Privacy Policy

Article 01

Data Controller

The controller of the personal data collected on the flowawayoga.com website is:

Article 02

Data We Collect

When you use our website and services, we may collect the following personal data:

• First and last name
• Email address
• Phone number (if voluntarily provided)
• Postal address (for a shop order or a retreat registration)
• Browsing data (cookies, IP address, pages visited)
• Payment information (processed securely by our payment provider)

Article 03

Purposes of Processing

Your personal data is collected and processed for the following purposes:

• Managing yoga retreat registrations (booking, communication, follow-up)
• Processing orders placed in the online shop
• Providing access to online classes and managing your personal account
• Responding to your enquiries via the contact form
• Sending newsletters and information about our upcoming events (with your consent)
• Improving our website and the user experience
• Complying with our legal and regulatory obligations

Article 04

Legal Basis for Processing

The processing of your data is based on the following legal grounds, in accordance with the General Data Protection Regulation (GDPR):

• Performance of a contract: when you register for a retreat, place an order or access an online class
• Consent: when you subscribe to our newsletter or accept cookies
• Legitimate interest: to improve our services and ensure the security of the website
• Legal obligation: to comply with our accounting and tax obligations

Article 05

Data Retention

Your personal data is kept only for as long as strictly necessary for the purposes for which it was collected:

• Customer data (retreats, shop, classes): 3 years after the last interaction
• Billing data: 10 years, in accordance with accounting obligations
• Marketing data (newsletter): 3 years after the last contact
• Cookies and browsing data: 13 months maximum

Beyond these periods, your data is deleted or anonymised.

Article 06

Data Recipients

Your personal data is intended exclusively for the Flowaway Yoga Retreats team. It may be shared with the following service providers, strictly for the purpose of delivering our services:

• Payment provider: for the secure processing of your transactions
• Website host: Netlify, Inc. (United States) — hosting and delivery of the website
• Emailing service: for sending newsletters (with your consent)

Under no circumstances do we sell, rent or transfer your personal data to third parties for commercial purposes.

Article 07

Transfers Outside the European Union

Some of your data may be transferred to countries located outside the European Union, in particular for hosting purposes (Netlify, Inc. — United States). In such cases, we ensure that these transfers are governed by appropriate safeguards, in accordance with the GDPR (standard contractual clauses, European Commission adequacy decisions, or the EU-U.S. Data Privacy Framework).

Article 08

Cookies

Our website uses cookies to improve your browsing experience. Cookies are small text files placed on your device when you visit.

The types of cookies used are:

• Essential cookies: required for the website to function properly (navigation, security)
• Analytics cookies: to measure traffic and understand how the website is used
• Functional cookies: to remember your preferences (language, shopping cart)

You can change your cookie preferences at any time through your browser settings. Refusing certain cookies may limit access to some features of the website.

Article 09

Your Rights

In accordance with the GDPR and the French Data Protection Act (Loi Informatique et Libertés), you have the following rights regarding your personal data:

• Right of access: obtain confirmation that your data is being processed and receive a copy of it
• Right to rectification: request the correction of inaccurate or incomplete data
• Right to erasure: request the deletion of your data in the cases provided for by law
• Right to restriction: obtain the restriction of processing in certain cases
• Right to data portability: receive your data in a structured, commonly used format
• Right to object: object to the processing of your data on legitimate grounds
• Right to withdraw consent: withdraw your consent at any time (newsletter, cookies)

In the event of a dispute, you may lodge a complaint with the French data protection authority, the Commission Nationale de l'Informatique et des Libertés (CNIL) — www.cnil.fr.

Article 10

Data Security

We implement all appropriate technical and organisational measures to guarantee the security and confidentiality of your personal data. Our website uses the HTTPS protocol to encrypt data exchanges. Payment information is processed directly by our secure payment provider and is never stored on our servers.

Article 11

Changes to This Policy

We reserve the right to modify this privacy policy at any time. Any changes will be published on this page, along with an update to the date shown at the top of this document. We invite you to check this page regularly to stay informed about our data protection practices.