Last updated: 30 September 2026

1. Who we are (Data Controller)

This Privacy Policy explains how Yoga Bhaya / Yogabhaya (“we”, “us”, “our”) collects, uses, stores and shares your personal data when you use our website (yogabhaya.co.uk), book classes or retreats, contact us, or subscribe to our newsletter.

We are the data controller responsible for your personal data.

Contact details for privacy queries:

Email: marina@yogabhaya.co.uk

Phone: 07990 647874

If you have any questions about this policy or how we handle your data, please contact us using the details above.

2. What personal data we collect

We may collect and process the following categories of personal data:

Identity & contact data

Name, email address, telephone number, postal address (where provided).

Booking & payment data

Details of classes or retreats you book, payment information (processed securely by our payment provider – we do not store full card details), booking history, and any special requirements you tell us about.

Health & wellbeing data (special category data)

Information about injuries, medical conditions, pregnancy, or other health matters that you voluntarily provide so we can teach safely. We only collect this when necessary for your safety and with your explicit consent or where otherwise permitted.

Dietary & accessibility information

Any dietary requirements, allergies, or accessibility needs you provide (especially for retreats).

Technical & usage data

IP address, browser type and version, device information, time zone, pages visited, and how you interact with our website (collected via cookies and similar technologies).

Marketing data

Your preferences regarding receiving newsletters or promotional emails, and records of when you open or click emails (if you have consented).

Communications data

Any messages you send us via contact forms, email, or phone.

We do not collect more data than we need for the purposes set out below.

3. How we collect your data

• Directly from you when you book a class or retreat, fill in a contact or enquiry form, subscribe to our newsletter, or email/phone us.
• Automatically when you visit our website (via cookies, server logs and analytics tools).
• From third-party service providers that help us run our business (e.g. payment processors), only where necessary.

4. Why we use your data and our lawful bases

Under UK GDPR we must have a lawful basis for every use of personal data. The table below shows the main purposes and the bases we rely on:

Purpose	Examples of data used	Lawful basis
To process and manage class or retreat bookings and payments	Identity, contact, payment, booking details	Contract – necessary to provide the service you have requested
To communicate with you about your booking or enquiry	Identity, contact, communications	Contract or Legitimate interests (responding to enquiries)
To deliver online classes (e.g. via video platforms)	Identity, contact, technical data	Contract
To keep you safe during classes or retreats	Health information you provide	Explicit consent (special category data) or Vital interests in emergencies
To manage dietary, accessibility or special requirements for retreats	Dietary, accessibility, health data	Contract and (where special category) Explicit consent
To send newsletters and marketing about classes, retreats and offers	Identity, contact, marketing preferences	Consent (you can withdraw at any time)
To improve our website, services and user experience	Technical & usage data	Legitimate interests (understanding how our site is used so we can improve it)
To prevent fraud and ensure website security	Technical data, payment data	Legitimate interests and Legal obligation
To comply with legal and tax obligations	Booking, payment and identity data	Legal obligation
To handle complaints or exercise/defend legal claims	Any relevant data	Legitimate interests or Legal obligation

Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms and concluded that the processing does not override your interests.

Where we rely on consent, you can withdraw it at any time by contacting us or using the unsubscribe link in emails. Withdrawal does not affect the lawfulness of processing that took place before you withdrew consent.

5. Who we share your data with

We do not sell or rent your personal data.

We may share it with the following categories of trusted third parties only where necessary:

• Payment processors (to take payments securely).
• Email and newsletter service providers.
• Website hosting, analytics and technical support providers.
• Video conferencing platforms used for online classes.
• Accountants or professional advisers (for tax and legal compliance).
• Retreat venue partners or local suppliers (only the information needed to deliver the retreat, e.g. dietary requirements or room preferences).
• Law enforcement or regulators if required by law.

All third parties are required to keep your data secure and to use it only for the purposes we specify. Where they act as processors on our behalf, we have appropriate contracts in place.

6. International transfers

Some of the tools we use (for example certain payment, email, analytics or video platforms) may process data outside the United Kingdom, including in the United States or other countries.

When we transfer personal data outside the UK we ensure appropriate safeguards are in place, such as:

• Transfers to countries covered by a UK adequacy decision, or
• Standard Contractual Clauses (or the UK International Data Transfer Agreement / Addendum) approved by the Information Commissioner’s Office.

You can contact us for more information about the specific safeguards that apply to any transfer.

7. How long we keep your data

We only keep personal data for as long as necessary for the purposes set out in this policy, or as required by law. Typical retention periods are:

• Booking and payment records: 6–7 years after the end of the financial year (for tax and accounting purposes).
• Health and special requirement information: for the duration of the relevant class/retreat plus a short period afterwards, or until you ask us to delete it (whichever is sooner), unless we need to retain it for legal reasons.
• Newsletter / marketing data: until you unsubscribe or withdraw consent, plus a short period to record that you opted out.
• Contact form and general enquiries: usually 12–24 months after the last contact, unless a longer period is needed.
• Website analytics data: according to the settings of the tools we use (typically 14–26 months).

After the retention period we securely delete or anonymise the data.

8. Your rights under UK GDPR

You have the following rights regarding your personal data:

• Access – request a copy of the personal data we hold about you.
• Rectification – ask us to correct inaccurate or incomplete data.
• Erasure (“right to be forgotten”) – ask us to delete your data in certain circumstances.
• Restriction – ask us to restrict processing in certain circumstances.
• Data portability – receive your data in a structured, commonly used format and transfer it to another controller (where applicable).
• Object – object to processing based on legitimate interests or to direct marketing.
• Withdraw consent – at any time where we rely on consent.
• Complain – lodge a complaint with the Information Commissioner’s Office (ICO) if you are unhappy with how we have handled your data. The ICO’s website is ico.org.uk and their helpline is 0303 123 1113 .

To exercise any of these rights, please email marina@yogabhaya.co.uk. We will respond within one month (or let you know if we need more time). We may need to verify your identity before processing the request.

9. Cookies and similar technologies

Our website uses cookies and similar technologies to:

• Make the site work properly (essential cookies).
• Understand how visitors use the site so we can improve it (analytics cookies).
• Remember your preferences.

Non-essential cookies are only placed with your consent. You can manage or withdraw your cookie preferences at any time via the cookie banner on our site or through your browser settings.

10. How we keep your data secure

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or alteration. These include secure hosting, encrypted connections (HTTPS), restricted access to personal data, and regular review of our security practices.

No method of transmission over the internet is completely secure, so we cannot guarantee absolute security, but we work hard to protect your information.

11. Children’s data

Our services are aimed at adults. We do not knowingly collect personal data from children under 16 without appropriate parental consent. If you believe we have collected data from a child, please contact us so we can delete it.

12. Third-party links

Our website may contain links to other websites (for example social media or external booking tools). This Privacy Policy applies only to our website. We are not responsible for the privacy practices of third-party sites.

13. Changes to this Privacy Policy

We may update this policy from time to time. The latest version will always be published on this page with the “Last updated” date. Significant changes will be highlighted or notified to you where appropriate.

14. Contact us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact:

Marina

Email: marina@yogabhaya.co.uk

Phone: 07990 647874

You also have the right to contact the Information Commissioner’s Office (ICO) at any time:

Website: ico.org.uk

Helpline: 0303 123 1113