GDPR Privacy Notice

This notice supplements our Privacy Policy and applies if you are in the European Union, the European Economic Area, or the United Kingdom. It explains your rights under the EU General Data Protection Regulation and the UK GDPR.

Who is responsible for your data

The data controller is Joy Through Alchemy LLC, 321 E Mulberry St, Kokomo, Indiana 46901, United States. We have not appointed a Data Protection Officer or an EU or UK representative.

What we process and where it comes from

• Identity and contact data (name, email, phone, shipping address), from you
• Order data (what you bought and when), from you and our checkout
• Personalization data (such as the name and birth details used for your Book of You), from you
• Communications (messages, chat, and applications), from you
• Technical data (IP address, browser, and device), collected automatically by our hosting and delivery providers

We do not intentionally collect special category data, such as health information. Please do not send it through our forms or chat.

Why we process it, and our legal basis

Purpose	Legal basis
Delivering what you bought, including personalized products and shipping	Contract
Reviewing your application before you join a program	Steps taken at your request before a contract
Replying to your messages and chat	Legitimate interests (answering people who contact us)
Sending marketing emails and texts	Consent
Taking payments and preventing fraud and misuse	Contract and legitimate interests
Keeping tax and accounting records	Legal obligation

Do you have to give us your data?

You need to give us your contact and order details to buy from us, and personalization details to receive a personalized product. Without them we cannot deliver it. Marketing is always optional.

Who receives it

Our service providers, acting on our instructions: GoHighLevel (customer database, email, texts, forms, checkout, and our AI chat assistant), our payment processor, our print-on-demand provider for printed books, and our website hosting and delivery services (GoHighLevel, Google Fonts, and Cloudflare's cdnjs). We may also disclose data where the law requires it.

International transfers

We are based in the United States, so your data is transferred to and processed in the United States. We rely on recognized safeguards for these transfers: the EU-U.S. Data Privacy Framework (and its UK Extension) where a provider is certified under it, or Standard Contractual Clauses approved by the European Commission (with the UK Addendum for UK data) where a provider offers them.

How long we keep it

Customer and order records: for as long as you have access to your purchase, and then for as long as tax and accounting law requires. Marketing data: until you withdraw consent. Messages and applications: as long as needed to respond and follow up.

Automated decisions

We do not make decisions about you that have legal or similarly significant effects using automated processing or profiling. Our AI chat assistant answers questions; it does not make decisions about you, and we always tell you when you are talking with an AI, in line with the transparency rules of the EU AI Act. The free Joy Assessment runs in your browser, and its result is not stored by us.

Your rights

• Access: ask for a copy of your data
• Rectification: ask us to correct inaccurate data
• Erasure: ask us to delete your data (the "right to be forgotten")
• Restriction: ask us to limit how we use your data
• Portability: receive your data in a portable format
• Objection: object to processing based on legitimate interests, and to direct marketing at any time
• Withdraw consent at any time, without affecting processing that already happened

How to use your rights

Contact us using the details below. We may ask you to confirm your identity first. We will respond within one month, or tell you within that month if a complex request needs up to two more months.

Complaints

If you are in the EU or EEA, you have the right to complain to the data protection authority where you live, where you work, or where you believe an infringement happened.

If you are in the UK, you can make a complaint to us first. We will acknowledge it within 30 days and respond without undue delay. You can also complain to the Information Commissioner's Office.

Wherever you are, we would appreciate the chance to address your concern.

How to contact us