Policies
Privacy Policy
This policy explains what personal information Home Yoga Studio collects, why, how long we keep it and the rights you have. We have tried to keep it clear and readable.
Last updated:
Text shown [like this] still needs the business's own details before launch.
Who we are
The controller responsible for your personal data under the EU General Data Protection Regulation (GDPR) is:
[Your full name, or the registered business name], trading as Home Yoga Studio
Schillerstr. 9314624 Dallgow-Döberitz
Germany
Email: info@homeyogastudio.de
"Controller" means we decide how and why your personal information is used. We are not required to appoint a data protection officer. For any privacy question or request, email us at the address above.
The short version
- We only collect what we need to run your bookings, answer your messages and, if you ask, send you updates.
- We never sell your information or share it for other companies' marketing.
- We don't ask for medical information. If you choose to tell us about health matters, we only use it to adapt your practice.
- Optional analytics only run if you agree, and you can change your mind at any time.
- You can ask to see, correct or delete your information.
Information we collect
When you book
Your name, email address, phone number (optional), the class or session and time you choose, your stated level of yoga experience, and any message you write. We also record the date and time of your booking and its status (for example, confirmed or cancelled).
When you contact us
Your name, email address, the topic you choose and your message.
When you sign up for updates
Your email address and a record of when you asked to subscribe, when you confirmed and, if applicable, when you unsubscribed.
When you use the website
Like most websites, our hosting provider automatically processes technical information such as your IP address, browser type and the pages requested, to deliver the site and keep it secure. To protect our forms from abuse, we use a scrambled (hashed) version of your IP address to limit repeated submissions; we do not store your IP address alongside your booking.
If you agree to analytics cookies, we also collect information about how you use the site. See our Cookie Policy.
When you join a live class
Classes take place on Zoom. When you join, the platform processes information such as your display name, and your video and audio if you switch them on. We do not record live group classes. The platform's own privacy policy also applies.
Payments
We never ask for card details through this website or by email. We'll explain how to pay when we confirm your booking.
Health information
We do not ask for medical information. Our forms invite you to mention modifications or access needs, and you can choose what, if anything, to share.
If you choose to tell us about a health condition, injury or pregnancy, this is "special category" data under data protection law. We only use it to adapt your practice, we rely on your explicit consent to do so, and you can withdraw that consent and ask us to delete it at any time. Please do not send detailed medical information through our forms.
How we use your information and our legal reasons
| What we do | Legal basis |
|---|---|
| Take and manage your booking, send joining details, confirmations and changes | Performing our contract with you, or taking steps at your request before entering into one (Art. 6(1)(b) GDPR) |
| Reply to your messages | Our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR), or steps before a contract if you are asking about booking (Art. 6(1)(b) GDPR) |
| Send newsletters and updates | Your consent, which you can withdraw at any time (Art. 6(1)(a) GDPR) |
| Analytics about how the site is used | Your consent, given through cookie settings (Art. 6(1)(a) GDPR and § 25(1) TDDDG) |
| Keep the site and forms secure, prevent spam and abuse | Our legitimate interest in protecting our services (Art. 6(1)(f) GDPR) |
| Keep business and accounting records | Legal obligation, e.g. German tax and commercial record-keeping rules (Art. 6(1)(c) GDPR) |
| Adapting your practice using health information you choose to share | Your explicit consent (Art. 9(2)(a) GDPR) |
Who we share information with
We use a small number of trusted service providers ("processors") who handle information on our behalf and only as we instruct:
- Website hosting: Vercel Inc.
- Booking database: Upstash (Redis database)
- Email delivery: [Your email provider, e.g. Resend]
- Video classes: Zoom
We may also share information if required by law, or to protect the rights and safety of our clients or others. We never sell personal information.
International transfers
Some of our service providers are based in, or may process data in, countries outside the European Union and European Economic Area, in particular the United States. Where this happens, we rely on the safeguards the GDPR recognises: the EU-U.S. Data Privacy Framework (for certified companies) or the EU Standard Contractual Clauses, as offered by each provider. Where a provider lets us choose, we store data in the EU. [Confirm the safeguards and data regions used by each provider before launch.]
How long we keep information
- Bookings: 24 months after your class or session, then deleted, unless we must keep them longer for accounting or legal reasons.
- Enquiries: 12 months after our last reply.
- Newsletter: until you unsubscribe. We keep a minimal record of your unsubscribe so we don't email you again.
- Security records: limits on repeated form submissions expire automatically, usually within an hour.
How we protect your information
The website is served over an encrypted connection (HTTPS). Booking records are stored in a database that is not publicly accessible; only the business owner can view them, through a password-protected admin area. Links that let you view or cancel your own booking contain a long, random code. We collect as little information as we can, and we use scrambled identifiers where possible.
No system is completely secure, but we take reasonable steps to protect your information and will tell you and the regulator if a breach occurs where the law requires it.
Your rights
Depending on where you live, you may have the right to:
- ask for a copy of your personal information;
- ask us to correct inaccurate information;
- ask us to delete your information;
- ask us to restrict or object to certain uses;
- receive your information in a portable format;
- withdraw consent at any time, where we rely on consent (this does not affect anything we did before you withdrew it).
To make a request, email info@homeyogastudio.de. We will respond within one month. We may need to confirm your identity first.
Age
Our services are intended for adults aged 18 and over. We do not knowingly collect information from children.
Complaints
If you are unhappy with how we have handled your information, please contact us first so we can try to put it right. You also have the right to complain to the data protection authority for Brandenburg (Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg, Stahnsdorfer Damm 77, 14532 Kleinmachnow), or the authority where you live or work (make a complaint (opens in a new tab)).
Changes to this policy
We may update this policy from time to time. The "last updated" date at the top shows when it last changed. If we make significant changes, we will make this clear on the website.