1. Data Controller

The data controller responsible for your personal data is:

2. Personal Data We Collect

We collect personal data only when necessary for specific purposes. The types of data we collect depend on how you interact with our website and services:

Source	Data Collected	Purpose
Contact form	Name, email, message	To respond to your enquiry
Event registration	Name, email, phone (optional)	To process event bookings and send confirmations
Newsletter signup	Email address	To send studio updates and event announcements
Community stories	Name, email (optional), message	To feature your experience on our website
Website analytics	IP address (anonymised), device type, pages visited, session duration	To understand website usage and improve our services

3. Legal Basis for Processing

We process your personal data based on the following legal grounds under GDPR Article 6:

• Consent (Art. 6(1)(a)): For analytics cookies (Google Analytics, Microsoft Clarity) — you can accept or reject these via our cookie banner
• Contract performance (Art. 6(1)(b)): For event registrations and class bookings
• Legitimate interest (Art. 6(1)(f)): For responding to contact form enquiries and maintaining website security

4. Cookies and Tracking Technologies

We use the following cookies and tracking technologies, activated only after your explicit consent:

Service	Provider	Purpose	Type
Google Analytics 4	Google LLC	Website traffic analysis with anonymised IP	Analytics (consent required)
Microsoft Clarity	Microsoft Corp.	Heatmaps and session recordings to improve UX	Analytics (consent required)
Google Tag Manager	Google LLC	Tag management — does not collect data itself	Functional
Language preference	Goyoga (localStorage)	Remembers your preferred language	Essential
Cookie consent	Goyoga (localStorage)	Remembers your cookie choice	Essential

You can change your cookie preferences at any time by clearing your browser's local storage or using the cookie banner that appears on your first visit. Analytics cookies are only activated after you click "Accept".

5. Third-Party Data Sharing

We share personal data with the following third-party services, strictly for the purposes described:

• Google LLC (USA) — Analytics and tag management. Google is certified under the EU-US Data Privacy Framework.
• Microsoft Corporation (USA) — Clarity analytics. Microsoft is certified under the EU-US Data Privacy Framework.
• Zoho Corporation (India/EU) — Email delivery via ZeptoMail for contact form responses and event confirmations. Zoho maintains EU data centres.
• Cloudflare, Inc. (USA) — Website hosting and security. Cloudflare is certified under the EU-US Data Privacy Framework.

We do not sell, rent, or trade your personal data to any third party for marketing purposes.

6. Data Retention

• Contact form messages: Retained for up to 12 months, then deleted
• Event registration data: Retained until 3 months after the event
• Newsletter subscriptions: Retained until you unsubscribe
• Analytics data: Automatically anonymised and aggregated by Google after 14 months
• Cookie consent preference: Stored in your browser's localStorage until you clear it

7. Your Rights Under GDPR

As an EU resident, you have the following rights regarding your personal data:

• Right of access — Request a copy of your personal data
• Right to rectification — Correct inaccurate data
• Right to erasure — Request deletion of your data ("right to be forgotten")
• Right to restrict processing — Limit how we use your data
• Right to data portability — Receive your data in a machine-readable format
• Right to object — Object to processing based on legitimate interest
• Right to withdraw consent — Withdraw cookie consent at any time

To exercise any of these rights, please contact us at [email protected]. We will respond within 30 days.

If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon): www.aki.ee.

8. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• HTTPS encryption on all pages
• Cloudflare Web Application Firewall and DDoS protection
• Google Consent Mode v2 — analytics only load after your explicit consent
• IP anonymisation in Google Analytics
• Limited access to personal data (studio management only)

9. Children's Privacy

Our website is not directed at children under the age of 16. We do not knowingly collect personal data from children. For our Kids Yoga classes, registration is handled by a parent or legal guardian.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the most recent revision. We encourage you to review this page periodically.