Privacy Policy – Kakawa Woman

Last updated: August, 15th 2026

This Privacy Policy explains how Andrea Zúñiga-Paltzer, operating Kakawa Woman, collects, uses, stores, shares and protects personal information when you visit our website, contact us, subscribe to our emails, use our Fertility Self-Check or purchase our services.

This Privacy Policy applies to:

• our website at www.kakawawoman.com;
• our landing pages;
• newsletter, waitlist and email subscriptions;
• individual communications with us;
• the Fertility Self-Check;
• purchases and payment administration; and
• related online programmes, resources and services.

We process personal information in accordance with the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (“PECR”), as amended, and the Data (Use and Access) Act 2025. Where we offer services to, or monitor the behaviour of, individuals in the European Economic Area (“EEA”), the EU General Data Protection Regulation (“EU GDPR”)may also apply.

1. Who We Are

For the purposes of UK data protection law and, where applicable, EU data protection law, the controller responsible for the processing described in this Privacy Policy is:

Andrea Zúñiga-Paltzer
Kakawa Woman
283 Coldharbour Lane
London SW9 8RP
United Kingdom

Website: www.kakawawoman.com
Email: hello@kakawawoman.com

You may contact us using these details if you:

• have a question about this Privacy Policy;
• wish to exercise your data protection rights;
• want to withdraw your consent;
• want to make a complaint about our handling of your information; or
• have a question about the personal information we hold about you.

We are not currently required to appoint a formal Data Protection Officer. Privacy enquiries should be directed to Andrea Zúñiga-Paltzer using the contact details above.

2. Important Medical Disclaimer

Kakawa Woman provides general educational, lifestyle and wellbeing information relating to fertility and preparation for pregnancy.

Kakawa Woman does not provide:

• medical diagnosis;
• medical treatment;
• fertility treatment;
• clinical advice;
• emergency medical assistance; or
• a substitute for advice from a doctor, fertility specialist or other appropriately qualified healthcare professional.

Information provided through the website, emails, programmes, resources or Fertility Self-Check should not be used to diagnose a condition or make decisions about medical treatment.

Do not send urgent medical enquiries to us by email. If you need medical advice or urgent assistance, contact an appropriately qualified healthcare professional or the relevant emergency service.

3. Personal Information We May Collect

The personal information we collect depends on how you interact with us.

3.1 Information You Provide Directly

We may collect:

• your name, where requested;
• your email address;
• your telephone number, if you choose to provide it;
• your country or general location;
• your communication and subscription preferences;
• information you enter into a registration, contact, waitlist or purchase form;
• records of your consent;
• correspondence you send to us;
• questions, feedback or complaints;
• information required to administer a programme or service;
• transaction and billing information; and
• any other information you voluntarily provide.

Our standard newsletter and waitlist forms are intended to collect only the information necessary to manage the relevant subscription, normally an email address and a consent record.

We do not intend these forms to collect medical records, treatment information, cycle information or detailed health histories.

3.2 Fertility-Related and Special Category Data

Our services concern fertility and preparation for pregnancy. Even where you provide only an email address, the context in which that address is collected may reveal or permit an inference about:

• an interest in fertility;
• a wish to become pregnant;
• reproductive health concerns; or
• engagement with fertility-related information or services.

We therefore take a cautious approach and treat identifiable subscriber and participant information connected with Kakawa Woman as special category data for the purposes of Article 9 UK GDPR and, where applicable, Article 9 EU GDPR.

This approach applies even where you have not provided a diagnosis, medical history, cycle information, treatment information or other detailed health data.

We do not intentionally request detailed medical records, test results, diagnoses or fertility-treatment documents through general subscription forms.

3.3 Information Collected Automatically

When you visit our website, our website infrastructure providers may automatically process limited technical information, including:

• your IP address;
• browser type and version;
• device type and operating system;
• requested pages and files;
• referring website or source;
• dates and times of requests;
• approximate location derived from an IP address;
• technical identifiers;
• error, diagnostic and performance information; and
• security and fraud-prevention information.

This information may be contained in server, security or content-delivery logs.

We use it where necessary to:

• deliver the website;
• maintain website security;
• prevent abuse and attacks;
• diagnose technical problems;
• maintain availability and performance; and
• establish, exercise or defend legal claims.

We do not intend to use technical logs to create fertility profiles.

3.4 Information Received from Service Providers

We may receive limited information from:

• GoDaddy, concerning our domain, email delivery, account security, routing, abuse reports and technical errors;
• Netlify, concerning website access, deployment, availability, security incidents and technical errors;
• Brevo, concerning subscriptions, consent, delivery, bounces, complaints, unsubscribes and, where enabled, email engagement;
• Stripe, concerning payment status, transaction identifiers, cancellations, disputes, chargebacks and risk indicators; and
• other service providers that you interact with in connection with our services.

We receive only the information reasonably required for the relevant purpose.

4. How and Why We Use Personal Information

We may process personal information for the following purposes:

Where we rely on legitimate interests, those interests may include:

• operating and protecting our business;
• responding to ordinary enquiries;
• providing appropriate customer support;
• maintaining accurate business records;
• protecting our systems and communications;
• preventing fraud, spam and abuse; and
• establishing, exercising or defending legal claims.

We assess whether those interests are overridden by your rights and interests, taking account of the potentially sensitive fertility-related context.

Whether You Have to Provide Personal Information

Whether you have to provide personal information to us, and what happens if you do not, depends on why we are collecting it:

• Newsletter, waitlist and requested resources: providing your email address, and giving any consent we ask for, is entirely voluntary. You are under no obligation to provide it. If you choose not to, the only consequence is that we cannot send you the emails, waitlist updates or free resources you have asked for.
• Purchases and programmes: where you buy a service or join a programme, the information we need to identify you, contact you, deliver the service and take payment is required in order to enter into and perform our contract with you. If you do not provide it, we will not be able to provide the service or process your payment.
• Legal, tax and accounting records: once you have transacted with us, we are required by law to keep certain transaction information for a set period. Providing this information, and retaining it, is a statutory requirement.

We will always make clear on the relevant form which information is required and which is optional.

5. Consent for Fertility-Related Emails

We will request your freely given, specific, informed and unambiguous consent before adding you to a fertility-related newsletter, waitlist or automated email sequence where consent is required.

Because the context may reveal or allow an inference about fertility or reproductive health, we also request explicit consent for the relevant special category processing.

Our subscription forms should use:

• a clear explanation of the emails you will receive;
• a separate, affirmative consent checkbox;
• a checkbox that is not pre-selected;
• a link to this Privacy Policy;
• a record of when and how consent was provided; and
• a straightforward method of withdrawing consent.

A suitable consent statement is:

I explicitly consent to Andrea Zúñiga-Paltzer processing my email address and the fertility-related context of my subscription to send me information about Kakawa Woman, fertility education, related resources and programme updates. I understand that this may reveal information about my interest in fertility or preparation for pregnancy. I can withdraw my consent at any time using the unsubscribe link in any email or by contacting hello@kakawawoman.com.

Consent to marketing will not be made a condition of accessing a service where marketing is not necessary to provide that service.

An email sent directly to hello@kakawawoman.com will not, by itself, be treated as consent to add the sender to a Brevo mailing list.

6. Withdrawing Consent and Unsubscribing

You may withdraw your consent at any time by:

• selecting the unsubscribe link in an email;
• contacting hello@kakawawoman.com; or
• using another preference-management method made available to you.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

After you unsubscribe, we may retain a minimal suppression record, normally your email address and the fact that you unsubscribed. This is used only to ensure that we do not accidentally send you further marketing emails. The suppression record will not be used to send marketing.

Withdrawing marketing consent does not prevent us from sending essential administrative or transactional messages concerning a service you have purchased or specifically requested.

7. Fertility Self-Check

The website may provide a Fertility Self-Check for general educational and self-reflection purposes.

The Self-Check:

• is not a medical assessment;
• does not diagnose any condition;
• does not recommend medical treatment;
• does not replace professional medical advice; and
• must not be used to make urgent or significant healthcare decisions.

The Self-Check is designed so that answers and results are processed locally within your browser.

Unless this Privacy Policy and the Self-Check interface clearly state otherwise:

• your individual answers are not transmitted to us;
• your result is not stored in our database;
• your result is not added to your Brevo profile;
• your answers and result are not sent to GoDaddy, Stripe or other marketing providers;
• we cannot view your completed answers or result; and
• no identifiable health profile is created from your answers.

The webpage containing the Self-Check may still generate ordinary technical access logs through Netlify or other infrastructure providers. These logs should not contain your Self-Check answers or results.

We will configure the Self-Check so that answers and results are not placed in:

• web page addresses;
• URL query strings;
• browser history entries;
• analytics events;
• domain-routing information; or
• marketing tracking parameters.

You should avoid using the Self-Check on a shared or public device if other people may be able to view your screen or browser history.

8. Business Email Through GoDaddy

We use GoDaddy for our domain and associated email service. Our business email address is hello@kakawawoman.com.

Depending on the technical configuration of the service, GoDaddy and providers involved in delivering its email infrastructure may process:

• sender and recipient names;
• email addresses;
• email subject lines;
• message contents;
• attachments;
• message headers;
• routing and delivery metadata;
• dates and times;
• IP addresses;
• spam, malware and security information;
• login and account activity; and
• backup or diagnostic information.

We use business email to:

• receive and respond to enquiries;
• communicate with customers and subscribers;
• administer purchases and participation;
• respond to complaints or privacy requests;
• communicate with suppliers and professional advisers; and
• maintain necessary business and legal records.

We do not routinely transfer the contents of individual correspondence or attachments from our GoDaddy email account to Brevo.

Please do not send detailed medical records, test results, treatment documents, identity documents or other highly sensitive information by ordinary email unless we have specifically requested it, explained why it is required and agreed on an appropriate method for sending it.

For more information, see the GoDaddy Global Privacy Notice.

9. Website Hosting Through Netlify

Our website and landing pages are hosted and technically delivered through Netlify.

When you access the website, Netlify may process technical information necessary to provide and protect the service, including:

• IP addresses;
• requested pages and files;
• browser and device information;
• dates and times of requests;
• referring pages;
• error and diagnostic information; and
• access and security logs.

We use Netlify to:

• host and deliver website content;
• maintain website availability and performance;
• protect the website against attacks and misuse;
• deploy updates; and
• diagnose technical problems.

Our lawful basis is normally our legitimate interests under Article 6(1)(f), specifically our interests in maintaining a functional, secure and reliable website.

GoDaddy and Netlify perform different functions. GoDaddy manages the domain, DNS and business email, while Netlify primarily hosts and delivers the website.

10. Newsletter and Automated Emails Through Brevo

We use Brevo to manage:

• newsletter subscriptions;
• waitlists;
• consent records;
• requested email resources;
• automated email sequences;
• email delivery;
• unsubscribes and suppression records;
• bounce and complaint handling; and
• email engagement, where lawfully enabled.

Brevo may process:

• your email address;
• your name, if provided;
• subscription source;
• consent wording;
• the date and time of consent;
• technical evidence associated with consent;
• email delivery status;
• bounce and complaint information;
• unsubscribe information;
• campaign history; and
• opening or link-interaction information, where tracking is enabled.

We use Brevo for fertility-related marketing only with the required consent and explicit consent.

We only use email-opening or link tracking where you have given consent to it. Where such tracking is used, we will provide appropriate information and obtain your consent as required by PECR, UK GDPR and applicable EU law, and you can withdraw that consent at any time.

Where such tracking is not necessary, we will consider disabling it or using less intrusive aggregate reporting.

You may unsubscribe at any time.

11. Payments Through Stripe

We use Stripe to process payments.

When you make a payment, Stripe may collect and process:

• your name;
• email address;
• billing address;
• payment-card or payment-method details;
• transaction amount and currency;
• payment status;
• transaction identifiers;
• device and browser information;
• IP address;
• fraud and risk indicators;
• authentication information; and
• information concerning cancellations, disputes or chargebacks.

Full payment-card details are generally collected directly by Stripe and are not made available to us.

We may receive limited transaction information needed to:

• confirm payment;
• provide the purchased service;
• issue invoices or receipts;
• maintain accounting records;
• respond to payment enquiries;
• prevent fraud; and
• manage disputes or chargebacks.

Stripe may process certain information as our service provider and certain information as an independent controller, for example where Stripe must meet legal, regulatory, security or fraud-prevention obligations.

A payment for a fertility-related service may reveal or allow an inference about a person’s fertility interests. We therefore handle identifiable transaction information associated with Kakawa Woman with appropriate care.

12. Cookies and Similar Technologies

Cookies are small files or identifiers stored on, or accessed from, your device.

We may use strictly necessary technologies to:

• deliver the website;
• maintain security;
• prevent fraud or abuse;
• remember privacy choices;
• operate forms; or
• provide functions specifically requested by you.

Strictly necessary technologies do not normally require consent, although we will provide appropriate information about them.

We will not set non-essential analytics, advertising, profiling or social-media cookies before obtaining any consent required under PECR and applicable EU rules.

Where non-essential cookies or tracking tools are introduced:

• a cookie banner or consent mechanism will be provided;
• non-essential technologies will remain disabled until consent is given;
• consent choices will be equally accessible;
• rejecting non-essential cookies will be as straightforward as accepting them;
• consent will not be obtained through pre-selected options; and
• consent can be withdrawn or changed.

A separate cookie notice may be provided if non-essential technologies are used.

13. Embedded Content and Third-Party Services

Our website may include content or functionality supplied by third parties, such as:

• YouTube or Vimeo videos;
• Instagram or TikTok content;
• webinar platforms;
• booking or calendar tools;
• videoconferencing services;
• external forms;
• payment interfaces; or
• social-media links.

Embedded content may behave as though you visited the third party’s website directly. The third party may process your IP address, device information, cookies, account information and interaction data.

Where possible, we will:

• avoid loading non-essential embedded content before consent;
• use privacy-enhanced settings;
• provide a link instead of automatically embedding content; or
• clearly identify the third party before its content is activated.

Third-party websites and services operate under their own privacy policies. We are not responsible for the privacy practices of an external website merely because we provide a link to it.

14. Sharing Personal Information

We may share personal information with carefully selected recipients where necessary, including:

• GoDaddy, for domain registration, DNS, business email, routing and related security services;
• Netlify, for hosting and technically delivering the website;
• Brevo, for subscription management, requested resources and email communications;
• Stripe, for payment processing, fraud prevention and transaction administration;
• webinar, booking, videoconferencing or event providers, where used;
• IT, security, support and consent-management providers;
• accountants, lawyers, insurers and other professional advisers;
• potential purchasers or successors in connection with a legitimate business reorganisation, subject to appropriate confidentiality protections;
• courts, regulators and public authorities where required by law; and
• law-enforcement bodies where disclosure is necessary and lawful.

A provider’s inclusion in this list does not mean that it receives every category of personal information. We seek to provide only the information reasonably necessary for its function.

We do not sell personal information.

We do not provide identifiable fertility-related information to data brokers.

We do not share identifiable fertility-related profiles with third parties for their independent advertising purposes.

15. Processor and Controller Roles

Some providers process personal information on our instructions and act as processors. We seek to put appropriate data-processing terms in place with these providers where required.

A provider may also act as an independent controller for certain activities where it determines why and how information is processed. Examples may include:

• legal and regulatory compliance;
• account administration;
• fraud prevention;
• network and service security;
• abuse detection;
• payment regulation; and
• responding to lawful government requests.

The precise role depends on the particular processing activity, service configuration, contractual terms and applicable law.

16. International Data Transfers

Our service providers and their approved subprocessors may process personal information outside the United Kingdom or European Economic Area.

International processing may occur through GoDaddy, Netlify, Brevo, Stripe and other providers we lawfully engage.

This does not necessarily mean that every category of information is transferred internationally. The location of processing depends on:

• the provider entity;
• account and storage configuration;
• service infrastructure;
• support access;
• backup arrangements; and
• subprocessor locations.

Where UK GDPR or EU GDPR applies, we will use an appropriate transfer safeguard, such as:

• a UK or EU adequacy decision;
• the EU–US Data Privacy Framework, where valid and applicable;
• the UK Extension to the EU–US Data Privacy Framework, where valid and applicable;
• approved EU Standard Contractual Clauses;
• the UK International Data Transfer Addendum;
• a UK International Data Transfer Agreement; or
• another lawful transfer mechanism.

Where required, we will consider whether supplementary contractual, organisational or technical measures are needed.

If EU GDPR applies and Article 27 requires us to appoint a representative in the EU, we will appoint one and add the representative’s contact details to this Privacy Policy. Where we already offer services to, or monitor the behaviour of, individuals in the EEA, we will ensure that any required representative is appointed before we begin that processing.

17. How Long We Keep Personal Information

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, security and dispute-resolution requirements.

Indicative retention periods are:

We may retain information for longer where:

• required by law;
• necessary for an active complaint or dispute;
• necessary to establish, exercise or defend legal claims;
• requested by a regulator or court; or
• deletion would interfere with the detection or investigation of fraud or security incidents.

We may delete information earlier where it is no longer needed.

Backups and provider systems may retain limited copies for a short additional period before they are overwritten or securely deleted.

18. Data Security

We use appropriate technical and organisational measures designed to protect personal information against:

• unauthorised access;
• accidental loss;
• unlawful use;
• unauthorised alteration;
• inappropriate disclosure; and
• destruction.

Measures may include:

• restricting access to people who genuinely need it;
• using strong passwords and multi-factor authentication where available;
• using reputable service providers;
• maintaining secure account and access controls;
• applying software and security updates;
• using encrypted connections;
• minimising the information collected;
• separating individual correspondence from marketing profiles;
• reviewing provider permissions and configurations; and
• maintaining procedures for suspected personal data breaches.

No method of online transmission or electronic storage is completely secure. We cannot guarantee absolute security, but we take reasonable and proportionate steps to reduce the risk.

If a personal data breach creates a risk to individuals, we will assess it and notify the appropriate supervisory authority where legally required. Where a breach is likely to create a high risk to affected individuals, we will also notify those individuals where required.

19. Your Data Protection Rights

Depending on the circumstances and applicable law, you may have the right to:

• be informed about how your personal information is used;
• request access to your personal information;
• request correction of inaccurate or incomplete information;
• request erasure of your personal information;
• request restriction of processing;
• object to processing based on legitimate interests;
• object at any time to direct marketing;
• request data portability where the legal requirements are met;
• withdraw consent at any time;
• request information about international transfer safeguards;
• challenge certain decisions based solely on automated processing; and
• make a complaint to a supervisory authority.

These rights are not absolute. An exemption or competing legal obligation may apply in some circumstances.

You will not normally be charged for exercising your rights. A reasonable fee may be charged, or a request may be refused, where permitted by law—for example, if a request is manifestly unfounded or excessive.

We may need to request information to confirm your identity before responding. We will use that information only to verify your identity and handle your request.

We aim to respond within one month. The period may be extended where permitted for particularly complex or numerous requests, in which case we will explain the reason for the extension.

To exercise a right, contact hello@kakawawoman.com.

20. Automated Decision-Making and Profiling

We do not make decisions that produce legal or similarly significant effects about you solely through automated processing.

The Fertility Self-Check may display an automatically generated educational result based on answers entered locally in your browser. It is not:

• a medical diagnosis;
• a clinical assessment;
• a decision about access to healthcare;
• a decision about eligibility for a service; or
• a legally or similarly significant automated decision.

If we introduce significant automated decision-making or fertility-related profiling in the future, we will update this Privacy Policy and provide the information and safeguards required by law before that processing begins.

21. Children

Kakawa Woman is intended for adults aged 18 or over.

We do not knowingly provide our services to children or intentionally collect their personal information.

If you believe that a child has provided personal information to us, contact hello@kakawawoman.com so that we can investigate and, where appropriate, delete it.

22. Complaints

If you are unhappy with how we have collected or used your personal information, you can make a data protection complaint to us. We encourage you to contact us first so that we have the opportunity to look into your concern and put things right.

You can raise a data protection complaint with us at any time by:

• emailing hello@kakawawoman.com, using the word “Complaint” in the subject line; or
• using any data protection complaint form we make available on www.kakawawoman.com.

When you make a data protection complaint to us, we will:

• acknowledge your complaint within 30 days of receiving it;
• take appropriate steps to investigate it without undue delay;
• keep you informed of how your complaint is progressing; and
• tell you the outcome of our investigation.

You also have the right to complain to the UK supervisory authority, the Information Commissioner’s Office (“ICO”), at any time. You do not have to complain to us first. You can contact the ICO at www.ico.org.uk, by calling its helpline on 0303 123 1113, or by writing to: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF, United Kingdom.

If you are located in the European Economic Area and EU GDPR applies, you may also have the right to complain to the data protection authority in the country where you live, work or believe an infringement occurred.

Making a complaint does not affect any other legal rights or remedies available to you.

23. Changes to This Privacy Policy

We may update this Privacy Policy where necessary to reflect:

• changes to our services;
• changes to our website or forms;
• new providers or technologies;
• changes to processing purposes;
• changes to the law or regulatory guidance; or
• improvements to our privacy practices.

The current version will be published on www.kakawawoman.com, together with the date it was last updated.

If a change materially affects processing based on consent, we will request new consent where required.

We will not treat continued website use as explicit consent to materially different special category processing.

24. Contact Us

For questions, requests or complaints concerning privacy or personal information, contact:

Andrea Zúñiga-Paltzer
Kakawa Woman
283 Coldharbour Lane
London SW9 8RP
United Kingdom

Website: www.kakawawoman.com
Email: hello@kakawawoman.com