This Privacy Policy explains how Shambala Iboga (“we,” “us,” or “the Company”) collects, uses, discloses, and protects personal information of visitors, customers, and retreat guests (“you”) in connection with shambalaiboga.com and related retreat and e-commerce services (the “Services”). By using the Services, you agree to the practices described in this Policy.
1. Who We Are
Shambala Iboga operates an e-commerce platform selling bwitti-tradition products, including iboga bark, powder, and fruit, and offers guided retreat experiences. For the purposes of applicable data protection law, Shambala Iboga is the data controller responsible for your personal information collected through the Services.
2. Information We Collect
We collect only the information necessary to process orders, deliver products, administer retreat bookings, and operate the site. This is limited to:
- Identity data — full name
- Contact data — email address and shipping/billing address
- Transaction data — payment details necessary to complete a purchase (see Section 4, Payment Processing)
- Order and correspondence records — purchase history and any messages you send us
We do not knowingly collect sensitive health data, biometric data, or government identification through the Services beyond what is stated above.
3. How We Use Your Information
We use the information collected for the following purposes only:
- Processing and fulfilling product orders and retreat bookings
- Communicating order status, shipping updates, and retreat logistics
- Responding to customer inquiries and support requests
- Complying with legal, tax, customs, and export/import obligations
- Preventing fraud and protecting the security of transactions
4. Payment Processing
Payments are processed through third-party payment rails, which may include:
- Cryptocurrency payments processed via a self-hosted BTCPay Server instance, which interacts directly with public blockchain networks
- Bank transfer processed via Wise or equivalent regulated payment institutions
We do not store full payment credentials on our servers. Cryptocurrency transactions are recorded on public, immutable blockchain ledgers outside our control; please review the relevant blockchain network’s characteristics before paying by this method. Bank transfer providers process payment data under their own privacy policies and regulatory obligations.
5. Legal Bases for Processing (GDPR/UK GDPR)
Where the EU/UK General Data Protection Regulation applies, we rely on the following legal bases:
- Contractual necessity — to fulfil an order or retreat booking you have requested
- Legal obligation — to meet tax, customs, and financial recordkeeping requirements
- Legitimate interests — to prevent fraud and maintain the security of our Services
6. Your Privacy Rights
6.1 EU/UK (GDPR)
You have the right to access, correct, delete, restrict, or port your personal data, and to object to certain processing. You may also lodge a complaint with your local supervisory authority.
6.2 United States (CCPA/CPRA and state equivalents)
California and other US state residents have the right to know what personal information is collected, to request deletion, to correct inaccurate information, and to opt out of the sale or sharing of personal information. We do not sell personal information.
6.3 Other Jurisdictions
Residents of Canada (PIPEDA), Brazil (LGPD), and other jurisdictions with comparable data protection laws have similar rights of access, correction, and deletion. To exercise any right described in this section, contact us using the details in Section 12.
7. Data Sharing and Disclosure
We do not sell your personal information. We may share limited data with:
- Shipping and logistics carriers, to deliver physical orders
- Payment processors identified in Section 4, to complete transactions
- Professional advisors and regulators, where required by law
We do not share personal information with third parties for their own marketing purposes.
8. International Data Transfers
Because we serve customers and retreat guests globally, your information may be transferred to and processed in countries other than your own, including Zimbabwe and other jurisdictions in which we or our service providers operate. Where required, we rely on appropriate safeguards such as standard contractual clauses for transfers originating in the EU/UK.
9. Data Retention
We retain order, payment, and correspondence records only for as long as necessary to fulfil the purpose for which they were collected, and thereafter as required by applicable tax, customs, and accounting law. Data no longer required is securely deleted or anonymised.
10. Data Security
We apply reasonable technical and organisational measures, including encrypted transmission and access controls, to protect personal information against unauthorised access, alteration, disclosure, or destruction. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
11. Age Restriction and Legal Compliance
The Services are intended for adults only. By using the Services, you confirm you are of legal age in your jurisdiction and that the purchase, import, possession, and use of bwitti and iboga-derived products is lawful where you reside and where the product will be shipped or used. Iboga and its derivatives are regulated or restricted in a number of jurisdictions; it is your sole responsibility to verify and comply with local law before ordering. We reserve the right to decline or cancel orders where lawful fulfilment cannot be confirmed.
12. Contact Us
For questions about this Privacy Policy or to exercise your data protection rights, contact us at:
- Website: shambalaiboga.com
- Email: info@shambalaiboga.com
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The “Effective Date” above indicates when this version took effect. Continued use of the Services after changes take effect constitutes acceptance of the updated Policy.