Privacy and Cookies Policy

Your privacy matters to us. This Policy explains how we collect, use, store and disclose personal information, including information collected through cookies and similar technologies. It also explains your choices, privacy rights and how to contact us.

1. About us and this Policy

Robert Reeves Pty Ltd is based in New South Wales, Australia. In this Policy, we, us and our mean the company. Robert personally operates the business. The Academy of Spiritual Development is our learning environment, rather than a separate contracting entity.

This Policy covers robertreeves.com, our linked online store and related websites, Academy, courses, certifications, meditations, communities, purchases, memberships, events, private readings, naturopathic consultations and related communications. It also covers relevant paper records and information retained in earlier business systems.

We comply with privacy laws applicable to our activities, including the Australian Privacy Act 1988 and Australian Privacy Principles, and relevant NSW health-information laws. Additional overseas requirements apply where their conditions are met.

This Policy provides privacy information. Reading it, browsing our website or accepting our Website Terms does not itself give consent to every activity described here. We obtain consent separately where required. Specific collection notices, consultation documents and event information may explain particular arrangements in more detail.

2. Information we collect and how we collect it

The information involved depends on your interactions with us. We collect information reasonably necessary for our activities or otherwise permitted by law.

Contact and account information: your name, preferred name, email, telephone number, billing or delivery address, country, account identifiers, profile information and preferences.

Purchases and learning records: products purchased, order references, payment status, instalments, subscriptions, refunds, account entitlements, course progress, quiz responses, results, completion and certificate records. Payment providers handle payment authorisation and full card details. We receive transaction information and may see limited payment details, such as card type and masked numbers.

Communications and contributions: enquiries, support requests, correspondence, survey responses, feedback, community posts, event questions, testimonials and other material you provide. Images, voice and video may be involved in the circumstances described in section 6.

Sensitive information: health information and, where disclosed or otherwise lawfully collected, religious or philosophical beliefs and other legally protected information. Section 4 explains our approach.

Technical and engagement information: IP addresses, device and browser details, approximate location, referring pages, pages viewed, session activity, online identifiers, email delivery, opens, clicks and video-message engagement where the relevant service records it. Such information is not necessarily anonymous simply because it does not include your name.

We collect information through forms, purchases, registrations, course activities, consultations, messages, events and other direct interactions. Technical information is also collected through logs, cookies, pixels, embedded media and connected services, subject to applicable controls.

We receive relevant information from providers assisting with payments, learning, communications, advertising, delivery and other requested services. We may also receive information from someone arranging a gift or service for you, or through your interactions with our social media accounts. Please provide another person's details only when you have appropriate authority.

You can browse public pages without giving us your name, although technical information may still be processed. Where lawful and practicable, you may interact anonymously or using a pseudonym. Purchases, certificates and consultations can require accurate details. If necessary information is unavailable, we may be unable to supply the requested service. We explain specific collection requirements where appropriate.

3. Why we use personal information

We use relevant information to:

• Process orders, payments, subscriptions, delivery, refunds and cancellations.
• Provide course access, administer accounts, assess quizzes and issue certificates.
• Deliver readings, consultations, events, communities and personalised communications.
• Answer enquiries, provide support and communicate about existing services.
• Send permitted newsletters, educational material and promotional messages.
• Understand engagement, improve services and measure marketing effectiveness.
• Maintain accurate records, protect accounts, prevent fraud and investigate misuse.
• Obtain necessary professional advice, resolve complaints, protect legal rights and meet applicable obligations.

We use information for its collection purpose, another appropriately related purpose, or a purpose supported by consent or another lawful authority. A description of an activity in this Policy does not override restrictions applying to sensitive information, marketing or tracking.

4. Sensitive information and naturopathic consultations

Our work can involve personal experiences concerning wellbeing, health, beliefs or other sensitive matters. We do not assume that a website visit or course purchase proves a particular belief or health condition.

We collect sensitive information only where reasonably necessary and with the consent or other authority required by applicable law. You need not disclose private health information simply to browse the website or receive general educational resources. Please avoid unnecessary sensitive details in ordinary enquiries, group discussions or forms.

Naturopathic consultations occur occasionally, generally by telephone or video, including for some overseas clients. Relevant information can include health history, symptoms, medication, supplements, allergies, intake forms, advice and follow-up correspondence. Robert normally makes handwritten notes while speaking with the client. Health updates and intake documents received by email also form part of the information we hold.

We use consultation information to provide the requested service, maintain appropriate records, communicate with you and address relevant professional, insurance, legal or complaint-handling requirements. Additional intake information and consent arrangements apply where required. Consultation records are confidential and are not ordinary advertising audience material.

Disclosure to another practitioner requires appropriate authority, unless a lawful exception applies. Other disclosures can be required or permitted by law, including specified circumstances concerning serious threats to health or safety.

Please contact us about sending particularly sensitive documents. A request for deletion or withdrawal of consent does not necessarily permit destruction of health records we must retain. Applicable retention requirements are explained in section 12.

5. Courses, certificates and communities

We retain relevant enrolment, purchase and progress information to administer your learning and access rights. Where a course uses an automatically assessed quiz, the system processes your responses and completion or passing status to issue a certificate according to the published course requirements. Contact us if you believe an assessment or certificate record is inaccurate.

We can retain necessary award records to verify completion or investigate credential misuse. A legitimate verification enquiry does not give someone unrestricted access to your private learning information.

Community participation can make your display name, profile, posts, comments and other contributions visible to the audience authorised for that space. We may review contributions for moderation, safety, support and enforcing community rules.

A members-only community is not the same as a confidential consultation. Other participants may save or repeat information they can see. Please consider what you share. We do not treat a community contribution or private submission as unrestricted permission to publish your sensitive experiences in public advertising.

6. Recordings, private video messages and testimonials

Individual sessions: private readings and consultations are not normally recorded unless requested or specifically agreed. Where a recording is arranged, we explain its purpose, intended recipients and relevant arrangements, and obtain required permission. Recordings may be delivered using conferencing or video-hosting services. Private asynchronous video readings or messages may also contain personal information about the recipient.

Group sessions: live course sessions and workshops can be recorded for the relevant course or program replay audience. A full recording may include participants' names, images, voices, questions, chat contributions or comments Robert reads aloud. A replay can remain available as part of the relevant course, rather than only to people who attended live. We explain recording and replay arrangements before participation and obtain any consent required for recording or sensitive disclosures. Please contact us beforehand about participation options if you do not want to appear, and avoid sharing unnecessary sensitive information. Keeping your camera off does not prevent a spoken or written contribution being included.

Personalised video messages: we use video-messaging services to send messages such as welcomes, responses or private guidance. Relevant contact details, the message and viewing or response information can be processed by the service. Protect any private viewing link; a link is not necessarily protected by an individual login.

Testimonials: permission to record or receive a service does not itself authorise public promotional use. We obtain appropriate permission before using identifiable private correspondence, client stories, photographs, recordings or sensitive experiences as testimonials. A clearly identified testimonial submission can provide permission for the uses explained when it is submitted. Using a first name alone does not necessarily make a story anonymous.

7. Artificial intelligence and automation

We may use AI and other software for general writing, educational development, technical work and appropriate business administration. We do not currently use external AI tools to transcribe or analyse private consultations, readings or participant recordings.

If we introduce AI processing of identifiable client material, recording summaries or a similar new activity, we will first assess its necessity, provider arrangements, security and applicable legal requirements, and provide any additional notice or consent process required. This Policy is not blanket permission to upload confidential client material to external AI services.

Routine systems automate activities such as enrolments, payments, email delivery and the quiz and certificate process described above. Where an automated decision or decision-support activity triggers additional legal transparency or other requirements, we provide the required information and safeguards. You can contact us about information used in an automated process affecting you.

8. Email, personalised communications and advertising audiences

We send newsletters and promotional communications with the permission or other legal basis required for the recipient and message. Signup forms explain the subscription offered, including where a free resource accompanies newsletter enrolment. A purchase or general enquiry is not unlimited permission for unrelated marketing.

Our communication systems record delivery, opens, clicks, unsubscribes and related engagement where supported. We use relevant interests, purchase history and engagement to organise subscribers, improve communications and send useful follow-ups. Tracking data can be incomplete or inaccurate because of privacy settings, automated scanners or other technical factors. Where separate tracking consent is required, we obtain it.

Unsubscribe: use the link in a promotional email or contact [email protected]. We honour requests within applicable time limits, including five working days where Australia's Spam Act applies. Necessary receipts, access instructions, appointment details, payment and security notices may continue. Including promotional content can bring a message within marketing rules even when it also concerns an existing service.

Advertising audiences: we use Meta's customer-list tools, where lawfully permitted, to match relevant contact information with platform accounts, exclude existing customers from campaigns or create similar audiences. Matching commonly uses hashed identifiers; hashing does not make the information anonymous. Audience matching is separate from cookies placed during a website visit and requires its own lawful basis and any necessary notice or consent.

We do not use confidential consultation notes, symptoms, diagnoses, treatment details or private readings to build advertising audiences. Contact us to object to use of your information for direct marketing or customer-list advertising. Cookie rejection alone does not necessarily communicate a customer-list objection, and unsubscribing from email does not necessarily change browser cookie settings. We maintain limited suppression information where needed to respect your choices, including when systems change.

9. Cookies and tracking technologies

What we use

Cookies store information in your browser. Related technologies include pixels, scripts, tags, local storage and online identifiers. They support functionality, measurement and advertising. Session cookies usually expire when the session ends; persistent technologies remain until their expiry or removal.

The categories used depend on the page and features involved:

Classification depends on what a technology actually does. A provider's label, or a benefit to our business, does not automatically make it strictly necessary. A technology with several purposes must meet the requirements applying to those purposes.

Google and Meta may receive online identifiers, IP addresses, page or event information, referral information and other data permitted by the relevant configuration, legal basis and privacy choices. Embedded videos and other third-party features can also process technical information when loaded or used. Where an integration sends information directly from a server, applicable privacy choices still apply; it is not exempt merely because it does not set a browser cookie.

For provider information, see Google's explanation of data use on partner services and Meta's Privacy Policy. Restrictions on sensitive information and advertising audiences are described in sections 4 and 8.

CookieYes and your choices

We use CookieYes to display our consent notice, manage preferences and maintain cookie information. Use Cookie settings to review the available categories and technologies, accept or reject optional tracking, or change your choices. You can withdraw consent as easily as you give it through these controls.

Cookie settings

We adapt the notice and the operation of optional technologies to applicable regional requirements. Where prior consent is required, optional technologies remain blocked until you provide the relevant consent. This includes applicable consent requirements for visitors in the UK and European Economic Area. Necessary technologies operate without optional consent only where the legal exemption applies.

In other locations, some optional technologies may operate without prior consent where lawful, with the applicable notice, objection or opt-out controls. This does not remove consent requirements that apply to a particular activity, sensitive information or individual. We may use approximate location derived from your IP address to select the relevant notice. Location detection can be imperfect; please use Cookie settings or contact us if you need assistance.

We honour recognised opt-out preference signals, including Global Privacy Control (GPC), where required by applicable law. GPC can communicate an objection to activities such as sale, sharing or targeted advertising covered by the relevant law. It does not necessarily reject every optional technology or unsubscribe you from email. A browser's general Do Not Track setting is different from GPC and is not a universal opt-out mechanism. Our cookie controls remain available regardless.

Preference records and browser controls

We normally remember cookie preferences for up to 180 days, although we may ask again sooner when the notice, purposes or applicable requirements change. Clearing browser data, changing devices or using a different browser or domain may also require a new choice. Preferences are not necessarily shared across our main website, a separately hosted store and every other service.

We keep appropriate consent and preference records to demonstrate and respect your choices. These can include a consent identifier, the date and time, selected categories and relevant notice information. Such records are not necessarily anonymous. Retention follows the accountability and recordkeeping purposes described in section 12.

Browser settings also let you restrict or delete many cookies. They do not independently control every form of tracking, email engagement measurement or customer-list advertising. Blocking necessary technologies can affect login, checkout or requested content. Withdrawing cookie consent stops the relevant future consent-based activity; it does not automatically delete information already held or invalidate earlier lawful processing.

Rejecting advertising technologies does not remove all advertising you see elsewhere. Customer-list advertising choices, including objections to audience matching, remain available separately under section 8.

Cookie inventory

The table below is maintained through CookieYes and identifies the recorded cookies, providers, purposes and durations for the relevant site. It forms part of this Policy. Cookie information can change as services and features change. We review classifications and supplement the inventory where necessary, including technologies that automated scans cannot identify.

If the table does not display, open Cookie settings or contact us for the information. Details for a separately hosted store or third-party service may also appear in its own privacy controls or notice. Cookie duration is different from how long associated information may be retained in a provider's systems.

10. Who receives information

Robert currently handles customer information personally within the business. Our external service providers also process relevant information to perform their functions. Depending on your interaction, these include providers of:

• Website hosting, course delivery, account management, community features and technical security.
• Checkout, payment processing, subscriptions, refunds and fraud prevention.
• Business email, email marketing, customer communication and personalised video messages.
• Cloud document storage, backups, video hosting and video conferencing.
• Analytics, advertising measurement, consent management and permitted audience matching.
• Physical delivery, event fulfilment or professional advice where relevant to the service or matter concerned.

We limit disclosures to information relevant to the authorised purpose and take reasonable steps appropriate to the arrangement. Some providers act on our instructions; others also have independent responsibilities and purposes described in their own notices. Outsourcing does not remove responsibilities that remain with us.

Our online store uses Shopify for commerce and checkout services. Shopify processes customer information to provide those services and may also process information for its own purposes as explained in its Consumer Privacy Policy. Where Shopify Network Intelligence or associated enhanced features are enabled, Shopify may combine information from interactions with our store, other merchants and Shopify services for the purposes described in that notice, subject to applicable settings and legal requirements. Shopify's privacy portal provides information about exercising rights concerning processing it controls.

Information may also be disclosed with your authority, where required or authorised by law, to address fraud or a serious safety concern where legally permitted, or in connection with a genuine business sale or restructure subject to appropriate privacy and confidentiality safeguards.

We do not sell or rent our customer mailing list as a product. Advertising-related disclosures may nevertheless be classified as a sale, sharing or targeted-advertising activity under particular overseas laws. Where those laws apply, their disclosure and opt-out requirements apply to those activities.

11. Overseas handling and changes of systems

Our business is Australian, but several technology providers operate internationally. Information can be stored, processed or accessed outside Australia, including for hosting, communications, payments, video services and provider support.

Depending on the service and its configuration, likely overseas recipient locations include the United States, Canada, the United Kingdom, Ireland, Germany, the Netherlands, Singapore and India. Providers can also use other international hosting and support locations. Contact us for information about the locations relevant to a particular service. A provider's headquarters does not necessarily identify every location where information is handled.

We take the reasonable steps required by Australian law concerning overseas disclosures, including appropriate provider agreements and safeguards. Different countries can have different privacy laws. We do not treat acceptance of this Policy as blanket consent to waive protections applying to overseas disclosures.

Where EU or UK restricted-transfer rules apply, we use an applicable adequacy arrangement or appropriate safeguards, such as the European Commission's Standard Contractual Clauses together with the UK Addendum or another approved UK transfer instrument where relevant. We assess whether supplementary protections are needed. A statutory exception is used only where its conditions are met. Contact us for details of the safeguards relevant to your information and how to obtain a copy, subject to appropriate redaction of confidential information.

We transfer necessary records between authorised current and legacy systems to preserve purchases, access rights, communications and support during platform changes. Historical records can remain where needed for those purposes or legal retention. Changing platforms does not create new marketing consent or cancel an existing unsubscribe request.

12. Retention, security and incidents

We keep personal information for as long as reasonably needed for its lawful purpose and applicable recordkeeping obligations. In particular:

• Account and purchase records support ongoing course access, contractual entitlements and service administration.
• Necessary completion and certificate records support award verification and correction.
• Financial and transaction records are retained for applicable statutory periods and justified audit or dispute requirements.
• NSW health records collected when a client was an adult are generally retained for at least seven years from the last health service. Records collected while a client was under 18 are generally retained until they turn 25. Other legal or justified requirements can extend retention.
• Recordings and private video messages are retained according to their service or replay purpose, permissions and any relevant recordkeeping or claim requirements. Event replays can remain while included in the relevant course library.
• Marketing information is retained for lawful subscription management, with limited suppression and consent records retained where needed to demonstrate or respect a choice.
• Enquiries and correspondence are retained according to their continuing support, recordkeeping or justified complaint-handling purpose.

When information is no longer required, we take reasonable steps to delete or genuinely de-identify it, subject to lawful retention. Health-record disposal includes any required disposal record. Backup copies may expire on a different recovery cycle from active files; deletion is not always immediate across every system.

We take reasonable technical and organisational steps to protect electronic and paper information against misuse, interference, loss and unauthorised access, modification or disclosure. Measures depend on sensitivity and the system involved. No internet transmission or storage system is completely secure; this does not remove our protection obligations. Please protect your credentials and private links and report suspected compromise promptly.

We assess suspected incidents, take appropriate containment and remedial steps, and notify affected people and regulators when an applicable breach-notification law requires it.

13. Your requests, choices and complaints

Contact [email protected] to request access to or correction of your personal information, raise a concern, withdraw consent or ask about deletion. You can also use available account and communication controls. We may reasonably verify identity or a representative's authority before disclosing or changing records.

We respond within applicable legal timeframes. We aim to address ordinary Australian privacy requests and complaints within 30 calendar days, or explain a delay. Different statutory rules apply to some requests. We do not charge merely for an ordinary access or correction request; any lawful access charge will be explained beforehand. If a request cannot be fulfilled, we explain the lawful reason and available review or complaint options as required.

Deletion, access and other rights have legal exceptions. Some health, transaction, entitlement or dispute records must remain. Closing an account may affect delivery of ongoing digital access; we explain relevant consequences without treating a request as automatic cancellation of contractual rights. Withdrawal does not invalidate earlier lawful processing.

Please describe a complaint and the outcome you seek. We investigate and respond through the contact details below. Depending on the matter and jurisdiction, you can also complain to the Office of the Australian Information Commissioner, Information and Privacy Commission NSW, UK Information Commissioner's Office or your relevant overseas regulator. These processes do not remove any applicable right to seek regulatory assistance.

14. Additional international information

Where EU or UK data-protection law applies, Robert Reeves Pty Ltd is the controller for processing whose purposes and methods we determine. Applicable legal bases depend on the activity:

• Contract or requested pre-contract steps: supplying purchases, accounts, bookings and other agreed services.
• Legal obligation: complying with an obligation supporting this basis under the relevant law.
• Consent: optional tracking, marketing or other activities where consent is required or relied on. Sensitive information also requires an appropriate additional condition, such as explicit consent where applicable.
• Legitimate interests: proportionate administration, security, fraud prevention, service improvement and handling claims, where individual rights do not override those interests. This does not replace consent required for tracking or authorise unrelated use of sensitive information.

Subject to applicable conditions, you may have rights to access, correction, erasure, restriction, portability, consent withdrawal and objection. You may object to direct marketing at any time, including related profiling, and object on grounds relating to your circumstances to processing based on legitimate interests. GDPR requests are ordinarily addressed within one month, subject to lawful extensions. Relevant safeguards also apply to automated decisions where the applicable law requires them.

Other jurisdictions can provide additional rights concerning targeted advertising, sale or sharing, sensitive information, appeals and non-discrimination. Where a law applies, we honour its requirements and provide any necessary supplementary notice or mechanism. These rights are not represented as identical for every visitor or activity.

15. Children, external services and updates

Our purchases, paid accounts and ordinary contractual services are intended for adults aged 18 or over unless separately agreed. General public content can be viewed by younger visitors. We do not knowingly seek unnecessary children's information. A proposed service for a minor requires appropriate arrangements. Contact us if you believe a child's information has been provided inappropriately so we can assess and take suitable action.

External websites and social platforms have their own privacy practices. Their notices apply to processing they control. Our responsibilities for information we collect or disclose remain subject to applicable law.

We update this Policy when our practices or obligations change, revise its last-updated date and give additional notice or obtain fresh consent where required. Publishing an update does not itself authorise a new use requiring consent. Earlier versions may be retained for accountability.

16. Contact us

Robert Reeves Pty Ltd
ABN: 91 161 316 507
Privacy enquiries and complaints: [email protected]

PO Box 393
Charlestown NSW 2290
Australia

Please include enough information for us to understand your request, without sending unnecessary sensitive details through ordinary email.