Privacy

This Privacy Policy aims to give you information on how the Sites collect and process your Personal Data (as defined below) through your use of these Sites, including any data you may provide through these Sites when you apply as an assistant or as a student for a training or workshop, or purchase any other Services.

It is important that you read this Privacy Policy together with any other terms and conditions or notices we may provide on the Sites or on special occasions when we are collecting or processing Personal Data about you so that you are fully aware of how and why we are using your data.

The NeuroAffective Touch^® Institute is the controller and responsible for your Personal Data. We have appointed a data privacy manager who is responsible for overseeing questions in relation to this Privacy Policy. If you have any questions regarding this Privacy Policy or our privacy practices, including any requests to exercise your legal rights, please contact the data privacy manager in the following ways:

The NeuroAffective Touch^® Institute
Attn: Data Privacy Manager
Email: victor@neuroaffectivetouch.com
Mailing Address: 3019 Wilshire Blvd #145 Santa Monica, CA 90403 USA
Telephone: +1 (424) 625-5893

If you are a resident of the European Union, you also have the right to make a complaint at any time to the Information Commissioner’s Office (“ICO”), the United Kingdom supervisory authority for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

In order to provide you with the Services offered on the Sites, we collect two basic types of information about our users — Personal Data (as defined below) and Aggregate Information (as defined below).

A. Personal Data. Personal Data, or Personal Information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous information). We may collect, use, store, and transfer different kinds of Personal Data about you, which we have grouped together as follows:

• Identity Data that includes, without limitation, your first name, last name, username or similar identifier, title, licenses/degrees/certifications, insurance, and/or date of birth.
• Contact Data that includes, without limitation, your billing address, email address, and telephone numbers.
• Financial Data that includes, without limitation, credit or debit card details processed through VeriSign, PayPal, WePay, and/or Authorize.net. For your security all credit card information is encrypted. We do not keep your credit card information on our servers.
• Transaction Data that includes, without limitation, details about payments to and from you and other details of Services you have purchased from us.
• Profile Data that includes, without limitation, your username and password, purchases or orders made by you, your interests, preferences, feedback, and survey responses.
• Marketing and Communications Data that includes, without limitation your preferences in receiving marketing from us and our third parties and your communication preferences.
• Content Data that includes, without limitation, user generated content you choose to publish on the Sites.
• Third-Party Data that includes, without limitation, information from third party sources, such as authorized NATouch™ Training Coordinators, which is incorporated in your Personal Data.
• Technical Data that includes, without limitation, internet protocol (IP) addresses and your operating system, domain servers, types of devices using the mobile app and what versions, types of devices and web browsers used to access the website and what versions, Internet service provider (“ISP”), referring or exit pages, a website’s Uniform Resource Locator (“URL”) that points to a website that you just came from and from which URL you go to after visiting the Sites, operating systems and platform type, date and time stamp, time zone setting and location, information collected by tracking technologies such as cookies, and number of clicks.
• Usage Data that includes, without limitation, information about how you use the Sites and Services.

We do not collect any special categories of Personal Data about you, which includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union memberships, information about your health, and genetic and biometric data. Nor do we collect any information about criminal convictions and offenses.

It is important that the Personal Data we hold about you is accurate and current. Please keep us informed if your Persona Data changes during your relationship with us.

Where we need to collect Personal Data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the services or provide you with goods. In this case, we may have to cancel a product or service you have with us, but we will notify you if this is the case at the time.

B. Aggregate Information. Even if you do not directly provide information to us, when you use the Sites, certain information is automatically collected and tracked relating to that use of the device or website. Aggregate Information could be derived from your Personal Data but is not considered Personal Data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Technical Data and/or your Usage Data to calculate the percentage of users accessing a specific website feature, analyze trends, administer the website, track user flow throughout the site and how many visitors received, gather broad demographic information, analyze trends, administer the website, track user flow throughout the site, gather broad demographic information, We also use Aggregate Information for internal system administration, to help diagnose problems with its servers, and to improve the design and user experience of the Sites. Should any Aggregate Information be associated with Personal Data, we will treat such information as Personal Data.

C. Cookies. When you interact with the Sites, we try to make your experience simple and meaningful. When you visit the Sites, our web server sends a cookie to your computer in order to collect certain Aggregate Information about our users and to customize certain aspects of your specific user experience.

Cookies are small data text files that web browsers stored on a computer’s hard drive, which uniquely identifies your web browser. We use cookies for a number of tasks, including the following: Cookies may also include Technical Data such as your IP address, browser type, the server your computer is logged onto, and the area code and zip code associated with your server. Cookies may also include Identity Data such as your first name to welcome you back to our Sites when you log on. Cookies may include Contact Data to access a customer’s account information when a customer logs into the Sites. And Cookies may also include Usage Data such as how you navigate around a web page, the most commonly clicked links on a specific web page, and selected preferences while you use our Sites. Cookies also provides us with Aggregate Information to estimate and report total audience size (unique users) and traffic for Sites, and to conduct research to improve the content and services of the Sites. However, we do not use cookies to track your browsing behavior.

Most browsers are initially setup to accept cookies but you can configure your browser to accept all cookies, reject all cookies, or notify you when a cookie is set (each browser is different, so check the “Help” menu of your browser to learn how to change your cookie preferences).

Cookies are shared with the following platforms: Google Analytics, ConstantContact, and social media platforms such as Facebook, Twitter, and LinkedIn.

• Data Interactions. You may give us your Identity Data, Contact Data, and Financial Data by filling out forms or corresponding with us by mail, phone, email, or otherwise. This includes Personal Data you provide when you: (a) registering for an account on our Sites, (b) apply as an assistant or register as a student for one of our trainings or workshops, (c) purchase Services through the Sites such as pillows, blankets, books, audio, video, and/or ebooks, as well as trainings and workshops, (d) subscribe to our newsletters or other publications, (e) request marketing to be sent to you; (f) enter a promotion or survey, or (g) give us feedback or contact us.
• Automated Technologies or Interactions. As you interact with the Sites, we will automatically collect Technical Data about your equipment, browsing actions, and patterns. We collect this Personal Data by using cookies and other similar technologies.
• Third Parties or Publicly Available Sources. We will receive Personal Data about you from various third parties and public sources as set out as follows: Technical Data may come from analytics providers such as Google).

When processing certain information such as Financial Data with payment processors, we encrypt the transaction using Secure Socket Layer (“SSL”) encryption technology, in order to prevent your Personal Data from being stolen or intercepted. Additionally, your credit and debit card information is never stored on our servers.

A. Overview of How We Use Your Personal Data. We will primarily use your Personal Data to provide Services to you and only when we have a lawful basis to do so. A lawful basis includes, without limitation, the following:

• Legitimate Interest means the interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your Personal Data for our legitimate interests. We do not use your Personal Data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.
• Performance of Contract means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.
• Comply with a legal obligation means processing your Personal Data where it is necessary for compliance with a legal obligation that we are subject to.

B. Purposes for Which We Will Use Your Personal Data. We have set out below, in a table format, a description of all the ways we plan to use your Personal Data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

We will only use your Personal Data for the purposes for which we collect it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us. If we need to use your Personal Data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your Personal Data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Please note that we may process your Personal Data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your Personal Data where more than one ground has been set out in the overview below.

Read detailed Overview >

C. Marketing & Promotions. We strive to provide you with choices regarding certain Personal Data uses, particularly around marketing and advertising. We may use your Identity Data, Contact Data, Technical Data, Usage Data, and Profile Data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which productions, services, and offers may be relevant for you (we call this marketing). You will receive marketing communications from us if you have requested information from us or purchased goods and/or services from us, and you have not opted out of receiving that marketing.

D. Opt-Out. You may ask us to stop sending you marketing messages at any time by following the opt-out links, i.e., the “Unsubscribe” link located at the bottom of each email, on any marketing messages sent to you or by contacting us at any time.

Please note that where you opt out of receiving these marketing messages, this will not apply to Personal Data provided to us as a result of a product and/or service purchase, or other transactions.

We do not share, sell, trade, or rent your Personal Data to unaffiliated third parties. We may provide some of our Services through contracted arrangements made with affiliates, service providers, partners, and other third parties including, without limitation, NATouch™ Training coordinators, Training assistants, and instructors and faculty of NATouch™, including service providers that may be located outside of the United States (collectively, “Service Partners”). We and our Service Partners may need to use some Personal Data based on the lawful basis described above. For example, in order to perform on a contract with you, we must release your credit or debit card information to the card-issuing bank to confirm payment for Services purchased on the Sites, release your address information to our delivery service to deliver any products that you purchased, or provide other information to third parties that help us provide customer services. Another example, based on our legitimate interest, we use Identity Data to verify attendance to a training or workshop, which may be seen by Training coordinators, Training assistants, instructors, faculty, and students, as well as to access video and/or audio recordings of the NATouch™ trainings for educational purposes by Training assistants, instructors, faculty, and Training coordinators.

Some Service Partners we may provide your Personal Data to, who are all located in the United States unless otherwise noted, are as follows:

• Internal Third Parties. Company’s employees and contractors, who have a need to know Personal Data in order to perform Services requested or purchased through the Sites. Such internal third parties, include, without limitation, IT and system administration services located in the United States, United Kingdom, and Pakistan.
• External Third Parties. Service providers, acting as processors, who provide IT and system administration services; professional advisers including lawyers, bankers, accountants, auditors, and insurers, who provide consultancy, banking, legal, insurance, and accounting services; students attending live trainings or workshops, who may be able to view Contact Data of the training and workshop participants as listed on sign-in lists; and/or sign-in lists may also be accessed by international training coordinators located throughout the European Union, United Kingdom, Norway, Canada, Australia, and Japan.
• Mergers or Acquisitions: Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your Personal Data in the same way as set out in this Privacy Policy.

We will take reasonable steps to ensure our Service Partners respect the security of your Personal Data subject to contractual obligations and to treat it in accordance with applicable law. We do not allow our Service Partners to use your Personal Data for their own purposes and only permit them to process your Personal Data for specified purposes as mentioned above and in accordance with our instructions.

External Links. The Sites may contain links to other websites, including social networks, NATouch™ Training Coordinator’s websites, and websites belonging to other third parties. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements or privacy practices. These websites, accessible through the Sites, have their own privacy policies and data collection, use, and disclosure practices. When you leave the Sites, we encourage you to read the privacy policy of every website you visit before providing Personal Data to them. We are not responsible for the policies and procedures for third parties.

Law Enforcement. Occasionally, we may be required by law enforcement or judicial authorities to provide Personal Data to appropriate governmental authorities. In such cases, we will disclose Personal Data upon receipt of a court order, subpoena, or to cooperate with a law enforcement investigation. We fully cooperate with law enforcement agencies in identifying those who use our Services for illegal activities. We reserve the right to report to law enforcement agencies any activities that we in good faith believe to be unlawful.

Except as otherwise discussed in this Privacy Policy, this document only addresses the uses and disclosure of information we collect from you.

We have put in place appropriate security measures to prevent your Personal Data from being accidentally lost, used, or accessed in an unauthorized way, altered, or disclosed. We strive to take appropriate security measures to protect against unauthorized access to or unauthorized alteration, disclosure, or destruction of your Personal Data. As examples:

• We work hard to ensure that the data collected is reliable, accurate, complete, and current. We also only keep collected information for as long as reasonably necessary (see 7. Data Retention and use it only for the purposes for which it was collected or to comply with any legal or ethical reporting or document retention requirements.
• We limit access to your Personal Data to those employees, agents, contractors, and other third parties who have a business need to know. They will only process your Personal Data on our instructions and they are subject to a duty of confidentiality.
• We also employ a number of physical, electronic, and procedural safeguards to protect Personal Data. Our servers and our data centers are protected by industry-standard encryption, and our servers reside behind fire walls and password protection.
• Access by you to your Personal Data is available through a password and unique customer identification selected by you. The password is encrypted. We recommend that you do not divulge your password to anyone as it is your responsibility for keeping your unique customer identification and password secure and confidential.

Unfortunately, no data transmission over the Internet or any wireless network can be guaranteed to be 100% secure. As a result, while we strive to protect your Personal Data, you acknowledge that (a) there are security and privacy limitations inherent to the Internet that are beyond our control; and (b) the security, integrity, and privacy of any and all information and data exchanged between you and us through the Sites cannot be guaranteed.

You must immediately notify us of any unauthorized use of your unique customer identification and/or password. Likewise, if you are contacted by anyone requesting your unique customer identification and/or password, please DO NOT RESPOND and notify us immediately about the contact.

We have put in place procedures to deal with any suspected Personal Data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

We will only retain your Personal Data for as long as reasonably necessary to fulfill the purposes for which we collected it, including the purposes of satisfying any legal, regulatory, tax, accounting, or reporting requirements. We may retain your Personal Data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of a legal dispute in respect to our relationship with you.

To determine the appropriate retention period for Personal Data, we consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorized use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting, or other requirements.

In some circumstances you may ask us to delete your Personal Data, see 8. Your Legal Rights below for more information.

In some circumstances we may anonymize your Personal Data so that it can no longer be associated with you for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

Under certain circumstances, you have rights under data protection laws in relations to your Personal Data. Please click on the links below to find out more about these rights:

• Request access to your Personal Data (commonly known as a “data subject access request”). This enables you to receive a copy of the Personal Data we hold about you and to check that we are lawfully processing it.
• Request correction of the Personal Data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Request erasure of your Personal Data. This enables you to ask us to delete or remove Personal Data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your Personal Data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your Personal Data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request. In addition, it may be impossible to completely delete your information without some residual information because of backups.
• Object to processing of your Personal Data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your Personal Data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information, which override your rights and freedoms.
• Request restriction of processing of your Personal Data. This enables you to ask us to suspend the processing of your Personal Data in the following scenarios:
  • If you want us to establish the data’s accuracy.
  • Where our use of the data is unlawful but you do not want us to erase it.
  • Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims.
  • You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
• Request the transfer of your Personal Data to you or to a third party. We will provide to you, or a third party you have chosen, your Personal Data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• Withdraw consent at any time where we are relying on consent to process your Personal Data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

If you wish to exercise any of the rights set out above, please contact us by telephone or email using the contact information provided above. If you contact us, please include your name, address, and/or email address.

You will not have to pay a fee to access your Personal Data or to exercise any of the other rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

To protect users’ privacy and security, we may need to request specific information from you to help us confirm your identity and ensure your right to access your Personal Data or to exercise any of your other rights. This is a security measure to ensure that Personal Data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one (1) month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

You must be at least 18 years old to have our permission to use the Sites as protecting the privacy of children is especially important to us. For that reason, we never collect or maintain information at our Sites from those we actually know are under the age of 13, nor do we allow the registration of users under the age of 13. In the event that we learn that we have collected Personal Data from a child under the age of 13 without verification of parental consent, we will delete that information.

A. Use of Testimonials. With your consent, we may select and post customer testimonials on the Sites, which may contain Identity Data and Contact Data such as your name, credentials, and/or country in which you live. If you would like us to remove or delete your name or testimonial from the Sites, you may contact us using the above mentioned contact information. We will obtain your consent prior to posting any testimonial with your name. If we post such content, it will be available to other users of the Sites. Your posting may also become public and we cannot prevent such information from being used in a manner that may violate this Privacy Policy or the law. Note that copies of information that you have updated, modified, or deleted may remain viewable in cached and archived pages of the Sites for a period of time.

B. Reviews. We may post customer reviews on the Sites, which may contain Identity Data and Contact Data such as your name, credentials, and/or country in which you live. When submitting your review to us you are giving us permission to post your review on the Sites. If you post such content, it will be available to other users of the Sites. Your posting may also become public and we cannot prevent such information from being used in a manner that may violate this Privacy Policy or the law. If you would like us to remove your name or review from the Sites, you may contact us using the contact information provided above. Note that copies of information that you have updated, modified, or deleted may remain viewable in cached and archived pages of the Sites for a period of time.

We reserve the right to change this Privacy Policy from time to time. We will notify you of any material changes in the way we treat Personal Data by sending a notice to the primary email address specified in your account, by placing a prominent notice on our Sites, and/or by updating any privacy information on this page. We encourage you periodically to check this site to learn about the information we collect, use, and share. Your continued use of any of the Sites after such modifications will constitute (a) acknowledgement of the modified Privacy Policy and (b) your agreement to abide and be bound by the revised Privacy Policy.

Effective Date of Policy. This Privacy Policy was last updated as of August 1, 2019.