them again. Comment cookies last for one year if you choose to save them.

Analytics cookies. We use Google Analytics to understand how people find and use our site – how many visitors we get, which pages they read, how long they stay, and where they came from. This helps us improve the website and the courses. These cookies are only set with your consent.

Advertising cookies. We use the Meta pixel so that we can show our adverts on Facebook and see whether they work. This cookie is only set with your consent. If you do not consent, you may still see our adverts, but they will not be tailored to you and we will not be able to measure them in the same way.

Cookies are either session cookies, which are deleted when you close your browser, or persistent cookies, which stay on your device until they expire or you delete them. Our analytics and advertising cookies are persistent.

Managing cookies. You can change your choices at any time using the cookie controls on our website. You can also block or delete cookies through your browser settings, though blocking essential cookies will prevent parts of the site from working.

To opt out of Google Analytics across all websites, Google provides a browser add-on. You can manage how Facebook uses your information for advertising through your Facebook ad settings.

14. Changes to this policy

We may update this policy from time to time. The current version is always on our website, with the date it was last updated at the top.

Where a change significantly affects how we use your information, we will tell you directly.

15. Contact us

Any question about this policy, or about your personal information: