Privacy Policy

This policy explains which personal data take-yoga.com collects, why, who processes it on our behalf, how long it is kept and what rights you have under the EU General Data Protection Regulation (GDPR). How the site uses cookies and similar technologies is explained in the cookie policy.

In short: we collect only what you send us through a form and what is technically needed to run and protect the site. We never sell your data. Google Analytics runs only if you allow it. Retreats are paid by bank transfer; the website never handles payment data.

Who is responsible

Take Yoga – Tania Sevasti Kemou
c/o Nikolaos Kemos
Themistokleous 4
10678 Athens
Greece
Email: hi@take-yoga.com

Write to this address with any question about your data or to exercise your rights. As a small business we are not required to appoint a data protection officer and have not done so.

When you visit the website

Hosting and security. The website is hosted by Cloudflare. To deliver pages and protect the site against attacks, Cloudflare processes your IP address, the page requested, the time and technical details sent by your browser (such as browser type and language). Our own server code logs only technical events, never form contents; these logs are kept for up to 7 days. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).

Visitor statistics. Cloudflare Web Analytics counts page views without cookies and without identifying you (Art. 6(1)(f)).

Google Analytics, only with your consent. Only if you accept analytics in the cookie banner do we load Google Tag Manager and Google Analytics 4. Google then processes information about your visit: pages viewed, device and browser, approximate location and a pseudonymous ID stored in a cookie. Google Analytics 4 does not store IP addresses. The data is kept for the period set in our account, at most 14 months. Legal basis: your consent (Art. 6(1)(a)), which you can withdraw at any time with “Cookie settings”.

Your cookie choice. When you make or change a choice in the cookie banner, we store a record as proof of consent: a random ID, your choice, the date, the page, your language, your browser type and a salted one-way hash of your IP address (never the address itself). These records are deleted after 24 months. Legal basis: our obligation to be able to prove consent (Art. 6(1)(c) with Art. 7(1)). Details: cookie policy.

Links to other sites. Links to Instagram and other sites are plain links. Nothing is sent to those sites until you click them; their own privacy policies then apply.

When you use a form

All forms are sent to our own server code on Cloudflare. Giving us your data is voluntary, but without the required fields we cannot handle your request. Every form is protected against spam (see spam protection), and every submission is recorded in our form log (see form log).

Data: email address, first name (optional), your language and the page you signed up on.

Purpose: sending you Tania’s monthly newsletter about Ashtanga, which can include news about classes, workshops and retreats. If you sign up for a retreat promo code, we also send you the code.

Double opt-in: after signing up you receive an email asking you to confirm your address. You only receive the newsletter after you confirm. This step does not apply if you were added through a class or retreat form or a booking (see below). Our newsletter service, MailerLite, records when and on which page you signed up and when you confirmed, as proof of your consent.

Legal basis: your consent (Art. 6(1)(a)). You can unsubscribe at any time with the link in every email or by writing to us.

Free Primary Series Chart

Data: first name, email address, your language and the page you signed up on.

Purpose: sending you the free Primary Series Chart (PDF) by email. Signing up for the chart also subscribes you to the monthly newsletter.

The same double opt-in applies: you receive the chart after confirming your email address. Legal basis: your consent (Art. 6(1)(a)). You can unsubscribe from the newsletter at any time; the chart is yours to keep.

Contact form and class enquiries

This covers the contact form, the signup for online group classes and the enquiry for private (one-on-one) classes.

Data: first name, last name (optional), email address, phone number (optional), your message, the class you are interested in, your language and the page you wrote from.

Purpose: answering your message and arranging the class you asked about. Your message reaches Tania as an email notification, and she replies personally from hi@take-yoga.com. Online classes take place on Zoom: when you join, Zoom processes your name, IP address and technical data, and your camera image and voice if you switch them on.

Legal basis: steps you ask for before a possible contract (Art. 6(1)(b)) and, for general questions, our legitimate interest in answering you (Art. 6(1)(f)).

Monthly newsletter (class signup and private class enquiry only). If you sign up for an online class or ask about private classes, we also add your first name, last name (if given), email address, phone number (if given) and the page you wrote from to our class list in MailerLite. You then receive Tania’s monthly newsletter, without a separate confirmation step. Every email has an unsubscribe link. Legal basis: our legitimate interest in sending people who asked about classes information about similar offers (Art. 6(1)(f)); for existing customers, also Art. 11(3) of Greek Law 3471/2006. You can object at any time by unsubscribing or writing to us. The contact form does not add you to any mailing list.

Questions about the retreat

Data: first name, last name (optional), email address, phone number (optional), your message, your language and the page you wrote from.

Purpose: answering your question. We also add your name, email address and phone number to our retreat list in MailerLite, so we can send you information about upcoming retreats. Like everyone on our lists, you also receive Tania’s monthly newsletter. Every one of these emails has an unsubscribe link.

Legal basis: steps you ask for before a possible booking (Art. 6(1)(b)) and our legitimate interest in keeping you informed about the retreat you asked about and sending you information about similar offers, including the monthly newsletter (Art. 6(1)(f)). You can object at any time.

Retreat booking request

Data: for you and, if you book for two, your fellow guest: first and last name, email address, phone number, date of birth, nationality and yoga experience. In addition: the retreat week, room type, promo code, your message and your acceptance of the terms. The price is calculated on our server.

If you book for a second person, please make sure they know you are sharing their data with us, and point them to this policy.

Purpose: handling your booking request, confirming availability, sending you the payment details and preparing your stay. You receive a confirmation email, Tania receives a notification, and the request is saved in our booking list. We add guests to our customer and retreat lists in MailerLite to send practical information before the retreat. Guests on these lists also receive Tania’s monthly newsletter. To arrange your room, we give the hotel on Serifos the guests’ names, room type, date of birth and nationality, which the hotel needs for its guest records. After the retreat, we may email past guests about future retreats a few times a year; you can opt out in every email or by telling us at any time.

Legal basis: performance of the contract and steps before it (Art. 6(1)(b)); for the monthly newsletter and emails about future retreats, our legitimate interest in staying in touch with our guests and sending them information about similar offers (Art. 6(1)(f); for existing customers, also Art. 11(3) of Greek Law 3471/2006). You can object at any time.

Health information. The terms ask you to tell us before the retreat about any injury, medical condition or pregnancy relevant to your practice. Please share this by email or in person, not in the booking form. We use it only to keep your practice safe, based on your explicit consent (Art. 9(2)(a)), which you can withdraw at any time.

Form log

Every submission is recorded in a database on Cloudflare (D1), so that no request gets lost and problems can be traced: the form, the time, your language, the page, the fields you filled in, a salted one-way hash of your IP address, your browser type, the result of the spam checks and whether delivery succeeded. These entries are deleted automatically after 24 months. Legal basis: our legitimate interest in handling your requests reliably and traceably (Art. 6(1)(f)).

Spam protection

To keep the forms free of spam and abuse, every submission goes through several checks:

Cloudflare Turnstile checks in the background whether the form is being sent by a person. For this, Cloudflare processes your IP address and technical information from your browser. It sets no advertising cookies.
A hidden field that only bots fill in, and a limit on how many submissions can come from one network in a short time. For this limit we use a salted one-way hash of your IP address; the IP address itself is never stored.
Automated rules that recognize typical spam, such as links in name fields, disposable email domains and typical advertising keywords.

Nothing you typed is stored before the Turnstile check has passed. If a submission fails it, we keep only a technical entry: the form, the time, the result, the domain of the email address (for example “gmail.com”), the hashed IP address and the browser type.

If our rules classify a submission as spam, or it is incomplete or invalid, we keep the full email address (and for spam also the content) for 90 days. This lets us find and help real people who were blocked by mistake, and improve the spam filter. After 90 days only the email domain remains. Legal basis: our legitimate interest in preventing abuse and improving the filter (Art. 6(1)(f)).

The spam check is automated, but it has no legal or similarly significant effect on you: at worst, a message does not reach us. If you think this happened, write to hi@take-yoga.com. We do not use any other automated decision-making or profiling.

Payments

The website does not process any payment data. Retreats are paid by bank transfer: once availability is confirmed, we send you our bank details by email. Your bank and ours process the name, account number, amount and reference of the transfer. We keep payment records and invoices for as long as Greek tax and accounting law requires. Legal basis: contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)).

Photos at retreats

We take photos and videos during retreats and use them on the website, on social media and in other promotional material (legitimate interest, Art. 6(1)(f)). If you do not want images in which you can be recognized to be used, tell us at any time; we will stop using them and remove published images where possible.

Service providers and other recipients

We do not sell your data and do not share it for advertising. We use the following service providers. They process data only on our instructions, under a data processing agreement (Art. 28 GDPR):

Cloudflare, Inc. (USA): hosting, server code (Workers), form and consent database (D1), Turnstile, Web Analytics and technical logs.
MailerLite (MailerLite Limited, Ireland): newsletter and mailing lists.
MailerSend, Inc. (USA): sending form notifications to Tania and booking confirmations to you.
Our booking-management tool (USA): our list of retreat booking requests.
Our email hosting provider (Germany): our mailbox.
Zoom Video Communications, Inc. (USA): online classes.
Google Ireland Limited (Ireland), with Google LLC (USA): Google Tag Manager and Google Analytics, only with your consent.

Our web developer maintains the website on our behalf and can access the form log for technical support. For retreats, the hotel on Serifos receives the guests’ names, room type, date of birth and nationality. Where the law requires it, we pass data to tax authorities or other public bodies.

Transfers outside the EU

Some providers are based in the USA or use sub-processors outside the European Economic Area. Transfers to the USA are based on the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission) where the provider is certified under it, as Cloudflare and Google are, and otherwise on the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR). Cloudflare runs a global network, so your requests are usually handled in a data center near you.

How long we keep your data

Form log: 24 months, then deleted automatically.
Submissions classified as spam or invalid: full email address (spam also the content) for 90 days, then only the email domain; the entry is deleted after 24 months.
Submissions that fail Turnstile or the other checks: a technical entry without your content, deleted after 24 months.
Consent records: 24 months.
Technical server logs: up to 7 days.
Newsletter and mailing lists: until you unsubscribe or object. After that we keep only your email address and the fact that you unsubscribed, so you are not added again by mistake.
Enquiries and emails: as long as needed to answer you and handle follow-up questions.
Bookings and payment records: as long as needed for the booking, and as long as Greek tax and accounting law requires.
Google Analytics: at most 14 months.

Your rights

Under the GDPR you have the right to:

access the data we hold about you (Art. 15);
have incorrect data corrected (Art. 16);
have your data deleted (Art. 17);
restrict processing (Art. 18);
receive your data in a common, machine-readable format (Art. 20);
object at any time to processing based on our legitimate interest, and to direct marketing (Art. 21);
withdraw your consent at any time; this does not affect processing before the withdrawal (Art. 7(3)).

Write to hi@take-yoga.com. We reply within one month and may ask you to confirm your identity.

Complaints: you can lodge a complaint with a data protection authority, in particular in the EU country where you live or work. In Greece this is the Hellenic Data Protection Authority (HDPA), Kifisias 1–3, 115 23 Athens, www.dpa.gr.

Security

The site is served only over encrypted connections (HTTPS). Access to the form log, mailing lists and booking list is limited to the people who need it. IP addresses are stored only as salted hashes, and stored data is deleted automatically after the periods above.

Children

Our offers are aimed at adults. We do not knowingly collect personal data from children under 16. If you believe a child has sent us data, please contact us and we will delete it.

Changes to this policy

We update this policy when our services or the law change. The date at the top shows the current version. If a change significantly affects data you have already given us, we will let you know by email.

Contact

Questions about this policy or your data: hi@take-yoga.com.