Privacy Policy

Privacy Policy for The Shala Yoga & Mindfulness

Last Updated: October 20, 2026

At The Shala Yoga & Mindfulness, we are committed to protecting your privacy and ensuring that your personal information is handled in a safe and responsible manner. This Privacy Policy outlines how we collect, use, and protect your personal data when you visit our website, use our services, or engage with our community. We are a yoga retreat, teacher training, and online course platform based in Norway, and we adhere to the General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act. The data controller for your personal data is The Shala Yoga & Mindfulness, and we can be contacted at support@theshalayoga.com

What Personal Data We Collect

We collect various types of personal data necessary for providing our services:

• Account Data: Information that you provide when creating your account, including your name, email address, and phone number.
• Booking Data: Information relevant to your bookings, such as dietary requirements, emergency contacts, and any special requests made during the booking process.
• Payment Data: Information collected during payment processing. Payments are processed through Stripe, and we do not store full credit card numbers or sensitive payment information.
• Course Progress & Submissions: Data related to your participation in online courses, including progress tracking and submissions made for assessments.
• Community Posts & Interactions: Data related to your interactions on our community platform, including posts, comments, and any other engagement.
• Technical Data: Information gathered automatically as you use our website, including your IP address, browser type, device information, and cookies.
• Communication Data: Any messages you send us, including emails and other communications.

How We Collect Your Data

Your personal data is collected in various ways:

• Directly from you when you create an account, book services, or interact with our community.
• Automatically through cookies and analytics tools as you navigate our website.
• From third-party payment processors, such as Stripe, when you make a payment.

Legal Basis for Processing (GDPR Art. 6)

We will only process your personal data when we have a legal basis to do so, as outlined by GDPR. The legal bases we rely on include:

• Contract Performance: Processing is necessary for the performance of a contract to which you are a party (e.g., fulfilling your booking or providing course access).
• Legitimate Interests: Processing is necessary for our legitimate interests or the interests of a third party, provided that your interests or fundamental rights do not override those interests.
• Consent: Where we need your consent to process your personal data for specific purposes, such as receiving marketing communications.
• Legal Obligations: We may process your personal data to comply with legal obligations, such as tax compliance and regulatory requirements.

How We Use Your Data

Your personal data may be used for various purposes, including:

• Delivering services such as booking management, online course access, and progress tracking.
• Facilitating community features where you can interact with other users.
• Communicating with you regarding your account, bookings, and promotional materials.
• Processing payments securely through our payment processing partner.
• Issuing certificates or diplomas upon course completion.
• Conducting analytics and improving our services based on user data.
• Implementing fraud prevention measures to protect your data and our services.

Data Sharing & Third Parties

We do not sell your data to third parties. Your personal data may be shared with trusted third parties only if necessary for the following reasons:

• Payment Processor: We use Stripe to handle payments and your payment information is processed according to their privacy policy.
• Video Hosting: Our video content may be hosted on Vimeo, which may collect data in accordance with their own policies.
• Email Services: We may use third-party email services to manage communications.
• Cloud Hosting: We may store data on cloud services that comply with GDPR requirements.

We ensure that we have data processing agreements in place with all third parties who process your personal data.

International Data Transfers

Some of our third-party processors may be based outside of the European Economic Area (EEA). In such cases, we ensure that adequate safeguards are in place for your personal data, including compliance with standard contractual clauses or utilizing processors in countries deemed adequate by the European Commission.

Data Retention

We retain your personal data only for as long as necessary for the purposes for which it was collected. The criteria for setting retention periods include:

• Duration of your relationship with us and necessity for service delivery.
• Compliance with legal obligations where we may need to retain data for specified periods.
• Data necessary for the establishment or defense of legal claims.

Your Rights Under GDPR

As a data subject, you have specific rights regarding your personal data:

• Right of Access: You have the right to request access to your personal data that we hold.
• Right to Rectification: You have the right to request correction of inaccurate or incomplete data.
• Right to Erasure: You may request that we delete your personal data in certain circumstances.
• Right to Restriction: You have the right to request that we restrict processing your personal data under specific conditions.
• Right to Portability: You have the right to receive the personal data you provided to us in a structured, commonly used format.
• Right to Object: You have the right to object to processing your personal data based on legitimate interests.
• Right to Withdraw Consent: If we process your data based on consent, you have the right to withdraw that consent at any time.
• Right to Lodge a Complaint: You have the right to lodge a complaint with Datatilsynet, the Norwegian Data Protection Authority, if you believe we are violating your rights.

Cookies & Tracking

We use cookies to enhance your browsing experience. Cookies are small text files placed on your device to collect data about your preferences and interactions. Types of cookies we use include:

• Session Cookies: To manage user sessions and help you navigate our website.
• Analytics Cookies: To collect information about how you use our website, helping us improve services.

You can control cookie preferences through your browser settings, and you may choose to block cookies, although this may affect your experience on our site.

Data Security

The security of your personal data is important to us. We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss, or destruction. These measures include:

• Data encryption to safeguard sensitive information.
• Access controls to restrict access to personal data to only authorized personnel.
• Secure hosting services that comply with data protection standards.

Children's Privacy

Our services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children under this age. If we become aware that we have collected such data, we will take reasonable steps to delete it.

Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will notify you by updating the date at the top of the policy and posting the new version on our website. We encourage you to review this policy periodically for any changes.

WhatsApp Communications and ShalaMS

When you contact The Shala Yoga & Mindfulness through WhatsApp, we receive your WhatsApp phone number, profile name where provided, message content and any media you share. We also process message identifiers, timestamps and delivery or read status where available. Our ShalaMS support system links these communications to support tickets so our authorised team can answer questions, manage bookings and follow up on your requests.

We process these communications to take steps at your request or perform a contract, and for our legitimate interest in providing customer support and maintaining secure, reliable communications. Where consent is required for marketing, we rely on that consent; contacting support does not itself constitute consent to marketing. Please avoid sending sensitive health information, identity documents or payment card details through WhatsApp.

We use Meta's WhatsApp Business Platform to send and receive WhatsApp messages, and Base44 to host our support application and store support records. These providers process data as necessary to deliver their services. Meta and WhatsApp may also process data for their own purposes under their applicable privacy policies, including WhatsApp's Privacy Policy. International transfers are subject to applicable data protection requirements as described above. We do not sell your WhatsApp conversations or use their content for advertising.

We retain support messages, contact details and delivery records only as long as needed to handle your enquiries, maintain relevant service records, meet legal obligations or resolve disputes. Access is limited to authorised personnel and relevant service providers. You may request access, correction or deletion of this information even if you do not have a Shala account.

Requesting Deletion of Your Data

To request deletion of your account data or WhatsApp support history, follow our Data Deletion Instructions. Include the email address or WhatsApp number associated with your request so we can locate the records and verify your authority. We will respond in accordance with applicable GDPR deadlines and explain any information we must retain by law.

Contact Us

The data controller is The Shala Yoga & Mindfulness, Fornebu Hovedgård, Fornebuveien 84, 1366 Lysaker, Norway. For questions about this policy or to exercise your privacy rights, email support@theshalayoga.com.