Privacy Policy
Version 1.0 · Body Awareness Center OÜ
1. Who is responsible for your data
The controller is Body Awareness Center OÜ, registry code 14148717, Telliskivi tn 49-39, 10611 Tallinn, Estonia. Email: info@bodyawareness.ee.
We have not appointed a data protection officer, because the law does not require one for our activities. Write to us about anything in this policy.
2. What data we use, why, on what legal basis, and for how long
| Situation | Data | Purpose | Legal basis (GDPR) | How long we keep it |
|---|---|---|---|---|
| You buy the Programme | The data Payhip's checkout asks for: at minimum your email address, plus your name and billing details where the payment method needs them; your country (needed for VAT); order details (product, price, date, order number); your checkout answers (consent tick-boxes); download history | Concluding and performing the contract, delivering the files, printing your email on the PDF to protect the licence, support | Art. 6(1)(b): performance of a contract | For as long as the contract runs, then as described below |
| The same order data | Accounting records | Art. 6(1)(c): legal obligation | 7 years from the end of the financial year (Estonian Accounting Act, § 12) | |
| Checkout consent records and complaint correspondence | Showing that we complied with consumer law; handling claims | Art. 6(1)(f): our legitimate interest in establishing and defending legal claims | 3 years after the purchase (general limitation period, Estonian General Part of the Civil Code Act, § 146) | |
| You contact us | Name, email address, your message | Answering you | Art. 6(1)(f), or art. 6(1)(b) if your message is about an order | 2 years after the last contact |
| You join the email list | Email address; first name (if you give it); date, time, source and IP address of the signup and of your confirmation | Sending our newsletter: breathwork tips, news and offers about our programmes and courses | Art. 6(1)(a): your consent; and consent to direct marketing by email under § 103¹ of the Estonian Electronic Communications Act | Until you unsubscribe. After that we keep a record of your consent and unsubscribe for 3 years, as proof |
| Store analytics (only if we switch it on) | Pages viewed, device and browser data, approximate location | Statistics | Art. 6(1)(a): consent through the cookie banner | See section 5 |
- You don't have to give us your data, but we cannot deliver the Programme without an email address.
- Joining the email list is always optional. Buying the Programme does not sign you up.
- We do not use automated decision-making or profiling that has legal or similarly significant effects on you.
Health data: we don't ask about your health. The checkout box only confirms that you have read the Health Disclaimer and Contraindications. Please don't send us health details. If you do include them in a message, we use them only to answer you and then delete them.
3. Who receives your data
- Payhip Limited (London, UK) runs our store, checkout, delivery and receipts. As reseller, it also handles EU and UK VAT. Payhip describes itself as the data controller for the data processed on its platform, and it keeps transaction data for 10 years for EU VAT purposes (https://payhip.com/privacy). We treat Payhip as an independent controller for its platform and VAT purposes.
- PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) processes your payment as an independent controller, under its Privacy Statement (https://www.paypal.com/myaccount/privacy/privacyhub). PayPal's data protection terms say that PayPal and the merchant are each independent controllers of payment data (https://www.paypal.com/us/legalhub/paypal/data-protection). Card payments made through Payhip's card checkout are processed by the payment provider Payhip uses, under its own privacy terms. We have no separate payment account on the store.
- MailerLite (UAB MailerLite, Lithuania, EU) sends the newsletter and stores the list for us, as our processor, under a data processing agreement.
- Google Ireland Ltd (YouTube) plays the guided audio (see section 4).
- Google Ireland Ltd (Google Forms) runs our online withdrawal form. The form is operated on behalf of Body Awareness Center OÜ under Nisarga Eryk Dobosz's Google account (nisarga8@gmail.com). Responses (name, email, order details, address) are used only to handle your withdrawal, and are kept for 3 years.
- Zone Media OÜ (Zone.ee, Estonia) hosts our email (info@bodyawareness.ee), as our processor.
- Netlify, Inc. (USA) hosts our website and legal pages, as our processor. It processes technical access data such as IP addresses in server logs.
- Our accountant, under a confidentiality obligation; and authorities or courts, when the law requires it.
4. Audio on YouTube
All guided audio tracks are unlisted videos on YouTube. QR codes and links in the PDF open YouTube directly. YouTube's own terms and cookies then apply, and Google Ireland Ltd processes your data as an independent controller under its privacy policy (https://policies.google.com/privacy). YouTube may set cookies and show ads. If you're signed in, it may link what you watch to your account. To limit this, sign out or use a private browser window.
The free Day 1 video on our product page is embedded in YouTube's privacy-enhanced mode (youtube-nocookie.com). Nothing loads from YouTube until you press play. Once the video plays, Google receives data such as your IP address and device information, and may store information on your device, under Google's privacy policy. Privacy-enhanced mode reduces tracking, but it doesn't stop it.
Legal basis: for the embedded preview, your consent, given by pressing play (art. 6(1)(a) GDPR). For delivering the guided audio you bought through the links in the PDF, performance of the contract (art. 6(1)(b) GDPR). You can avoid the embedded preview simply by not pressing play.
5. Cookies on the store
The store runs on Payhip, which uses cookies that are needed for the shop, cart and checkout to work, and for security. They are described in Payhip's Privacy & Cookies Policy (https://payhip.com/privacy).
We use no analytics, advertising or tracking tools on our website. Fonts are hosted on our own server.
6. Transfers outside the EU/EEA
- Payhip is based in the United Kingdom, which the European Commission recognises as providing adequate protection (UK adequacy decision).
- PayPal, Google and Netlify, Inc. (USA) may transfer data to the USA, and MailerLite may do so through its sub-processors. They rely on the EU-US Data Privacy Framework or on standard contractual clauses.
- Ask us if you'd like details.
7. Your rights
You have the right to:
- access your data;
- have it corrected or erased;
- restrict its processing;
- receive it in a portable format;
- object to processing that is based on our legitimate interests; and
- withdraw consent at any time, for the future. This doesn't affect processing that happened before you withdrew.
You can unsubscribe from the newsletter with one click in any email. For anything else, write to info@bodyawareness.ee. We reply within one month.
You may complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI), Tatari 39, 10134 Tallinn, Estonia, https://www.aki.ee, or to the data protection authority in the EU country where you live or work.
8. Changes
We update this policy when our tools or the law change. The current version and its date are always on this page.
Version 1.0. Body Awareness Center OÜ · reg. code 14148717 · Telliskivi tn 49-39, 10611 Tallinn, Estonia · info@bodyawareness.ee