Privacy Policy

This Privacy Policy explains how Sea View Yoga Málaga collects, uses, and protects your personal data when you use our website, member platform, or contact us about our services. We are based in Spain and this policy is written in compliance with the General Data Protection Regulation (GDPR).

1. Who we are

Sea View Yoga Málaga is operated by Stéphanie, a yoga coach based in Cerrado de Calderón, Málaga, Spain. For the purposes of data protection law, Stéphanie is the data controller responsible for your personal data.

You can contact us at any time via our contact page.

2. What data we collect

When you create an account

• Full name and email address
• Encrypted password (we never see your password in plain text)

When you book an outdoor class

• Full name, email address and phone number (optional)
• The class and package you selected
• Whether you need a mat, and any message you include

When you enrol in a programme

• Full name and email address
• Payment confirmation reference from Stripe (we do not store card details)
• The programme you bought and the price you paid

When you use the member platform

• Which lessons and sessions you have completed, and when
• Your progress through the programme

When you join a waitlist

• Full name, email address, and any message you include
• The programme you are interested in (Move Better, Get Stronger, or Stay Flexible)

When you take the mobility assessment

• First name and email address, and your answers to the assessment questions
• We use these to send your personalised result and, unless you unsubscribe, related tips and offers by email

When you contact us

• Full name, email address, phone number (optional)
• Subject, preferred contact time, and the content of your message

Automatically collected data

When you visit our website, standard server logs may collect your IP address, browser type, and the pages you visit. This data is not linked to your identity and is used only for security and performance purposes.

3. How we use your data

• To create and manage your account on our member platform
• To process class bookings and programme enrolments
• To give you access to your lessons and progress dashboard
• To send you booking confirmations, purchase confirmations, and programme reminder emails
• To notify waitlist members when a programme opens for enrolment
• To respond to enquiries submitted through our contact form
• To process payments securely through Stripe
• To improve our website and services

We do not sell your data to third parties. We do not use your data for automated decision-making or profiling.

4. Legal basis for processing

We process your data on the following legal grounds under GDPR:

• Contract performance: to fulfil your booking or programme enrolment and provide you with the services you have purchased.
• Legitimate interest: to respond to your enquiries, to notify waitlist members of programme availability, to send related tips and offers to visitors who complete our free mobility assessment (disclosed at the point of submission), and to maintain the security of our platform. You can unsubscribe from these emails at any time via the link included in every message.
• Consent: where you have explicitly opted in to receive other marketing communications from us. You may withdraw consent at any time.
• Legal obligation: where we are required to retain certain records for tax or accounting purposes.

5. Third-party services

We use the following third-party services to operate our website and platform. Each is bound by its own privacy policy and, where relevant, a Data Processing Agreement with us.

Supabase

We use Supabase for user authentication, account management, and our application database. Data is stored on servers in the European Union. Supabase Privacy Policy.

Stripe

Payments are processed by Stripe. When you complete a purchase, you are submitting your payment details directly to Stripe. We receive only a payment confirmation reference. Stripe is PCI DSS Level 1 certified. Stripe Privacy Policy.

Brevo (formerly Sendinblue)

We use Brevo to send transactional emails such as booking confirmations and programme reminders. Brevo Privacy Policy.

Google (YouTube & Places API)

Our website may embed YouTube videos and uses Google's Places API to display public reviews. Google may set cookies or collect data when you interact with embedded content. Google Privacy Policy.

Google Analytics

We use Google Analytics to understand how visitors use this site, such as which pages are viewed and general traffic patterns. It only runs if you accept analytics cookies in the banner shown on your first visit. If you decline, no Analytics data is collected about you. Google Privacy Policy.

Live sessions (corporate programmes)

Live group sessions included in a corporate programme are hosted online. The platform's own privacy policy applies when you join a session.

Meta (Facebook & Instagram)

If you accept cookies, the Meta Pixel records visits and purchases on our website so we can measure our Facebook and Instagram ads. Meta Privacy Policy.

WhatsApp

Community groups for corporate programme participants are hosted on WhatsApp, and you may choose to contact us by WhatsApp. Participation is voluntary. WhatsApp Privacy Policy.

6. How long we keep your data

• Account data: retained for as long as your account is active. You may request deletion at any time.
• Booking records: retained for 5 years for accounting and tax compliance.
• Payment records: retained for 5 years as required by Spanish tax law.
• Progress data: retained for the duration of your account, then deleted upon account closure.
• Waitlist data: retained until the relevant programme launches and you have been notified, or until you ask to be removed.
• Contact messages: retained for 12 months, then deleted unless ongoing communication is active.

7. Your rights

Under GDPR, you have the following rights regarding your personal data:

• Right of access: you can request a copy of all personal data we hold about you.
• Right to rectification: you can ask us to correct inaccurate data.
• Right to erasure: you can ask us to delete your data, subject to legal retention obligations.
• Right to data portability: you can request your data in a machine-readable format.
• Right to object: you can object to processing based on legitimate interest.
• Right to restrict processing: you can ask us to pause processing of your data in certain circumstances.
• Right to withdraw consent: where processing is based on consent, you may withdraw it at any time without affecting prior processing.

To exercise any of these rights, use our contact form. We will respond within 30 days. You also have the right to lodge a complaint with the Spanish data protection authority (AEPD) at www.aepd.es.

8. Cookies

Our website uses minimal cookies. We use session cookies required for the member platform to function (authentication tokens stored in your browser's local storage). We use Google Analytics cookies to understand site traffic and the Meta Pixel (Meta Platforms Ireland) to measure our Facebook and Instagram ads. Both are used only after you accept them in the cookie banner shown on your first visit. If you reject them, no analytics or advertising data is sent. Visitors outside Europe do not see the banner and these cookies are enabled for them by default. Third-party services such as YouTube may set their own cookies when you interact with embedded content.

Your cookie choice is remembered locally in your browser. You can change it at any time by clearing your browser's local storage for this site, which will show the banner again, or control cookies through your browser settings. Disabling session cookies will prevent you from logging in to the member platform.

9. Contact us

For any questions about this Privacy Policy or how we handle your data, please contact:

Sea View Yoga Málaga
Cerrado de Calderón, Málaga, Spain
Contact us via our contact page

We may update this policy from time to time. Changes will be posted on this page with an updated date. We encourage you to review this policy periodically.