Privacy & Data Policy — Bali Yoga Retreats

Effective Date: March 25, 2026 | Last Updated: March 25, 2026

Bali Yoga Retreats ('we', 'us', or 'our') is a Yoga Alliance registered yoga school and retreat centre located in Ubud, Bali, Indonesia. Since 2015, we have guided thousands of students from across the world through transformative Yoga Teacher Training Courses (200/300/500 Hour Multi-Style YTTC, Kundalini YTTC), specialised training programs including Ayurveda Yoga TTC, Yin Yoga TTC, Aerial Yoga TTC, Acro Yoga TTC, Kids Yoga TTC, and Prenatal Yoga TTC, as well as yoga retreats and workshops.

This Privacy & Data Policy governs how Bali Yoga Retreats collects, uses, stores, protects, and shares your personal information when you interact with our website (https://baliyogaretreats.org/) or engage with any of our programs. It has been prepared in accordance with the Information Technology Act, 2000, the IT (Amendment) Act, 2008, the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and India's Digital Personal Data Protection (DPDP) Act, 2023. For students and visitors from the European Union or European Economic Area, our practices are aligned with the General Data Protection Regulation (GDPR). For residents of California, we adhere to the California Consumer Privacy Act (CCPA).

1. Information We Collect

1.1 Information You Share With Us

When you register for a course, book a retreat, submit an enquiry, or contact us through our website or WhatsApp, we may collect the following:

• Full legal name, email address, mobile number, and nationality
• Country of residence and correspondence address
• Yoga background, experience level, and any health or medical disclosures relevant to participation
• Passport or travel document details required for residential program administration
• Selected program, course dates, preferred room type, and batch preferences
• Payment reference details — we do not store card numbers or banking credentials

1.2 Enrollment Consultation Data — Proponent Technologies Pvt. Ltd.

Part of the enrollment process for our programs is facilitated by Proponent Technologies Pvt. Ltd., our authorised enrollment consultation partner. During the pre-enrollment consultation stage, Proponent Technologies Pvt. Ltd. may independently collect personal data including your name, contact information, course preferences, and travel timeline. This data is used solely to deliver the enrollment consultation service and to coordinate your booking with Bali Yoga Retreats. Only information strictly necessary for enrollment processing is shared with us. Both entities operate independent data protection practices.

1.3 Automatically Collected Technical Data

When you visit our website, our systems automatically record technical information including your IP address, browser type, operating system, device identifiers, pages visited, session duration, and referring web addresses. This data helps us maintain website security, understand visitor behaviour, and improve our digital experience.

1.4 Communications Records

We retain records of all communications you submit through our website enquiry forms, email, and WhatsApp. These records are used exclusively for service delivery, administrative follow-up, and student support continuity.

2. How We Use Your Personal Data

Your personal data is processed solely for lawful, transparent, and directly relevant purposes, including:

• Processing course registrations and issuing enrollment confirmations for all YTTC, retreat, and workshop programs
• Communicating pre-arrival guidance, daily timetables, accommodation logistics, and important program updates
• Providing student support during and after your residential program in Bali
• Sending yoga insights, retreat news, and promotional content where you have explicitly opted in
• Analysing website traffic patterns to improve our content, course pages, and overall user experience
• Detecting and preventing fraud, security breaches, and technical disruptions
• Fulfilling our legal obligations under Indian law and applicable international data protection frameworks

3. Media & Photography Consent

By enrolling in any Bali Yoga Retreats program or retreat, you grant Bali Yoga Retreats a non-exclusive, royalty-free, worldwide licence to use photographs and videos captured during your course or retreat for promotional, educational, and marketing purposes across our website (https://baliyogaretreats.org/), social media channels (Facebook, Instagram, YouTube, Twitter/X, Pinterest), printed publications, and advertising materials.

This licence does not permit the sale or transfer of your images to unaffiliated third parties for their own commercial purposes. If you wish to withdraw media consent, please send a written request to info@baliyogaretreats.org. We will make all commercially reasonable efforts to remove identifiable images within 60 days of receiving your request, except where images are already embedded in printed or archived materials.

4. Legal Basis for Data Processing

4.1 Indian Law — DPDP Act, 2023

Under India's Digital Personal Data Protection Act, 2023, and associated IT Rules, we process your personal data on the basis of your informed consent, or as necessary to fulfil a lawful purpose directly connected to your enrollment in and participation in our programs.

4.2 GDPR — EU and EEA Residents

For students resident in the European Union or European Economic Area, we rely on consent, contractual necessity (enrollment processing), legal compliance, and legitimate interests — including the improvement of course delivery, safety, and student wellbeing — as the legal basis for processing your data.

4.3 CCPA — California Residents

We do not sell personal data under any circumstances. California residents may request access to, deletion of, or an opt-out from certain data processing activities by contacting us using the details at the end of this policy.

5. Sharing of Your Personal Data

5.1 Authorised Partners and Service Providers

We share your personal data only with entities that have a direct and necessary role in supporting your enrollment or program experience, including:

• Proponent Technologies Pvt. Ltd. — our authorised enrollment consultation partner, which independently processes student data as part of the pre-enrollment consultation service
• Payment gateway providers for secure processing of course fee transactions
• Website analytics providers including Google Analytics and Statcounter for traffic monitoring and performance analysis
• Email and communication platforms used for enrollment confirmations and program updates
• Social media platforms (Facebook, Instagram, YouTube, Twitter/X, Pinterest) — these platforms may independently place cookies and collect interaction data when you click on embedded social content or sharing buttons on our website; BYR does not actively transmit your personal data to these platforms

5.2 No Commercial Data Selling

Bali Yoga Retreats does not sell, lease, rent, or trade your personal data to any third party for marketing, advertising, or commercial purposes. All third-party partners who access your data are contractually bound to process it exclusively for the agreed purpose and in full compliance with applicable data protection laws. As an exception to this, analytics providers such as Google Analytics may, where you have explicitly consented to marketing cookies, use anonymised and aggregated interaction data within their own advertising platforms. This use is consent-gated and is disclosed fully in our Cookie & Accessibility Policy.

5.3 Legally Required Disclosures

We may disclose your data when required to do so by a court order, statutory authority, or government directive, or where necessary to protect the rights, safety, or property of Bali Yoga Retreats and its students.

6. International Data Transfers

Bali Yoga Retreats operates from Ubud, Bali, Indonesia, and its primary data processing infrastructure is based in India. Students enrolling from outside India should be aware that their personal data will be transferred to and processed in India. We take all reasonable steps to ensure such transfers comply with applicable data protection laws including India's DPDP Act, 2023, and — for EU/EEA students — the GDPR's data transfer safeguards.

7. How Long We Retain Your Data

We retain personal data for the duration necessary to fulfil the purposes described in this policy. Enrollment records, attendance data, and certification documentation are generally retained for a minimum of five (5) years following the completion of your program, in line with Indian legal and contractual record-keeping requirements. You may request deletion of your personal data at any time, subject to our legal obligations to maintain certain records.

8. Your Rights as a Data Principal

8.1 Rights Under the DPDP Act, 2023

• The right to obtain a summary of personal data held about you and how it is being processed
• The right to correct or update any inaccurate or incomplete personal information
• The right to withdraw consent for data processing at any time, subject to lawful obligations
• The right to nominate a trusted person to exercise your data rights on your behalf
• The right to raise a grievance with our designated Grievance Officer or the Data Protection Board of India

8.2 Additional Rights Under GDPR (EU/EEA Students)

Students resident in the EU or EEA additionally hold the right to erasure ('right to be forgotten'), the right to data portability, the right to restrict processing, and the right to object to processing where it is based on legitimate interests.

9. Age & Student Eligibility

All programs offered by Bali Yoga Retreats are designed for adults aged 18 years and above. Students aged 16 to 17 may be considered for enrollment upon submission of verified written consent from a parent or legal guardian prior to registration being confirmed. We do not knowingly collect or process personal data from individuals under the age of 16. For EU/EEA students, we comply with GDPR Article 8 requirements regarding parental consent for data processing of minors. If we become aware that data from a person under 16 has been inadvertently collected, we will take immediate steps to delete it securely.

10. Data Security

We implement industry-standard technical and organisational safeguards to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These include encrypted data transmission (SSL/TLS), role-based access controls, and regular internal reviews of our data handling practices. No system of digital transmission or storage is entirely risk-free, and we encourage all users to exercise appropriate care when sharing personal information online.

11. Official Communication Channels

Only information published on the official Bali Yoga Retreats website (https://baliyogaretreats.org/) and confirmed via our official email (info@baliyogaretreats.org) constitutes a binding representation by Bali Yoga Retreats. Information shared by third-party agents, travel blogs, aggregator platforms, review websites, or social media accounts not officially managed by Bali Yoga Retreats is not binding on us.

12. Changes to This Policy

We may revise this Privacy & Data Policy from time to time to reflect changes in applicable law, our programs, or our data practices. Material changes will be communicated to registered students via email or through a prominent notice on our website. The effective date at the top of this page will always indicate the most recent revision.

Contact Us

Bali Yoga Retreats
No 77 A, Jl. Bisma, Ubud, Kecamatan Ubud, Kabupaten Gianyar, Bali 80571, Indonesia
Email: info@baliyogaretreats.org
Phone / WhatsApp: +62 813 2881 810
Website: https://baliyogaretreats.org/