Privacy Policy

How we collect, use, and protect your personal information.

Privacy Policy for The Shala Yoga & Mindfulness


Last Updated: March 18, 2026


At The Shala Yoga & Mindfulness, we are committed to protecting your privacy and ensuring that your personal information is handled in a safe and responsible manner. This Privacy Policy outlines how we collect, use, and protect your personal data when you visit our website, use our services, or engage with our community. We are a yoga retreat, teacher training, and online course platform based in Norway, and we adhere to the General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act. The data controller for your personal data is The Shala Yoga & Mindfulness, and we can be contacted at support@theshalayoga.com


What Personal Data We Collect


We collect various types of personal data necessary for providing our services:

  • Account Data: Information that you provide when creating your account, including your name, email address, and phone number.
  • Booking Data: Information relevant to your bookings, such as dietary requirements, emergency contacts, and any special requests made during the booking process.
  • Payment Data: Information collected during payment processing. Payments are processed through Stripe, and we do not store full credit card numbers or sensitive payment information.
  • Course Progress & Submissions: Data related to your participation in online courses, including progress tracking and submissions made for assessments.
  • Community Posts & Interactions: Data related to your interactions on our community platform, including posts, comments, and any other engagement.
  • Technical Data: Information gathered automatically as you use our website, including your IP address, browser type, device information, and cookies.
  • Communication Data: Any messages you send us, including emails and other communications.


How We Collect Your Data


Your personal data is collected in various ways:

  • Directly from you when you create an account, book services, or interact with our community.
  • Automatically through cookies and analytics tools as you navigate our website.
  • From third-party payment processors, such as Stripe, when you make a payment.


Legal Basis for Processing (GDPR Art. 6)


We will only process your personal data when we have a legal basis to do so, as outlined by GDPR. The legal bases we rely on include:

  • Contract Performance: Processing is necessary for the performance of a contract to which you are a party (e.g., fulfilling your booking or providing course access).
  • Legitimate Interests: Processing is necessary for our legitimate interests or the interests of a third party, provided that your interests or fundamental rights do not override those interests.
  • Consent: Where we need your consent to process your personal data for specific purposes, such as receiving marketing communications.
  • Legal Obligations: We may process your personal data to comply with legal obligations, such as tax compliance and regulatory requirements.


How We Use Your Data


Your personal data may be used for various purposes, including:

  • Delivering services such as booking management, online course access, and progress tracking.
  • Facilitating community features where you can interact with other users.
  • Communicating with you regarding your account, bookings, and promotional materials.
  • Processing payments securely through our payment processing partner.
  • Issuing certificates or diplomas upon course completion.
  • Conducting analytics and improving our services based on user data.
  • Implementing fraud prevention measures to protect your data and our services.


Data Sharing & Third Parties


We do not sell your data to third parties. Your personal data may be shared with trusted third parties only if necessary for the following reasons:

  • Payment Processor: We use Stripe to handle payments and your payment information is processed according to their privacy policy.
  • Video Hosting: Our video content may be hosted on Vimeo, which may collect data in accordance with their own policies.
  • Email Services: We may use third-party email services to manage communications.
  • Cloud Hosting: We may store data on cloud services that comply with GDPR requirements.

We ensure that we have data processing agreements in place with all third parties who process your personal data.


International Data Transfers

Some of our third-party processors may be based outside of the European Economic Area (EEA). In such cases, we ensure that adequate safeguards are in place for your personal data, including compliance with standard contractual clauses or utilizing processors in countries deemed adequate by the European Commission.


Data Retention

We retain your personal data only for as long as necessary for the purposes for which it was collected. The criteria for setting retention periods include:

  • Duration of your relationship with us and necessity for service delivery.
  • Compliance with legal obligations where we may need to retain data for specified periods.
  • Data necessary for the establishment or defense of legal claims.


Your Rights Under GDPR


As a data subject, you have specific rights regarding your personal data:

  • Right of Access: You have the right to request access to your personal data that we hold.
  • Right to Rectification: You have the right to request correction of inaccurate or incomplete data.
  • Right to Erasure: You may request that we delete your personal data in certain circumstances.
  • Right to Restriction: You have the right to request that we restrict processing your personal data under specific conditions.
  • Right to Portability: You have the right to receive the personal data you provided to us in a structured, commonly used format.
  • Right to Object: You have the right to object to processing your personal data based on legitimate interests.
  • Right to Withdraw Consent: If we process your data based on consent, you have the right to withdraw that consent at any time.
  • Right to Lodge a Complaint: You have the right to lodge a complaint with Datatilsynet, the Norwegian Data Protection Authority, if you believe we are violating your rights.


Cookies & Tracking


We use cookies to enhance your browsing experience. Cookies are small text files placed on your device to collect data about your preferences and interactions. Types of cookies we use include:

  • Session Cookies: To manage user sessions and help you navigate our website.
  • Analytics Cookies: To collect information about how you use our website, helping us improve services.

You can control cookie preferences through your browser settings, and you may choose to block cookies, although this may affect your experience on our site.


Data Security

The security of your personal data is important to us. We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss, or destruction. These measures include:

  • Data encryption to safeguard sensitive information.
  • Access controls to restrict access to personal data to only authorized personnel.
  • Secure hosting services that comply with data protection standards.


Children's Privacy

Our services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children under this age. If we become aware that we have collected such data, we will take reasonable steps to delete it.


Changes to This Policy


We may update this Privacy Policy from time to time. When we do, we will notify you by updating the date at the top of the policy and posting the new version on our website. We encourage you to review this policy periodically for any changes.


Contact Us


If you have any questions or concerns regarding this Privacy Policy or our data processing practices, please contact us at:

Email: Privacy Policy for The Shala Yoga & Mindfulness


This Privacy Policy describes how The Shala Yoga & Mindfulness (herein referred to as "The Shala," "we," "us," or "our") collects, uses, and protects your personal data when you visit our website and engage with our services. We are dedicated to ensuring the privacy of our students and community members and to complying with the General Data Protection Regulation (GDPR) and the Norwegian Personal Data Act.


1. Introduction


The Shala is a nonprofit organization based in Norway with a mission to make yoga, meditation, and inner practices accessible to as many people as possible. Our registered office is located at Fornebu Hovedgård, Fornebuveien 84, 1366 Lysaker, Norway. As the data controller, we are responsible for how your personal data is handled, and we are committed to protecting your privacy.

If you have any questions about this policy or our data handling practices, please contact us at support@theshalayoga.com


2. What Personal Data We Collect


We collect and process a variety of personal data from our users, including but not limited to:

  • Account Data: Information you provide when creating an account, such as your name, email address, and phone number.
  • Booking Data: Details related to your course bookings, including dietary requirements, emergency contacts, and special requests.
  • Payment Data: Information processed by our payment provider, Stripe, including transaction details. Please note that we do not store your full payment card numbers.
  • Course Progress & Submissions: Records of your engagement with our online courses, including progress tracking and submitted assignments.
  • Community Posts & Interactions: Content you share within our community forum, including posts and comments.
  • Technical Data: Information related to your device and browsing behavior, such as IP address, browser type, and operating system, collected via cookies.
  • Communication Data: Records of your communications with us, including emails and responses.


3. How We Collect Your Data


We collect your personal data in several ways:

  • Directly from you when you register for an account, book a course, or engage with our services.
  • Automatically through the use of cookies and analytics tools as you browse our website.
  • From third-party payment processors, such as Stripe, when you make a transaction.

4. Legal Basis for Processing (GDPR Art. 6)


We process personal data based on the following legal grounds:

  • Contract Performance: When processing is necessary for the performance of a contract with you, such as providing course access.
  • Legitimate Interests: When processing is necessary for our legitimate interests, provided that your interests and fundamental rights do not override those interests.
  • Consent: Where you have given us explicit consent to process your personal data for specific purposes.
  • Legal Obligations: When processing is necessary for compliance with a legal obligation to which we are subject.


5. How We Use Your Data


Your personal data is used for the following purposes:

  • Service Delivery: To provide and manage the services you have requested.
  • Booking Management: To process your bookings and manage your participation in our courses and events.
  • Course Access & Progress Tracking: To enable you to access our courses and track your learning progress.
  • Community Features: To facilitate interaction within our community platform.
  • Communication: To send you important updates about your account and services, including transactional and marketing emails.
  • Payment Processing: To process your payments securely through Stripe.
  • Certification Issuance: To issue certificates or diplomas for completed courses.
  • Analytics & Improvement: To analyze usage patterns to improve our services.
  • Fraud Prevention: To detect and prevent fraudulent activities.


6. Data Sharing & Third Parties


We may share your personal information with the following third-party service providers:

  • Payment Processor: Stripe, which processes your payment information on our behalf.
  • Video Hosting: Vimeo, which hosts our course video content.
  • Email Services: Third-party providers that assist us in sending emails for communications.
  • Cloud Hosting: To securely store our data and host our services.

We do not sell your personal data to any third parties. We ensure that data processing agreements are in place with all service providers to safeguard your information.


7. International Data Transfers


Some of our service providers may operate outside the European Economic Area (EEA). In such cases, we will ensure that adequate safeguards are in place for your data, such as using Standard Contractual Clauses or relying on adequacy decisions by the European Commission to protect your data.


8. Data Retention


We will retain your personal data only for as long as necessary to fulfill the purposes for which we collected it, including meeting legal, accounting, or reporting requirements. The retention periods vary based on the type of data and our obligations. For example:

  • Account data is retained as long as your account is active.
  • Booking data is kept for the duration of our relationship and a maximum of seven years as required by tax regulations.
  • Communication data may be retained until you request its deletion or withdraw your consent.


9. Your Rights Under GDPR


You have the following rights regarding your personal data:

  • Right of Access: You have the right to request access to the personal data we hold about you.
  • Right to Rectification: You have the right to request the correction of inaccurate or incomplete data.
  • Right to Erasure: You may request the deletion of your personal data in certain circumstances.
  • Right to Restriction: You can request to restrict the processing of your data while we verify your concerns.
  • Right to Data Portability: You have the right to request the transfer of your data to another service provider.
  • Right to Object: You can object to the processing of your personal data based on legitimate interests.
  • Right to Withdraw Consent: If we process your data based on your consent, you have the right to withdraw your consent at any time.
  • Right to Lodge a Complaint: You have the right to lodge a complaint with Datatilsynet, the Norwegian Data Protection Authority.


10. Cookies & Tracking


We use cookies and similar tracking technologies to enhance your experience on our website. Cookies are small files stored on your device that help us learn about your usage patterns and preferences. The cookies we use may include:

  • Essential Cookies: Necessary for the operation of our website.
  • Analytical Cookies: Help us measure and analyze how our website is performing.
  • Functional Cookies: Improve functionality and personalization of our site.

You can manage your cookie preferences through your browser settings. However, disabling cookies may affect your experience on our site.


11. Data Security


We implement technical and organizational measures to protect your personal data. These include:

  • Encryption: We use encryption technology to safeguard sensitive data.
  • Access Controls: Access to personal data is restricted to authorized personnel only.
  • Secure Hosting: We utilize secure hosting services with industry-standard security measures.


12. Children's Privacy


Our services are not directed towards children under the age of 16. We do not knowingly collect personal data from individuals under 16. If we become aware that we have collected data from a child under this age, we will take steps to delete such information.


13. Changes to This Policy


We may update this Privacy Policy from time to time. If we make significant changes, we will notify you via the email address associated with your account or through a notice on our website. We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your data.


14. Contact Us


If you have any questions or concerns regarding this Privacy Policy or our privacy practices, please contact us at:

Email: support@theshalayoga.com

Address: Fornebu Hovedgård, Fornebuveien 84, 1366 Lysaker, Norway


Thank you for being a part of The Shala Yoga & Mindfulness community!