1. Who We Are

The data controller responsible for the personal data processing described in this Privacy Policy is:

Valentina Giulia Vergani
Operating under the brand The Mental Space Method
Based in Italy
Email: hello@thementalspacemethod.com

The Mental Space Method is a brand operated by an individual and is not a separate incorporated legal entity.

Questions, requests, or concerns regarding privacy and personal data may be submitted to the email address above.

2. Scope of This Privacy Policy

This Privacy Policy applies to personal data processed through:

• the Site and its sales pages;

• checkout and payment processes;

• delivery of digital products;

• order-related and transactional emails;

• customer-support communications;

• cookies and consent-preference tools;

• advertising measurement and conversion-tracking technologies;

• links between the Site and our Facebook and Instagram profiles.

This Privacy Policy does not govern third-party websites, payment platforms, or social networks that process personal data under their own privacy policies.

3. How We Collect Personal Data

We may collect personal data:

• directly from you when you make a purchase, provide your details, or contact us;

• automatically from your browser or device when you use the Site;

• from payment providers when they confirm or process a transaction;

• from service providers that operate the Site, checkout, digital-product delivery, or transactional communications;

• through advertising technologies, but only after consent where required by law.

4. Categories of Personal Data We Process

4.1 Information You Provide

Depending on how you interact with the Site, we may process:

• first and last name;

• email address;

• country or billing information requested during checkout;

• products selected or purchased;

• order and transaction details;

• messages, questions, and support requests;

• any other information you voluntarily provide.

Please do not submit medical records, diagnoses, treatment information, or other sensitive personal data through the Site or by email.

4.2 Order and Transaction Information

When you purchase a digital product, we may process:

• product purchased;

• date and time of the order;

• order amount and currency;

• payment status;

• selected payment method;

• transaction or order identifier;

• refund, dispute, or chargeback information;

• information required to deliver the purchased product.

We do not receive or store your complete payment-card number, bank credentials, or PayPal password.

4.3 Technical and Usage Information

When you visit the Site, certain information may be processed automatically, including:

• IP address;

• browser type and version;

• device type;

• operating system;

• browser language;

• approximate location derived from the IP address;

• pages visited;

• referring page or advertising source;

• date and time of access;

• interactions with links and buttons;

• access to the checkout;

• technical logs, security data, and error information;

• cookie identifiers and consent preferences.

4.4 Cookie-Consent Information

When you interact with the cookie banner, we may process information such as:

• whether you accepted or rejected optional cookies;

• categories of cookies selected;

• date and time of the consent decision;

• consent identifier;

• information needed to remember or demonstrate your choice.

This information is used to respect your preferences and document compliance with applicable privacy requirements.

5. Purposes and Legal Bases for Processing

Where the General Data Protection Regulation applies, personal data is processed under one or more of the following legal bases.

5.1 Processing and Delivering Your Order

We process personal data to:

• complete and verify your purchase;

• process payment confirmations;

• send order confirmations;

• provide access to purchased digital products;

• send download links;

• address access or delivery problems;

• administer refunds and payment disputes.

Legal basis: performance of a contract or steps taken at your request before entering into a contract.

5.2 Transactional Communications

We use your email address to send communications directly related to your purchase, including:

• order confirmations;

• download links;

• product-access instructions;

• payment, refund, or dispute information;

• responses to customer-support requests;

• notices necessary for the delivery or continued availability of a purchased product.

These are service-related communications.

We do not currently add customers to a general marketing newsletter solely because they completed a purchase. Any future promotional email programme will be subject to the consent or opt-out requirements applicable to the recipient.

Legal basis: performance of a contract, compliance with legal obligations, and legitimate interests in providing customer support.

5.3 Website Operation, Security, and Fraud Prevention

We may process technical and transaction-related information to:

• operate and maintain the Site;

• protect the checkout and digital products;

• detect suspicious or fraudulent activity;

• prevent unauthorized access;

• identify and resolve technical problems;

• enforce our Terms and Conditions;

• protect our legal rights;

• establish, exercise, or defend legal claims.

Legal basis: legitimate interests in maintaining a secure and reliable online service, and compliance with legal obligations where applicable.

5.4 Accounting, Tax, and Legal Compliance

We may process and retain order and transaction information when necessary to:

• comply with accounting and tax requirements;

• meet consumer-protection obligations;

• respond to lawful requests from courts, authorities, or regulators;

• maintain legally required business records;

• manage legal claims and disputes.

Legal basis: compliance with legal obligations and legitimate interests in protecting legal rights.

5.5 Cookie-Preference Management

We use Cookiebot CMP to:

• display the cookie-consent banner;

• record your cookie preferences;

• prevent optional marketing technologies from operating before consent;

• allow you to change or withdraw your choice;

• retain evidence of consent or refusal where required.

Legal basis: compliance with legal obligations and legitimate interests in documenting and respecting privacy choices.

5.6 Advertising Measurement and Marketing Technologies

Where you consent to the Marketing category, we may use the Meta Pixel to:

• measure visits generated by advertisements;

• understand whether an advertisement led to a checkout or purchase;

• create aggregated advertising reports;

• evaluate the effectiveness of Facebook and Instagram campaigns;

• optimize the delivery of advertisements;

• reduce repeated or irrelevant advertising;

• create or use advertising audiences where permitted.

Legal basis: consent.

Refusing or withdrawing consent to Marketing cookies does not prevent you from browsing the Site or purchasing the digital products.

6. Payments

Payments may be processed through Stripe or PayPal.

These providers may collect and process payment details directly, including:

• card or account information;

• billing information;

• transaction details;

• device and fraud-prevention data;

• identity-verification information where required.

We receive only the information necessary to confirm, administer, refund, or support the transaction.

Stripe and PayPal may act as independent data controllers for payment processing, regulatory compliance, fraud prevention, risk management, and other activities described in their respective privacy policies.

Your use of their services is also governed by their terms and privacy notices.

7. Systeme.io

The Site, sales funnel, checkout pages, order automations, transactional emails, and digital-product delivery are operated using Systeme.io, provided by ITACWT Limited, an Irish company.

Systeme.io may process:

• contact information;

• order and product information;

• page and checkout interactions;

• transactional-email information;

• technical and security logs;

• product-access and delivery data.

Systeme.io processes this information to host and operate the Site, manage orders, automate product delivery, and send service-related communications.

8. Cookiebot CMP

The cookie-consent platform is provided through Cookiebot CMP, a service of Usercentrics A/S, based in Denmark.

Cookiebot is used to:

• display the consent banner;

• organize cookies into categories;

• record and remember cookie choices;

• block optional scripts before consent;

• allow preferences to be changed or withdrawn.

The Site currently uses the following consent categories:

• Necessary

• Preferences

• Statistics

• Marketing

Necessary technologies may operate without consent where they are required to provide the Site or service requested.

Preferences, Statistics, and Marketing technologies remain optional. The Meta Pixel is assigned to the Marketing category.

Further details about cookies, providers, purposes, and durations are available in the separate Cookie Policy and in the cookie-details section displayed by Cookiebot.

9. Meta Pixel

The Site uses the Meta Pixel, provided by Meta Platforms Ireland Limited and associated Meta entities.

The Meta Pixel is configured to remain blocked unless you consent to the Marketing category through Cookiebot.

If Marketing consent is provided, the Pixel may process or transmit information including:

• IP address;

• browser and device information;

• user-agent information;

• page URL;

• referring source;

• date and time of interaction;

• browser or advertising identifiers;

• information indicating that a website action occurred.

The events configured on the Site may include:

• PageView;

• ViewContent;

• InitiateCheckout;

• Purchase.

These events indicate that a page was viewed, the sales content was accessed, the checkout was reached, or a purchase was completed.

Our current browser-Pixel configuration is intended to communicate the occurrence of these events. We do not intentionally configure the Pixel to transmit:

• complete payment-card details;

• PayPal credentials;

• passwords;

• customer-support messages;

• medical records or diagnoses;

• the contents of purchased digital products;

• sensitive personal information.

Depending on the purpose of the processing, Meta may act:

• as a processor providing matching, measurement, and campaign-reporting services on our behalf;

• as a joint controller with us for the collection and initial transmission of certain event data;

• as an independent controller for subsequent processing carried out by Meta under its own privacy policy and terms.

Meta may use information received through its business tools for measurement, analytics, security, product improvement, and advertising purposes as described in its applicable terms and privacy policy.

Managing Meta Pixel Consent

You may:

• reject Marketing cookies when the banner is first displayed;

• accept only selected categories;

• accept all categories;

• reopen the cookie-preference tool;

• withdraw Marketing consent at any time.

After withdrawal, the Meta Pixel will no longer be authorized to operate during subsequent use of the Site, subject to the technical implementation of the consent tool.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

10. Service Providers and Recipients

We may disclose personal data only where necessary to the following categories of recipients:

• Systeme.io / ITACWT Limited, for hosting, checkout, automation, email delivery, and digital-product access;

• Stripe, for payment processing, fraud prevention, and payment administration;

• PayPal, for payment processing, fraud prevention, and payment administration;

• Cookiebot / Usercentrics A/S, for consent-preference management;

• Meta Platforms Ireland Limited and associated Meta entities, after Marketing consent, for advertising measurement and related services;

• technical, hosting, security, and infrastructure providers used by the services above;

• accountants, legal advisers, and other professional advisers where necessary;

• courts, regulators, law-enforcement bodies, tax authorities, or public authorities where disclosure is legally required;

• parties involved in preventing fraud, managing payment disputes, or protecting legal rights.

Service providers acting solely on our behalf are permitted to process personal data only for the relevant service and under applicable contractual and data-protection obligations.

Some providers may act as independent controllers for particular activities, including payment processing, fraud prevention, regulatory compliance, and their own platform operations.

11. International Data Transfers

Some providers may process personal data outside Italy or the European Economic Area, including in the United States and other countries.

Where international transfers are subject to the GDPR, they may be based on:

• a European Commission adequacy decision;

• the EU–U.S. Data Privacy Framework, where applicable to a participating recipient;

• Standard Contractual Clauses approved by the European Commission;

• supplementary technical, contractual, or organizational safeguards;

• another lawful transfer mechanism available under applicable law.

The mechanism used may depend on the recipient, destination, type of service, and circumstances of the transfer.

You may contact us for further information about the safeguards relevant to personal data processed on our behalf.

12. Data Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy.

Retention criteria include:

• the duration of the customer relationship;

• the time required to deliver and support purchased products;

• applicable accounting and tax-retention requirements;

• consumer-protection and contractual limitation periods;

• the need to prevent fraud or resolve disputes;

• the need to establish, exercise, or defend legal claims;

• applicable consent-recordkeeping requirements;

• security and technical troubleshooting needs.

In particular:

• order and transaction records may be retained for the period required under applicable accounting, tax, and consumer laws;

• product-delivery records may be retained while necessary to provide access and resolve delivery issues;

• support communications may be retained until the request is resolved and for any additional period reasonably required for dispute management;

• consent records may be retained as necessary to demonstrate and respect the choice made;

• event data processed by third-party providers is retained according to their applicable terms, settings, and legal obligations.

When personal data is no longer required, it will be deleted, anonymized, or securely restricted, unless further retention is required by law.

13. Whether Providing Data Is Mandatory

Providing contact, order, and payment-related information is necessary to complete a purchase and deliver the digital product.

If required information is not provided, we may be unable to:

• process the order;

• verify payment;

• deliver the product;

• send access instructions;

• respond effectively to a support request.

Providing consent to optional Marketing cookies is not required to make a purchase.

14. Your Privacy Rights

Depending on your location and applicable law, you may have the right to:

• request confirmation that personal data is being processed;

• obtain access to your personal data;

• request correction of inaccurate or incomplete data;

• request deletion of personal data;

• request restriction of processing;

• object to processing based on legitimate interests;

• withdraw consent at any time;

• receive certain personal data in a portable format;

• object to direct marketing;

• request information about international-transfer safeguards;

• lodge a complaint with a competent supervisory authority.

These rights may be subject to legal limitations or exceptions.

To submit a request, contact:

hello@thementalspacemethod.com

We may ask for information reasonably necessary to verify your identity and protect personal data from unauthorized disclosure.

Where the GDPR applies, you may also lodge a complaint with:

Garante per la protezione dei dati personali

or with the data-protection authority in the EU or EEA country where you live, work, or believe a violation occurred.

15. Withdrawing Cookie Consent

Cookie consent may be changed or withdrawn by reopening the cookie-preference tool available on the Site.

Selecting Deny or disabling the Marketing category prevents the Meta Pixel from being authorized through the consent-management configuration.

Browser settings may also be used to delete stored cookies, but browser-level deletion may remove your saved preference and cause the consent banner to be displayed again.

16. United States Privacy Rights

We do not sell personal data for monetary consideration.

Under some U.S. state privacy laws, the use of third-party advertising technologies may be considered:

• targeted advertising;

• sharing of personal data;

• cross-context behavioural advertising.

To the extent such laws apply, you may opt out of these activities by rejecting or disabling the Marketing category in the cookie-preference tool.

Residents of certain U.S. states may also have rights to:

• request access to personal data;

• request correction;

• request deletion;

• obtain a copy of personal data;

• opt out of targeted advertising, sale, or sharing;

• appeal the refusal of a privacy request;

• receive equal service without unlawful discrimination for exercising privacy rights.

Applicability may depend on the relevant state law, legal thresholds, and available exceptions.

Requests may be sent to:

hello@thementalspacemethod.com

17. Automated Decision-Making and Profiling

We do not use personal data to make decisions that produce legal or similarly significant effects solely through automated processing.

Meta may use automated systems to determine advertising audiences, measure campaign performance, or personalize advertisements within its platforms, in accordance with Meta’s own terms, privacy policy, and user controls.

18. Sensitive Personal Data

The Site provides educational digital content about mental overload and everyday mental clarity. It is not intended to collect medical or clinical data.

Please do not send:

• medical diagnoses;

• treatment information;

• therapy notes;

• health records;

• information about disabilities or medical conditions;

• other special-category or sensitive personal information.

If such information is submitted without being requested, we may delete or restrict it where appropriate.

19. Children’s Privacy

The Site and its products are intended for adults.

We do not knowingly collect personal data from children under 13. We also do not intentionally offer the Site or its products directly to children where parental consent would be required under applicable law.

If you believe that a child has submitted personal data, contact us so that we can review and, where appropriate, delete the information.

20. Data Security

We use reasonable technical and organizational safeguards designed to protect personal data against:

• unauthorized access;

• accidental loss;

• misuse;

• alteration;

• unauthorized disclosure;

• destruction.

These measures may include:

• restricted access;

• password protection;

• secure payment providers;

• encrypted data transmission where supported;

• platform and account-security controls;

• service-provider due diligence;

• monitoring and fraud-prevention measures.

No online system or method of transmission can be guaranteed to be completely secure.

21. Third-Party Websites and Social Media

The Site may contain links to third-party websites, including Facebook, Instagram, Stripe, PayPal, and other external services.

When you follow an external link or interact with our social-media profiles, the third-party provider may collect and process information independently.

For example, when you:

• follow our Facebook or Instagram profile;

• like, comment on, or share content;

• send a direct message;

• click a social-media advertisement;

Meta may process information under its own privacy policy and platform terms.

We are not responsible for the privacy practices of third-party websites or services that we do not control.

22. Changes to This Privacy Policy

We may update this Privacy Policy when necessary to reflect:

• changes to the Site or products;

• the introduction or removal of service providers;

• changes to advertising or analytics technologies;

• changes to payment methods;

• legal or regulatory developments;

• changes to our personal-data processing practices.

The updated version will be published on the Site with a revised “Last updated” date.

Where required by law, we will provide additional notice or request renewed consent.

23. Contact Us

For privacy questions, complaints, or requests concerning your personal data, contact:

Valentina Giulia Vergani
Operating under the brand The Mental Space Method
Italy
Email: hello@thementalspacemethod.com