1. Controller
Gina-Marie Malling, trading as Prana Soul
FULL POSTAL ADDRESS IN THAILAND
Email: pranasoulretreats@gmail.com
2. Website hosting and access data
The final hosting provider may process technical access data such as IP address, date and time, requested page, browser information and server logs to deliver and secure the website. Before launch, add the provider, server location, processing agreement and actual retention period here: HOSTING PROVIDER + PRIVACY LINK + LOG RETENTION.
3. Enquiries and free consultations
If you contact Prana Soul, the information you provide — typically your name, email address, selected area of interest and message — is used to respond and to take steps requested before entering into a service agreement. Depending on the context, processing is based on Article 6(1)(b) GDPR or Article 6(1)(f) GDPR.
Please share only information that is necessary. If you voluntarily provide health information or other special-category data, it must only be processed with an appropriate Article 9 GDPR condition. Before launch, the enquiry form and operational process must be checked and, where required, an explicit-consent mechanism added.
4. Group-class reservations
For a class reservation, Prana Soul processes the name, email address, selected class or pass, date, amount, booking reference, reservation status and payment-confirmation status. This is necessary to administer the requested booking under Article 6(1)(b) GDPR. Bank details are processed by the banks involved in the transfer under their own terms.
5. Email communication
Messages and manually sent confirmations are handled through the chosen email provider. Complete before launch: EMAIL PROVIDER, PROCESSING LOCATION, PRIVACY LINK AND SAFEGUARDS.
6. Web fonts and external content
The current draft uses externally loaded Google Fonts. A visitor's browser may therefore connect to Google and transmit technical data such as the IP address. Before launch, these fonts should preferably be hosted locally; otherwise Google must be listed as a recipient with the applicable legal basis, transfer safeguard and privacy information. Any future maps, videos, social-media embeds or externally hosted images must be audited and, where required, blocked until valid consent has been given.
7. Recipients and international transfers
Personal data is shared only where necessary with service providers used to host, secure or communicate through the website, or where required by law. Because Prana Soul operates from Thailand and may use providers outside the EEA, the final policy must identify relevant international transfers and the applicable safeguards, such as an adequacy decision or standard contractual clauses.
8. Retention
Enquiry and booking data is kept only as long as needed for the relevant purpose and any applicable legal record-keeping duties. Insert the actual deletion schedule before launch: ENQUIRY, UNSUCCESSFUL RESERVATION, CLIENT AND INVOICE RETENTION PERIODS.
9. Your rights
Subject to the legal requirements, you may have rights of access, rectification, erasure, restriction, data portability and objection. Where processing is based on consent, consent can be withdrawn for the future. You may also lodge a complaint with a competent data-protection supervisory authority.
Competent authority/contact to add after the final establishment and target-market assessment: SUPERVISORY AUTHORITY.
10. Images of identifiable people
Where genuine photographs identify a person, publication is based on the relevant permission or another applicable legal basis. AI-generated illustrative people are not presented as clients. Information about image sources and generated content is provided in the image notice.
11. Security and updates
Reasonable technical and organisational measures are used to protect personal data. This notice will be updated if the website, providers, booking process or legal requirements change.
Draft status: 6 August 2026