Privacy Policy & POPIA Data Protection Notice

1. Introduction & Responsible Party

Red Alchemy ("the Practice", "we", "us", or "our"), founded and operated by Anita Munsamy, provides specialized subconscious regression therapy, personal transformation coaching, and somatic nervous system regulation. We operate with strict adherence to client confidentiality and data security.

For the purposes of the Protection of Personal Information Act (POPIA, Act 4 of 2013), Red Alchemy is the designated Responsible Party. This policy applies to all personal information collected via our website (redalchemy.co.za), online diagnostic assessments, confidential intake forms, discovery calls, and virtual or in-person consultations.

2. Information Officer Details

Our designated Information Officer handles all statutory inquiries, access requests, and compliance communications:

Information Officer	Anita Munsamy
Practice Entity	Red Alchemy (Reg: 2026/237102/07)
Physical Address	Umhlanga Ridge, Durban, KwaZulu-Natal, 4319, South Africa
Telephone / WhatsApp	+27 82 000 0000
Direct Inquiries Email	anita@redalchemy.co.za

3. What Personal Information We Collect

In order to provide personalized subconscious breakthroughs and ensure client safety, we collect only information that is adequate, relevant, and not excessive for that purpose:

3.1 General Personal Information

• Identifying Information: Full name, preferred title, and country of residence.
• Contact Details: Email address, mobile telephone number, and WhatsApp contact details.
• Billing & Payment Data: Proof of payment receipts and invoicing details (credit card transactions are processed securely via third-party hosted gateways; card numbers never touch or reside on our servers).
• Technical & Telemetry Data: IP address, device type, browser specifications, and referral source collected anonymously via server logs.

3.2 Special Personal Information (Section 26 of POPIA)

Because subconscious regression touches on emotional health, childhood patterns, and physiological tension, you may voluntarily disclose special personal information:

• Therapeutic Context: Self-reported emotional blocks, recurring anxieties, fears, and personal history submitted via our confidential intake form or diagnostic tool.
• Session Observations: Clinical practitioner notes taken during your 90 to 120-minute intensive.
• Audio Integration Recordings: Bespoke hypnotic voice recordings created specifically for your personalized 21-day audio practice.

We process special personal information strictly with your explicit voluntary consent (Section 27 of POPIA) and exclusively to deliver your scheduled therapeutic sessions.

4. Lawful Grounds for Processing

We process your personal information on the following lawful bases under POPIA and the GDPR:

• Informed Voluntary Consent (Section 11(1)(a)): You provide explicit consent when submitting our diagnostic questionnaire, requesting a discovery call, or engaging in consultation.
• Contractual Performance (Section 11(1)(b)): Processing is necessary to deliver your 90 to 120-minute session and engineer your custom 21-day audio track.
• Statutory Compliance (Section 11(1)(c)): Retaining financial transaction records to meet South African tax laws (Tax Administration Act) and accounting standards.
• Legitimate Practice Interests: Maintaining accurate therapeutic records to ensure continuity of care and client safety.

5. How We Safeguard Your Information

Red Alchemy implements stringent organizational and technical measures to prevent unauthorized access, loss, destruction, or alteration of your personal data:

• End-to-End Encryption: All website traffic is protected via Transport Layer Security (TLS 1.3 / HTTPS). In-transit data between your browser and our servers is fully encrypted.
• Confidential Practitioner Archival: Client session notes and intake responses are stored in encrypted, password-protected vaults accessible only by Anita Munsamy personally. Zero staff, junior coaches, or unauthorized third parties have access to your private file.
• Secure Video Infrastructure: Virtual sessions take place across high-definition video connections secured with AES-256 bit encryption. Sessions are never recorded without your prior written agreement.
• Zero Commercial Data Selling: We do not sell, rent, monetize, or trade your personal information to advertisers, marketers, or data brokers under any circumstances.

6. Third-Party Operators & Cross-Border Transfers

We may use trusted service providers ("operators") to maintain our operational infrastructure (e.g. web hosting, encrypted video conferencing, and transaction processors). Every operator is bound by written confidentiality agreements and POPIA Section 21 operator standards.

Where information is transferred outside the Republic of South Africa (e.g. cloud backup servers located in ISO 27001-certified data centres in Europe or North America), we ensure that the recipient country provides an adequate level of data protection substantially similar to POPIA (Section 72 of POPIA), or that binding agreements enforce appropriate technical safeguards.

7. Data Retention & Secure Disposal

We retain personal information only for as long as necessary to fulfill the therapeutic and contractual purpose for which it was collected, or to comply with statutory retention obligations (e.g. 5 years for financial records under SARS regulations). When retention horizons expire, electronic records are permanently purged using secure digital shredding protocols.

8. Your Statutory Rights Under POPIA

As a data subject under South African law, you hold clear statutory rights regarding your personal information:

• Right of Access (Section 23): You may request confirmation of whether we hold personal information about you and receive a copy of that record.
• Right to Rectification (Section 24): You may request the correction or updating of inaccurate, irrelevant, out-of-date, or incomplete personal data.
• Right to Erasure / Deletion (Section 24): You may request the destruction or deletion of personal information where we are no longer authorized to retain it.
• Right to Object (Section 11(3)): You may object to the processing of your personal data on reasonable grounds relating to your particular situation.
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw that consent at any time without retroactive effect.

To exercise any of these rights, please submit a written request to our Information Officer at anita@redalchemy.co.za. We will respond within 30 calendar days without undue delay.

9. Cookies & Tracking Technologies

Our website uses strictly necessary technical cookies to maintain site security, responsive UI states, and audio player functionality. We do not deploy third-party advertising cookies, cross-site trackers, or behavioral profiling pixels. You may configure your browser to block cookies, though certain interactive features (such as audio previews or assessment states) may experience reduced functionality.

10. Direct Marketing Communications

We maintain a strict anti-spam policy. We do not send automated bulk promotional messages or sales sequences. You will receive direct communication from Anita Munsamy only in response to your explicit inquiry, discovery call booking, or active session schedule. Every non-transactional email contains a one-click opt-out mechanism.

11. Right to Lodge a Complaint with the Information Regulator

If you believe that your personal information has been processed in violation of POPIA, we encourage you to contact our Information Officer first so we can resolve your concern immediately. However, you retain the statutory right to lodge a formal complaint with the South African Information Regulator:

12. Updates to this Policy

We may update this Privacy Policy from time to time to reflect operational modifications or statutory regulatory adjustments. The revised policy will be posted on this page with an updated effective date. Continued use of our website or services following an update constitutes acceptance of the revised terms.