Welcome to Behind the Yoga Mat.

Protecting your privacy and personal data is important to us. This Privacy Policy explains how we collect, use, store, disclose and protect your personal data when you visit our website, purchase our services or otherwise interact with Behind the Yoga Mat.

This Privacy Policy applies to all personal data processed through:

• our website;
• our online learning platform;
• our digital products;
• our online courses;
• workshops;
• events;
• retreats;
• coaching services;
• online sessions;
• newsletters;
• customer support;
• communication with us.
  
  

Please read this Privacy Policy carefully before using our website or purchasing any of our services.

This Privacy Policy applies whenever you:

• visit our website;
• contact us;
• purchase one of our products or services;
• register for an online course;
• book a workshop, retreat or event;
• participate in coaching;
• use our online learning platform;
• communicate with us through our official communication channels.

This Privacy Policy applies regardless of whether you access our services from within the European Union or from another country.

For the purposes of this Privacy Policy:

Personal Data

"Personal Data" means any information relating to an identified or identifiable natural person.

Examples include:

• your name;
• email address;
• postal address;
• telephone number;
• IP address;
• billing information;
• account information;
• online identifiers.

Processing

"Processing" means any operation performed on personal data.

Examples include:

• collection;
• storage;
• organisation;
• consultation;
• use;
• disclosure;
• deletion;
• destruction.

Controller

The Controller is the organisation determining the purposes and means of processing personal data.

For this Privacy Policy, the Controller is Behind the Yoga Mat.

Processor

A Processor is a third party processing personal data on behalf of the Controller.

Examples include website hosting providers, online course platforms and payment service providers.

Behind the Yoga Mat processes personal data in accordance with Article 5 GDPR.

We ensure that personal data is:

• processed lawfully, fairly and transparently;
• collected for specified and legitimate purposes;
• limited to what is necessary;
• accurate and kept up to date where possible;
• retained only as long as necessary;
• processed securely;
• protected against unauthorised access, alteration or loss.

Depending on the circumstances, we process personal data on one or more of the following legal bases under Article 6 GDPR.

Performance of a Contract

We process personal data where necessary to:

• provide our services;
• deliver online courses;
• organise workshops;
• organise retreats;
• organise events;
• provide coaching;
• process bookings;
• provide customer support.

Consent

Where required by law, we process personal data based on your consent.

Examples include:

• newsletter subscriptions;
• marketing communications;
• optional cookies;
• certain optional features of our website.

You may withdraw your consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Legal Obligation

We may process personal data where required by applicable laws.

Examples include:

• accounting obligations;
• tax obligations;
• legal reporting obligations.

Legitimate Interests

We may process personal data where necessary for our legitimate interests, provided these interests do not override your fundamental rights and freedoms.

Examples include:

• website security;
• fraud prevention;
• customer support;
• improving our services;
• maintaining the functionality of our online learning platform;
• defending legal claims.

Depending on your interaction with Behind the Yoga Mat, we may collect the following categories of personal data.

Identity Data

Examples include:

• first name;
• last name;
• title (where applicable).

Contact Data

Examples include:

• email address;
• telephone number;
• postal address.

Account Data

Where you create an account for one of our online services, we may process:

• username;
• encrypted password;
• account preferences;
• account activity.

Booking Data

Where you register for workshops, retreats, coaching or events, we may process information relating to your booking.

Payment Data

We may process information necessary for payment administration, such as:

• billing address;
• payment status;
• transaction reference;
• invoices.

Behind the Yoga Mat does not store complete credit card or payment card information.

Payments are processed by authorised third-party payment service providers.

Technical Data

Examples include:

• IP address;
• browser type;
• operating system;
• device information;
• access times;
• referring websites.

Communication Data

Where you contact us, we may process:

• emails;
• enquiries;
• messages;
• attachments;
• communication history.

Marketing Data

Where you choose to receive marketing communications, we may process:

• newsletter subscription;
• marketing preferences;
• records of your consent.

Behind the Yoga Mat process personal data only where necessary for specific and legitimate purposes.

Depending on your interaction with Behind the Yoga Mat, your personal data may be processed for the following purposes:

• providing and administering our website and services;
• creating and managing customer and learner accounts;
• providing access to online courses and digital content;
• administering bookings for workshops, events, retreats, coaching and online sessions;
• processing and documenting payments;
• communicating with customers and participants;
• responding to enquiries and providing customer support;
• administering our online learning environment;
• facilitating community and messaging functions;
• fulfilling accounting, tax and other legal obligations;
• protecting our website, systems and services against misuse;
• establishing, exercising or defending legal claims;
• improving our services and customer experience;
• sending newsletters or marketing communications where permitted by law or where you have provided the required consent.

We do not use personal data for purposes incompatible with those for which it was originally collected unless permitted or required by applicable law.

Behind the Yoga Mat uses LearnWorlds as its online learning platform.

LearnWorlds may be used to provide:

• online courses;
• digital learning materials;
• customer accounts;
• member/login areas;
• course progress tracking;
• assessments or exercises;
• downloads;
• community functionality;
• internal messaging;
• other learning-related features.

When you create an account, purchase or enrol in a course, or use the learning platform, personal data may be processed including:

• name;
• email address;
• account information;
• login information;
• course enrolments;
• course activity and progress;
• completed lessons or learning activities;
• assessment information, where applicable;
• community activity;
• messages or other content you submit;
• technical information relating to your use of the platform;
• transaction and purchase information.

The purpose of this processing is to create and administer your account, provide the purchased services and digital content, operate the learning environment, communicate with you regarding your participation and provide customer support.

The legal basis is generally Article 6(1)(b) GDPR where processing is necessary to perform a contract with you or take steps at your request before entering into a contract.

Where processing is required for legal or accounting purposes, Article 6(1)(c) GDPR may apply.

Where processing is necessary for platform security, prevention of misuse or the effective administration of our services, we may rely on our legitimate interests pursuant to Article 6(1)(f) GDPR, subject to the required balancing of interests.

LearnWorlds processes personal data in connection with providing its platform and related services. Where LearnWorlds processes personal data on our behalf, it acts as a processor in accordance with the applicable data protection requirements.

LearnWorlds may engage authorised subprocessors and may involve processing outside the European Economic Area. International transfers are addressed further in Section 19 of this Privacy Policy

Where our services include access to LearnWorlds community functions, discussion areas or internal messaging, we process personal data necessary to provide these functions.

Depending on how you use them, this may include:

• profile information;
• posts;
• comments;
• replies;
• messages;
• uploaded materials;
• participation information;
• timestamps and related technical information.

The legal basis for processing required to provide community or communication features forming part of a purchased service is generally Article 6(1)(b) GDPR.

Where such processing is necessary to administer and secure the platform, Article 6(1)(f) GDPR may also apply.

Information that you intentionally publish in a community area may be visible to other authorised members of that community.

Contractual rules concerning appropriate community use, confidentiality, intellectual property and participant conduct are addressed separately in our Terms & Conditions, rather than in this Privacy Policy.

When you register for a workshop, event or retreat organised by Behind the Yoga Mat, we process personal data necessary to administer your registration and participation.

Depending on the activity, this may include:

• name;
• email address;
• telephone number;
• billing details;
• booking information;
• payment status;
• communication concerning your booking;
• participant information reasonably necessary to organise the service.

The primary legal basis is Article 6(1)(b) GDPR, as processing is necessary to administer and perform your booking.

We may also process certain information under Article 6(1)(c) GDPR where necessary to comply with accounting, tax or other statutory obligations.

Third-party venues and service providers

Some events or retreats may take place at hotels, retreat centres, studios or other third-party venues.

Where reasonably necessary to organise the service, limited participant information may be provided to the relevant venue or service provider.

Only the information reasonably necessary for the relevant purpose will be shared.

If you enter into a separate accommodation or other service contract directly with a hotel or venue, that provider is generally responsible for its own processing of your personal data under its own privacy policy.

The contractual conditions applying to bookings, cancellations and refunds are addressed in our Terms & Conditions and/or the applicable booking conditions and are not part of this Privacy Policy.

Certain yoga, movement, workshop or retreat activities may make it appropriate for participants to voluntarily provide information concerning an injury, pregnancy, physical limitation, allergy, accessibility requirement or other health-related circumstance relevant to participation.

Health data constitutes a special category of personal data under Article 9 GDPR and requires additional protection.

Where Behind the Yoga Mat intentionally collects or records health information, we will process such information only where an appropriate legal basis under Articles 6 and 9 GDPR applies. Depending on the circumstances, this may include your explicit consent pursuant to Article 9(2)(a) GDPR.

We aim to collect only information reasonably necessary for the relevant purpose.

Where consent is relied upon, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing undertaken before withdrawal.

We do not use health-related information for advertising or unrelated marketing purposes.

Rules concerning participants' responsibility for assessing their ability to participate safely, notifying the instructor of relevant circumstances and practising within their personal limits belong to our Terms & Conditions and are therefore not repeated in this Privacy Policy.

Where you book coaching, individual sessions, consultations or live online services, we may process:

• your name;
• contact information;
• booking information;
• payment information;
• correspondence;
• information you voluntarily provide in connection with the session.

The primary legal basis for processing is Article 6(1)(b) GDPR.

Information voluntarily disclosed during coaching or individual sessions will be processed only to the extent necessary to provide the relevant service, respond to you or maintain appropriate business records.

If information falling within a special category under Article 9 GDPR is intentionally recorded or otherwise processed, an additional legal basis under Article 9 will be required where applicable.

Online sessions may be provided through a video-conferencing provider such as Google Meet or another provider identified at the time the service is offered.

The selected provider may process technical and account information necessary to establish and operate the online session.

Behind the Yoga Mat does not record individual or group online sessions unless participants are informed in advance and an appropriate legal basis exists.

Rules concerning recording by participants are contained in our Terms & Conditions.

Behind the Yoga Mat uses Google/Gmail for business email communication.

If you contact us by email, we may process:

• your name;
• email address;
• the contents of your communication;
• attachments;
• date and time of correspondence;
• previous correspondence where relevant.

We process this information primarily to respond to your enquiry, administer an existing contractual relationship, prepare a requested service or provide customer support.

Depending on the circumstances, the legal basis may be:

• Article 6(1)(b) GDPR for contractual or pre-contractual communication;
• Article 6(1)(f) GDPR for general business correspondence and legitimate customer-service purposes;
• Article 6(1)(c) GDPR where correspondence must be retained to satisfy a legal obligation.

Google may process data on infrastructure located outside the EEA. Where international transfers occur, the safeguards described in Section 19 apply.

Where you voluntarily contact Behind the Yoga Mat through WhatsApp or another messaging service made available by us, we process the information you provide for the purpose of responding to you and administering the relevant communication.

This may include:

• your telephone number;
• profile name;
• profile image where made available by your settings;
• message content;
• attachments;
• communication metadata.

Depending on the context, the legal basis is generally Article 6(1)(b) GDPR or Article 6(1)(f) GDPR.

The relevant messaging provider separately processes personal data in accordance with its own privacy terms.

Where a matter involves particularly sensitive information, we may ask you to continue the communication through another appropriate channel.

Behind the Yoga Mat may maintain profiles on social media and professional networking platforms, including platforms such as:

• Instagram;
• Facebook;
• LinkedIn;
• Pinterest.

If you voluntarily contact us through a social media platform, comment on our content or otherwise interact directly with our profile, we may process information made available to us through that interaction.

This may include:

• your account or profile name;
• publicly available profile information;
• the content of your message or interaction;
• correspondence history.

The purpose is primarily to communicate with you, respond to enquiries and manage our professional social media presence.

Depending on the circumstances, processing may be based on Article 6(1)(b) GDPR or our legitimate interests pursuant to Article 6(1)(f) GDPR.

The respective social media provider independently processes personal data when you use its platform. Its own privacy policy applies to such processing.

Where social-media technologies are integrated directly into our website and involve cookies, tracking or similar technologies, the relevant information is provided in our separate Cookie Policy.

Our website/domain infrastructure is hosted using services provided by ALL-INKL.COM / Neue Medien Münnich.

When you access our website, technical information necessary to establish and maintain the connection may be processed by the hosting provider.

This may include:

• IP address;
• date and time of access;
• requested page or file;
• browser information;
• operating system information;
• referring URL;
• technical status information.

Processing is necessary to make the website available, maintain stability and security and identify technical problems or misuse.

To the extent that Behind the Yoga Mat determines this processing, the legal basis is our legitimate interest pursuant to Article 6(1)(f) GDPR in providing a secure and functional website.

Where ALL-INKL processes personal data on our behalf, the processing is governed by the applicable data-processing arrangements.

Detailed information about cookies or similar technologies is provided separately in our Cookie Policy.

Where you purchase a course, programme, workshop, event, retreat or another paid service, payment processing may be carried out through an authorised payment service provider.

Depending on the payment options offered at checkout, payment methods may include:

• credit or debit card;
• Apple Pay;
• Google Pay;
• other payment methods made available through the relevant payment provider.

Where Stripe is used as our payment service provider, Stripe processes information required to execute and secure the transaction.

Depending on the payment method, this may include:

• name;
• billing information;
• payment method;
• payment card information;
• transaction data;
• technical and fraud-prevention information.

Behind the Yoga Mat generally receives information such as:

• confirmation of payment;
• payment status;
• transaction identifier;
• amount;
• information required for invoicing and accounting.

We do not receive or store your complete payment card number where payment is handled directly by the payment provider.

Processing necessary to complete your purchase is generally based on Article 6(1)(b) GDPR.

Processing necessary to fulfil tax and accounting obligations is based on Article 6(1)(c) GDPR.

Payment providers may also process certain information as independent controllers for purposes such as fraud prevention, regulatory compliance and payment security.

The payment methods actually available to you will be displayed during checkout.

We do not sell your personal data.

Personal data may, however, be disclosed or made accessible to third parties where necessary to operate our business, provide your purchased services or comply with legal obligations.

Recipients may include:

• website and hosting providers;
• online learning platform providers;
• cloud and IT service providers;
• email and communication providers;
• payment service providers;
• accountants, tax advisers or other professional advisers;
• event or retreat venues where necessary;
• competent authorities where disclosure is required by law.

Where a service provider processes personal data on our behalf, we use appropriate contractual arrangements as required under Article 28 GDPR.

Transfers outside the EEA

Some service providers may process personal data outside the European Economic Area ("EEA").

Where personal data is transferred to a country outside the EEA, we take appropriate steps to ensure that the transfer complies with Chapter V of the GDPR.

Depending on the provider and destination, these safeguards may include:

• an adequacy decision adopted by the European Commission under Article 45 GDPR;
• the European Commission's Standard Contractual Clauses under Article 46 GDPR;
• participation in an applicable recognised data-transfer framework;
• other legally permitted safeguards.

Where appropriate, additional safeguards may also be implemented.

You may contact us if you would like further information about the safeguards applicable to a particular international transfer.

We retain personal data only for as long as necessary for the purposes for which it was collected and to satisfy applicable statutory obligations.

The applicable retention period depends on the type of information and the reason for processing it.

In particular:

Customer and contractual information may be retained for the duration of the contractual relationship and thereafter for the period necessary to establish, exercise or defend legal claims and comply with statutory requirements.

Invoice, payment and accounting information is retained for the period required under applicable Austrian tax and accounting legislation.

Course account information may be retained for the duration of your course access and, where necessary, for a reasonable period afterwards for administration, contractual documentation or legal claims.

Enquiries and correspondence are retained for as long as reasonably necessary to deal with the enquiry and any subsequent relationship or legal requirements.

Newsletter information is generally processed until you unsubscribe or withdraw your consent, subject to limited retention where necessary to document that consent was obtained or withdrawn.

Special-category information, including recorded health-related information, will not be retained longer than reasonably necessary for the purpose for which it was collected unless a longer period is legally required or another lawful basis applies.

When personal data is no longer required, it will be deleted, anonymised or otherwise handled in accordance with applicable legal requirements.

We take appropriate technical and organisational measures designed to protect personal data against:

• unauthorised access;
• unlawful processing;
• accidental loss;
• alteration;
• disclosure;
• destruction.

The level of protection is selected having regard to the nature, scope, context and purposes of processing and the risks to individuals.

However, no method of electronic transmission or storage can guarantee absolute security.

Our courses, retreats, workshops, coaching services and other services are generally intended for adults unless a particular offer expressly states otherwise.

We do not knowingly seek to collect personal data from children through services intended exclusively for adults.

Where a service is specifically offered to minors, appropriate consent and data-protection procedures will be implemented where required by applicable law.

We may update this Privacy Policy where necessary to reflect:

• changes to our services;
• changes to the providers we use;
• technical developments;
• changes to our processing activities;
• changes in applicable law or regulatory guidance.

The current version will be made available on our website together with its effective or last-updated date.

Material changes will be communicated where required by applicable law.



To exercise any of these rights or for questions concerning the processing of your personal data, please contact us using the contact details provided in Section 2 of this Privacy Policy.