Privacy Policy (GDPR) 

The controller is the natural or legal person who, alone or jointly with others, determines the purposes and means of processing personal data (e.g., names, email addresses, etc.). 

​

Retention Period

Unless a more specific retention period is stated in this Privacy Policy, we will retain your personal data until the purpose for which it was collected no longer applies. If you assert a legitimate request for erasure or revoke your consent to data processing, your data will be erased unless we have other legally permissible grounds for storing your personal data (e.g., retention periods under tax or commercial law ranging from 6 to 10 years); in the latter case, the data will be deleted once these grounds no longer apply. 

​

Withdrawal of Your Consent to Data Processing

Many data processing operations are only possible with your explicit consent. You may withdraw any consent you have already given at any time. The lawfulness of the data processing carried out prior to the withdrawal remains unaffected by the withdrawal. 

​

Right to File a Complaint with the Competent Supervisory Authority

In the event of violations of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority, in particular in the Member State of their habitual residence, their place of work, or the location of the alleged violation. 

​

Right to Data Portability

You have the right to have data that we process automatically—based on your consent or in fulfillment of a contract—provided to you or to a third party in a commonly used, machine-readable format. 

​

Access, Erasure, and Rectification

Subject to applicable legal provisions, you have the right at any time to receive, free of charge, information about your stored personal data, its origin and recipients, and the purpose of the data processing, as well as, where applicable, the right to have this data corrected or erased. 

​

Right to Restriction of Processing

You have the right to request the restriction of the processing of your personal data.

 

3. Data Collection During Booking and On-Site Processing (Special section for the two-stage retreat model) 

When you book a retreat on our platform and stay at the retreat location, we process your data in the following phases: 

​

a) Online registration for the retreat (Step 1)

During online registration, we collect the data necessary to conduct the retreat:

* Last name, first name 

* Email address (to send the booking confirmation)

* Mailing address (if applicable)

* Payment information for the seminar fee (depending on the selected

   online payment providers, such as PayPal, credit card, Stripe, etc.) 

* Legal basis:* Processing is based on Article 6(1)(b) of the GDPR

   (fulfillment of a contract for seminar participation). 

​

b) On-site check-in and lodging agreement (Step 2)

When you fill out the check-in form on site, we collect additional information regarding your stay:

* Address and date of birth (required to comply with state registration requirements for lodging facilities pursuant to Sections 29 and 30 of the Federal Registration Act (BMG)).

* Selected receipt type (digital via email or printed). If you choose the digital receipt, we will use your email address to send the invoice.

* On-site payment details (recording of cash payments, card payment terminal transactions, or QR code transaction data from banking apps/PayPal). 

* Legal basis:* Data processing during check-in is based on Art. 6(1)(b) of the GDPR (performance of the accommodation contract) and Art. 6(1)(c) of the GDPR (compliance with a legal obligation under the Federal Registration Act and tax-related retention requirements under the German Fiscal Code—AO). 

​

c) Disclosure of Data to International Guest Speakers

If it is absolutely necessary for the organization of the retreat (e.g., for group assignments or for the speaker to clarify technical prerequisites in advance), the name and email address will be transferred to the respective guest speaker at . If the guest speaker is located in a third country outside the EU/EEA, we ensure an adequate level of data protection through standard contractual clauses. Data will **not** be shared for the speaker’s marketing purposes without your explicit consent. 

​

4. On-site Payment Service Providers 

We offer various cashless payment methods on-site. 

This data is processed by the respective payment providers: 

​

Card payment (debit/credit card) 

When paying via terminal, the card details and the amount are transmitted to our acquirer / payment service provider. 

​

PayPal via QR Code 

If you use the PayPal QR code on-site, you’ll log in to your own PayPal app. PayPal processes your payment data as an independent data controller in accordance with PayPal’s own privacy policy. 

​

Bank app via QR code (GiroCode) 

In this case, our system generates a code that you scan with your banking app. 

The transfer is executed directly by your bank via Instant Payment. 

We only record the receipt of funds in our bank account for accounting purposes. 

​

5. Photos and Videos Taken During Your Stay (Art. 6(1)(a) and (f) of the GDPR) 

1. Purpose and scope of processing 

If you have given us your consent by checking the corresponding box during the online booking process, we or persons commissioned by us will take photos and record videos during your stay at the monastery and retreat center. 

These recordings serve the following purposes: 

​

• Public Relations & Marketing: To showcase our nonprofit activities, services, and retreats on our website, on social media (e.g., Instagram, Facebook), and in printed brochures or flyers. 
   

• Security: To enforce our right to manage the premises and ensure safety on the property (Art. 6(1)(f) GDPR). 

​

2. Legal Basis 

The processing of recordings for marketing and documentation purposes is based exclusively on your explicit consent in accordance with **Art. 6(1)(a) GDPR**. To the 

extent that recordings are used to secure the premises, this is based on our legitimate interest in accordance with **Art. 6(1)(f) GDPR**. 

​

3. Retention Period and Disclosure 

The recordings will be stored for as long as necessary to achieve the stated purposes (e.g., for the duration of our website’s existence) or until you revoke your consent. The recordings will not be disclosed to unauthorized third parties. However, the recordings may be freely accessible worldwide on the Internet once they are published on our website or on social media. 

​

4. Your Rights (Right to Withdraw Consent) 

You have the right to withdraw your consent to the future creation and use of photos and videos in which you are clearly recognizable at any time without providing a reason. You can send your notice of withdrawal by email to the email address listed earlier on this website.

​

Please note that the lawfulness of the processing carried out up until the withdrawal remains unaffected by the withdrawal. 

​

If you appear in a recording that has already been published and wish to have it deleted, simply send us a brief message specifying the exact image or video. We will then remove the recording immediately, to the extent that this is technically possible. 

​

6. Processing of Health Data 

To the extent that you provide information regarding your physical condition, limitations, pregnancy, or health-related dietary habits (e.g., allergies) as part of your registration for our retreats and seminars, we process this data exclusively on the basis of your explicit consent in accordance with Article 9(2)(a) of the GDPR. This data is used to ensure the safe conduct of yoga and meditation exercises as well as to provide meals tailored to your needs. It will be treated as strictly confidential and deleted after the event, unless required by law to be retained. You may revoke your consent at any time with future effect. 

​

7. Data Sharing When Using the Taxi Booking Service 

If you select our service for pre-booking a taxi for your train station or airport transfer on the registration form, we will transfer the necessary data (name, arrival time, arrival location, and, if applicable, your phone number for the driver to contact you) to the local taxi company we have commissioned [name and address of the taxi company]. The legal basis for this data transfer is Art. 6(1)(b) of the GDPR (performance of a contract or implementation of pre-contractual measures taken at the request of the data subject). 

​

8. Processing of Data for Booking Seminars, Accommodations, and Meals 

The data you enter in the registration form (name, address, contact information, and booking details for the seminar and accommodations) will be processed for the purpose of fulfilling the contractual relationship, including billing (Article 6(1)(b) of the GDPR). Due to commercial and tax law requirements (e.g., the German Fiscal Code (AO) and the German Value-Added Tax Act (UStG)), we are required to store your address, payment, and order data for a period of ten years. Once these periods have expired, the data will be deleted. 

​