Privacy Policy

Last updated: 18 July 2026

This Privacy Policy explains how Linden House Yoga (“we”, “us”, “our”) processes personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the German Bundesdatenschutzgesetz (“BDSG”), and applicable state data protection law.

1. Data controller

Business name: Linden House Yoga
Owner: Clara Weiss
Address: Bergstraße 8, 29221 Celle, Germany
Email: [email protected]
Phone: +49 5141 289376
Website: innacdilen.live

For data protection enquiries or to exercise your rights, contact us using the details above. We respond within one month, or inform you if an extension is required under Art. 12 GDPR.

2. Scope

This policy applies to personal data collected through our website, enquiry and sign-up forms, email, phone, in-studio interactions, class bookings, memberships, and workshop registrations relating to students, parents, guardians, business clients, and website visitors.

3. Categories of personal data

Depending on your relationship with us, we may process:

• Identity and contact data: name, address, email, phone number, emergency contact details.
• Student data: age, experience level, health-related information you voluntarily provide, attendance, membership status.
• Financial data: invoice details, payment records, SEPA mandate references (we do not store full card numbers).
• Technical data: IP address, browser type, device information, pages visited, cookie identifiers (see our Cookie Policy).
• Communications: messages, emails and notes related to enquiries and customer service.

4. Purposes and legal bases

We process personal data for the following purposes and legal bases under Art. 6 GDPR:

• Contract performance (Art. 6(1)(b)): processing sign-ups, class bookings, memberships, workshops, private sessions, and invoicing.
• Legal obligation (Art. 6(1)(c)): tax and accounting records (e.g. under the German Abgabenordnung), responding to lawful requests from authorities.
• Legitimate interests (Art. 6(1)(f)): improving our services, ensuring studio safety, fraud prevention, and limited communication with existing customers about schedule changes — balanced against your rights.
• Consent (Art. 6(1)(a)): optional analytics and marketing cookies, newsletter emails, and photography in promotional materials where required. You may withdraw consent at any time.

5. Health-related information

If you share health information (e.g. injuries, pregnancy, medical conditions) so we can adapt your practice, we process this based on your consent (Art. 9(2)(a) GDPR) or, where applicable, to protect your vital interests during class (Art. 9(2)(c)). Such data is kept confidential, accessible only to relevant teachers, and not used for marketing.

6. Recipients and processors

We may share personal data with:

• Our teachers and administrative staff on a need-to-know basis.
• IT and hosting providers, email services, booking software, and payment processors bound by data processing agreements under Art. 28 GDPR.
• Professional advisers (accountants, lawyers) under confidentiality obligations.
• Public authorities where required by law.

We do not sell personal data. Where processors are located outside the EEA, we ensure appropriate safeguards (e.g. EU Standard Contractual Clauses or adequacy decisions).

7. Retention

We retain personal data only as long as necessary:

• Active member and student records: duration of membership plus up to 10 years for tax and legal purposes.
• Enquiry records not converted to membership: up to 12 months.
• Website analytics (if consented): per provider settings, generally up to 26 months.
• Financial records: minimum 10 years per German tax law (Abgabenordnung).
• Health information voluntarily provided: deleted within 12 months after your last class unless ongoing relevance requires longer retention with your consent.

8. Your rights

Under GDPR and BDSG, you have the right to:

• Access your personal data (Art. 15 GDPR).
• Rectification of inaccurate data (Art. 16 GDPR).
• Erasure (“right to be forgotten”) where applicable (Art. 17 GDPR).
• Restriction of processing (Art. 18 GDPR).
• Data portability for data processed by automated means based on consent or contract (Art. 20 GDPR).
• Object to processing based on legitimate interests or for direct marketing (Art. 21 GDPR).
• Withdraw consent at any time without affecting prior lawful processing.
• Lodge a complaint with the supervisory authority: Die Landesbeauftragte für den Datenschutz Niedersachsen (LfD Niedersachsen), Prinzenstraße 5, 30159 Hannover, www.lfd.niedersachsen.de.

9. Security

We implement appropriate technical and organisational measures including access controls, secure storage of physical records, encrypted transmission where feasible, and staff training on data protection. No method of transmission over the Internet is completely secure.

10. Children

We offer classes for children from age six. Personal data about minors is collected from parents or legal guardians. We do not knowingly process children's data for marketing without parental consent.

11. Automated decision-making

We do not use automated decision-making or profiling that produces legal or similarly significant effects within the meaning of Art. 22 GDPR.

12. Changes

We may update this policy from time to time. The current version is always published on this page with the date above.