Privacy Policy

Version 11 September 2026. This version replaces all earlier versions.

1. In short

I collect what I need to teach you, invoice you and stay in touch. Nothing more. I don't sell your data and I don't build profiles. This page tells you what I collect, why, who else sees it and how long I keep it. If anything is unclear, e-mail me.

2. Who is responsible

I am, José de Groot – de Haan, as the data controller. The website runs on Wix, which processes data on my behalf.

3. What I collect, why, and on what basis

When you book or buy something

Name, e-mail address, phone number, address, what you bought and your payment status. Payment details themselves — card number, bank account — go straight to the payment provider; I don't see or store them. Why: delivering what you booked, sending confirmations and invoices, answering your questions. Basis: performance of our agreement. Keeping the invoice records is a legal obligation.

When you register for a training or a retreat
Everything above, plus what you fill in on the registration form: your yoga background, the price option that applies to you, and your confirmations.

The form also asks about injuries, pregnancy and medical conditions. That is health data, and the law treats it as a special category. I ask for it for one reason: so I can adapt the practice safely to your body. I process it only with your explicit consent, which you give by ticking the box on the form, and you can withdraw that consent at any time by e-mailing me. Answering is voluntary; if you'd rather not write it down, tell me in person before we start.

Basis: performance of our agreement, and your explicit consent for the health information.

When you create an account or join an online programme Your login details, your progress, what you watch, and anything you post in a group. This runs through the Wix Members Area and the Spaces by Wix app. Why: giving you access and keeping track of where you are in a programme. Basis: performance of our agreement.

When you subscribe to the newsletter
Name and e-mail address, and whether you open or click a mail. Why: sending you the newsletter. Basis: your consent. Every mail has an unsubscribe link.

Live sessions and recordings
Live sessions take place on Zoom and are recorded. What ends up in the recording depends on the kind of session:

Group classes — only I am in view. You can be heard if you speak or ask a question. Keep your microphone off and use only your first name if you'd rather not be recognisable.
Online training sessions — participants are in view too, because what we do together is part of the training. If you'd rather not be in view, keep your camera off; that changes nothing about your place in the training.
Online private sessions — recorded so that you can look back at them.

Recordings are shared only with the participants of that session, package or training. They are never published anywhere else without your consent.

Basis: performance of our agreement, and my legitimate interest in making a session available to people who couldn't be there live. You can always stay off camera.

Yogatreat on Facebook and Instagram
Yogatreat has pages on Facebook and a profile on Instagram. When you visit or follow them, Meta collects data about your visit and gives me anonymised visitor statistics. For those statistics Meta and I are joint controllers. Everything that happens on Meta's platforms is governed by Meta's own privacy policy, which I have no influence over. If you'd rather not be counted, you can visit the website instead. Basis: legitimate interest in being findable where people look.

When you visit the website
Wix places cookies that are needed to make the site work — login, cart, security — and records technical data such as your IP address and browser type in its server logs. With your consent, Google Analytics and Wix Analytics measure how the site is used. See section 4. Basis: legitimate interest for the essential cookies and logs; consent for analytics.

When you contact me
Your name, e-mail address and what you wrote. Why: answering you. Basis: legitimate interest, or performance of our agreement if you're already a client.

I don't use automated decision-making or profiling. You're never obliged to give me data, but without your name, e-mail address and payment I can't complete a booking.

4. Cookies and the website

When you arrive, a cookie banner asks what you allow. Essential cookies — the ones that keep you logged in, hold your cart and protect the site — are always placed; without them the site doesn't work. Analytics cookies from Google Analytics and Wix Analytics are only placed if you accept them, and you can change your choice at any time through the banner.

Pages with an embedded video from Wix Video, YouTube or Vimeo load that video from the provider's own servers. Those providers can place their own cookies and see that you watched. Their privacy policies apply alongside this one.

5. Who else sees your data

Only the parties I need to run Yogatreat:

Wix — website, bookings, forms, e-mail marketing, member area, invoicing, video hosting and the Spaces by Wix app. Wix processes all website data on my behalf.
Wix Payments — processes your payment.
Zoom — live sessions.
Google — Google Analytics, only if you accept analytics cookies. YouTube, if you play an embedded video.
Vimeo — if you play an embedded video.
Meta — Facebook and Instagram, for the pages and profile described in section 3.
My accountant — invoice data, for the books.

I never sell your data and never share it with anyone else, unless the law requires me to.

6. Transfers outside the EEA

Wix, Zoom, Google, Vimeo and Meta store data partly on servers outside the European Economic Area, mainly in the United States. They do this under the EU-US Data Privacy Framework and the EU Standard Contractual Clauses. If you'd like a copy of the relevant safeguards, e-mail me.

7. How long I keep your data

Invoices and payment records — 7 years after the financial year, as tax law requires
Training and retreat registrations, including certificates issued — 5 years
Health information from a registration form — until the end of that training or retreat, then deleted
Other client data, such as bookings and correspondence — 2 years after your last booking
Account and online programme data — until you delete your account, or 2 years after your last login
Newsletter data — until you unsubscribe
Session recordings — 12 months after the session. Recordings of private sessions are deleted from my own storage once I have shared them with you.
Google Analytics data — 14 months

8. Your rights

You can ask me at any time to see the data I hold about you, to correct it, to delete it, to restrict or object to its use, or to receive it in a portable format. Where I rely on your consent — the health information, the newsletter, analytics cookies — you can withdraw it whenever you want; that doesn't affect what happened before.

E-mail admin@yogatreat.eu and I'll respond within a month.

If you feel I'm not handling your data properly, tell me first. You can also file a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

9. Children

What I offer is for adults. If you're under 16 and want to take part, I need consent from your parent or guardian before I process your data. If I find out that I hold data about someone under 16 without that consent, I delete it.

10. Security

The website and all data run on Wix, which uses encrypted connections and secured data centres. Access to your data is limited to me and the parties in section 5.

11. Changes

When I change this policy, the new version appears here with a new date. If a change affects how I use data you've already given me, I let you know by e-mail.

Cookie Policy

Analytics