PRIVACY POLICY

Last update: 9th March 2025

Welcome to Baobab Yoga Therapy. We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy explains how we collect, use, process, retain and safeguard your Personal Data , including information gathered through our services, as well as our website, https://baobabyogatherapy.com (the “Site”), and other online platforms. By using our services and the Site, you agree to the terms of this Privacy Policy.

1. Definitions
   1. Personal Data means any information that enables any natural person also known as the Data Subject,to be identifiable, whether directly or indirectly, andwhich may include but shall not be limited to the Data Subject’s pronoun, name and surname, address, date of birth, age, height, weight, sex, gender, contact numbers, ID or passport number, email, address, occupation, and factors relating to the natural person’s physical, physiological, genetic, mental/psychological, economic, cultural or social identity.
   2. Processing refers to any activity performed on the Personal Data held by Baobab Yoga Therapy about its Clients and/or Service Users. This includes the collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, use, disclosure, dissemination or otherwise making available, restriction, erasure or destruction of such data.
   3. Restriction of processing is when Personal Data is deliberately marked for restrained processing in the future.
   4. Data Controller or Controller refers to the natural or legal person, authority, agency or other body which, determines the purposes and means of the processing of Personal Data, in this case referring to Baobab Yoga Therapy, any employees, teachers, representatives, partners, agents, affiliates, and/or any associated companies/persons that Baobab Yoga Therapy works with/for, now or in the future.
   5. Processor means a natural or legal person, authority, agency or other body which processes Personal Data on behalf of the Controller;
   6. Third Party means any natural or legal person, authority, agency or body other than the Data Subject, Controller, Processor or persons who, under the direct authorisation of the Controller or Processor, are permitted to process Personal Data;
   7. Consent of the Data Subject refers to the explicit and voluntary approval given by the Data Subject for the processing of their Personal Data, with such approval being given freely and in an informed manner, having received specific and unambiguous information as to the purpose and manner in which Personal Data shall be processed, signifying clear agreement to the processing of the same.
   8. Personal Data Breach is a breach of data security which leads to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise processed;
   9. Health Data refers to Personal Data associated with the physical or mental health of Data Subjects, providing insights into their health status, medical history, or healthcare needs.
   10. Cookies are small text files placed on your device to collect standard internet log data and information about your behaviour, preferences, and interactions while using Baobab Yoga Therapy’s website and other online platforms. These cookies may also store information related to your online identity. When visiting Baobab Yoga Therapy’s website, social media accounts, or any other digital platforms, we may automatically collect information through cookies or similar technologies. These technologies help us understand how you use our platforms and improve your experience. Service Users have the option to manage or disable cookies through their personal settings at any time, allowing them to clear or prevent the use of cookies on their devices.
   11. Activities, whether in the singular or plural form, shall be construed as referring to all and any services, including yoga and/or yoga therapy classes/sessions, workshops, retreats and/or other activities or events that are delivered, operated, organized, arranged, and/or sponsored by Baobab Yoga Therapy, and/or which in any way involve Baobab Yoga Therapy and/or any of the Released Parties. The interpretation of this Agreement shall not be affected by whether ‘Activities’ is used in singular or plural form.
   12. For the avoidance of doubt, references to “us”, “our”, “its”, “we” and ‘the studio’ shall refer to Baobab Yoga Therapy and/or any employees, teachers, representatives, partners, agents, affiliates and/or associated companies that Baobab Yoga Therapy works with/for, whether existing, currently in the process of being contracted, or contracted in the future.
       • Reference to “you”, “your”, “they”, “them”, “their”, “service user”, “digital platform user” and/or ‘website visitor’ shall refer to the Data Subject(s), clients and/or Digital Platform users to whom this policy applies.
2. Commitment
   1. Baobab Yoga Therapy is committed to protecting the privacy of its Clients and Service Users, including those who visit its website and online platforms. We ensure that all submitted information remains private, confidential, and is processed in accordance with the provisions of the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Data Protection Act (Cap 440). These regulations govern the processing of Personal Data, whether stored electronically or in manual form.
   2. This Privacy Policy (the “Policy”) sets out Baobab Yoga Therapy’s policy in relation to the protection, processing, retention, maintenance and disposal of its Clients’/Service Users’ Personal Data. It has been written deliberately to reflect the provisions of the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Data Protection Act (Cap 440). This Policy outlines the nature of, what, how and why Baobab Yoga Therapy collects, uses, processes and manages Personal Data collected also through its online platforms. Furthermore, Data Subjects are informed of their rights by means of this data protection declaration. The Policy details the nature and types of Personal Data we collect, the purposes and methods of processing, and how it is managed both through our services and online platforms. Additionally, it informs Data Subjects of their rights under applicable data protection laws.
   3. This Policy applies to the data protection of Personal Data relating to any natural person who:
      1. has purchased and/or is seeking to purchase any of the products/services offered by the studio;
      2. has visited any of Baobab Yoga Therapy’s online platforms, including but not limited to its website (https://baobabyogatherapy.com), social media accounts (such as Instagram, Facebook, etc.), or any other digital channels operated by Baobab Yoga Therapy.
      3. who has subscribed to the studio’s regular updates feature voluntarily by filling out the relevant form/s, whether in hardcopy, electronic or digital form. 
   4. Baobab Yoga Therapy is committed to processing Personal Data lawfully, fairly and in a transparent manner and thus only collects Personal Data which is adequate, relevant and limited to what is necessary in relation to the purposes listed in this Policy.
   5. If the processing of Personal Data is necessary and no statutory basis for such processing exists, Baobab Yoga Therapy is committed to ensure that Consent from the Data Subject is obtained beforehand.
   6. Baobab Yoga Therapy has implemented numerous technical, physical and organizational measures to ensure the comprehensive protection of Personal Data that is Processed by the studio.
   7. The details of the Data Controller shall be as follows:
      • Contact person: Nadia Camilleri 
      • Email: info@baobabyogatherapy.com
      • Tel: +356 79091766
3. ​What Personal Data do we Collect and How?
   1. Most of the Personal Data that we collect and process is directly and voluntarily provided by Clients themselves. This includes but shall not be limited to the following:
   2. Personal Information  
      1. Name and surname of clients and/or their parents/legal guardians where applicable;
      2. Address of clients and/or their parents/legal guardians where applicable;
      3. Date of birth and age of clients and/or their parents/legal guardians where applicable;
      4. Pronoun, sex and gender of clients and/or their parents/legal guardians where applicable;
      5. Height and weight of the client;
      6. Landline and mobile phone numbers of clients and/or their parents/legal guardians where applicable;
      7. Email address of clients and/or their parents/legal guardians where applicable;
      8. Occupation of the client and/or their parents/legal guardians where applicable;
      9. Name, surname, relation and contact of emergency contacts;
      10. Doctor’s name and contact information;
      11. Past and existing medical and health history, including conditions, injuries, and any relevant biological, physical, psychological, emotional, spiritual, and social aspects of a person as required by Baobab Yoga Therapy. This includes, but is not limited to, diagnoses, treatments, allergies, phobias, and any other relevant information indicated on the Client Registration Form, Client Intake, Physical/Breath Assessments, and ongoing discussions with the Client for safe practice. Specific areas of inquiry may encompass information relating to:
          • Cardiovascular, respiratory, digestive, endocrine and immune systems
          • Cancer, musculoskeletal, and nervous system conditions
          • Trauma, sleep patterns, and lifestyle factors
          • Family health history, relationships with close ones (e.g., family, spouse, friends, children, parents), and social life where and as applicable for the tailored approach to the individual client’s needs
          • Work, school, studies, hobbies, and leisure activities
      12. Name of persons who recommended the studio’s products/services
      13. Payment information (if applicable)
      14. CCTV recordings for security purposes
   3. Automatically Collected Information:
      1. When you visit the Site, we may automatically collect certain information, including:
         • IP address
         • Browser type and version
         • Operating system
         • Pages visited
         • Time and date of visits
         • Referring website
   4. Cookies and Tracking Technologies:
      1. Why: We may use cookies, web beacons, and similar technologies to enhance your experience on the Site, analyse trends, and administer the Site effectively. These technologies help us understand user behaviour, improve site functionality, and personalize your experience. Cookies also help recognize Data Subjects’ devices to avoid requiring the same information repeatedly. You can control and manage cookies through your browser settings, allowing you to accept, reject, or delete cookies according to your preferences.
      2. Types of Cookies We Use: Cookies are used for a variety of purposes to improve users’ experience of the website. These purposes include, but are not limited to:
         1. Authentication: Keeping Data Subjects logged in, where applicable;
         2. Shopping Experience: Remembering items in clients’ online shopping baskets and past purchases, where applicable;
         3. Functionality: Storing preferences such as language settings and providing location-specific information. A combination of first-party and third-party cookies is used;
         4. Advertising: Collecting data about your visit to our online platforms, the content you viewed, links you followed and information about your browser, device and IP address. This data may be shared with third parties to tailor advertising based on your interests;
         5. User Behaviour Analysis: Understanding how Service Users navigate and interact with our website and online platforms to improve functionality and experience. Cookies also collect, measure, and analyse statistical information about website traffic and usage.
         6. Additionally, cookies may collect the following information:
            • Browser Information: Browser type, language, and history.
            • Device Information: IP address, device make and model, operating system/version, and data connection type.
            • Internet Service Provider Information: Data about your internet service provider.
            • Interaction Information: Domain name, referring website address, date/time of website visit, page views, search keywords, referring/exit pages, platform type, geolocation data, click data, and types of ads viewed.
      3. How to manage cookies: Baobab Yoga Therapy’s website requests Data Subjects’ acceptance for the use of such cookies. You can set your browser not to accept cookies. The following website also provides detailed information on how to remove cookies from your browser: https://allaboutcookies.org/. When disabling cookies, some of our website and / or digital platform features may not function as intended.
   5. Social Networking Activities
      1. The studio’s website allows Service Users to link to social networking websites. Consequently, Personal Data may be collected when Service Users choose to post or otherwise share information related to the studio on these social networking websites. We may also receive Personal Information about Service Users from their social networking account depending on their privacy setting for that account. Such may include name, profile picture, age, gender, country and other public information. Service Users can control the information accessible by the studio by adjusting their privacy setting on their social network accounts.
   6. Surveys, Contests and Other Promotions
      1. Service Users may opt to participate in surveys, contests and/or other promotions presented by Baobab Yoga Therapy on its website and/or digital platforms, wherein they may be requested personally identifiable information such as their name, contact information, age, demographics, and/or other similar details to participate. They would also submit information connected with the survey, contest and/or other promotion. Participation is completely voluntary and Service Users can therefore choose whether to disclose personally identifiable information.
      2. Baobab Yoga Therapy may use third parties to administer surveys, contests and/or other promotions. Information provided by Service Users may be shared with them in accordance with this Privacy Policy.
      3. Participation in any surveys, contests and/or other promotions is subject to each of their individual terms and conditions which will be posted accordingly. Winners may be required to provide additional information which they may choose to provide or otherwise, albeit non-provision may render the studio unable to proceed with delivering the award.
   7. Interactive Forums
      1. Baobab Yoga Therapy may host online communities, message boards, chat rooms, blogs, and other interactive forums or services (each, a “Forum”), where Service Users may post content, comment, and/or otherwise communicate with others. Should Service Users choose to participate in a Forum, they may be asked to submit demographic information, such as social links, bio, languages, professional associations, areas of expertise, professional specialties, and profile photo. Demographics are pieces of information that help Service Users to identify themselves or others, and can power ‘Networks’ which Service Users can use to find others by common interests. Baobab Yoga Therapy may also send Service Users targeted communications based on their engagement and the information they submit, subject also to their settings and this Privacy Policy. Participation and thus disclosure of personally identifiable information on Forums is completely voluntary.
   8. CCTV Cameras
      1. Baobab Yoga Therapy and/or its Partners have CCTV cameras installed on their premises. Data Subjects are informed that the installation of such cameras is solely for security purposes and by no means to monitor the movement of clients or other persons, unless such need arises for the same reasons. For the sake of clarity, security refers to the safekeeping of any assets within the premises as well as the personal physical security of anybody walking into the studio’s premises.
      2. Data collected through such CCTV systems are accessed only in the event of security incidents and on a need-to-know basis by authorized persons. These data may be divulged to third parties, such as law enforcement agencies, in the event of such security incidents.
      3. Data captured by the CCTV systems is stored in visual form on a separate hard disk and is overwritten on a regular basis for security purposes. The retention and overwriting period may vary, but the data is not stored for longer than necessary to fulfil its security function.
4. How is data collected.
   1. Data is generally collected through:
      1. Enrolment Forms: Personal data is collected through voluntary completion of enrolment forms by prospective and existing clients, either in hard or soft copy. These forms typically include essential details required for safe practice and tailored services as noted above. Prospective clients are informed that while they have the right to refuse to complete these forms, doing so may prevent them from accessing the Data Controller’s services.
      2. Participation in Activities: Personal data is collected when clients voluntarily participate in Activities related to Baobab Yoga Therapy, such as intakes, evaluations, classes, or sessions. This may require gathering personal data, as noted in 3.1, to support the personalized service process.
      3. Engagement with Online Platforms: Data is collected when clients engage with Baobab Yoga Therapy’s Digital Platforms, including websites, social media, and online forums. This includes both active participation (e.g., comments, likes, interactions and inquiries) and passive data collection (e.g., cookies, analytics).
      4. Online Registration and Orders: Data is collected during online registration for services or products, including personal, payment, and contact information necessary to process bookings and/or purchases.
      5. Subscription to Updates: Clients can voluntarily subscribe to receive updates, newsletters, and promotional information. In doing so, personal contact information, preferences, and interests may be collected to ensure relevant communications.
      6. Participation in Surveys, Contests, and Other Promotions: Data may be collected through voluntary participation in surveys, contests, and other promotional activities organized by Baobab Yoga Therapy. This can include personal details such as name, contact information, age, demographics, and other relevant information that helps improve the services and offerings based on user feedback. Participation in such activities is completely optional, and individuals have the choice to provide or withhold Personal Data.
      7. Website Interaction via Cookies: Data is automatically collected via cookies and tracking technologies when Clients view or interact with Baobab Yoga Therapy’s website or digital platforms. This includes information such as browser type, device information, IP address, and interactions with content (e.g., page views, time spent on pages, etc.).  These technologies help us improve website functionality, enhance user experience, and tailor our services.
      8. CCTV Recordings: Personal Data may also be collected through CCTV cameras installed on Baobab Yoga Therapy’s or its Partner’s premises for security purposes. These cameras capture video footage that is used solely for ensuring the safety of the clients, staff, and property.
      9. Third-Party Sources: Information may also be collected from Third Parties, such as referrals from clients, social media accounts, or external platforms. In these cases, personal data will be collected according to the privacy settings and preferences set by the client on those platforms. Referral from clients” in this context refers to situations where an existing client recommends or refers someone to Baobab Yoga Therapy. This could happen in several ways:
         1. A client shares the studio’s contact information with a friend, who then reaches out.
         2. A client provides the name and basic details of a potential client (with their consent).
         3. A client connects the studio with someone seeking services, such as by sending an inquiry on their behalf.
         4. A client tags someone in a post or comments their name on social media.
   2. This multi-channel approach allows Baobab Yoga Therapy to collect accurate and relevant data essential for delivering personalized services, maintaining safety, and enhancing the overall client experience. All data collection practices are carried out with a commitment to privacy, transparency, and compliance with applicable data protection regulations..
5. Why Does Baobab Yoga Therapy Process Personal Data?
   1. We may use your information for the following purposes:
      1. To enter into a therapeutic relationship;
      2. To enable the studio to contact the client, clients’ parent/s, legal guardian, emergency contact/s and/or physician as needed from time to time;
      3. To address the client in line with the client’s identity;
      4. To assist clients in the event of an emergency where and as applicable;
      5. To identify who will be attending any of the Activities organised by the studio;
      6. To communicate any announcements relating to the products/services, surveys, contests and other promotions they show interest in;
      7. To identify Data Subjects Or authenticate their identity;
      8. To process orders and manage users’ account as required;
      9. To provide and maintain the service offered by the studio;
      10. To improve Data Subjects’ experience as users of our digital platforms personalising your experience.
      11. To provide customer care and support;
      12. To process payments and bookings (if applicable)
      13. For marketing purposes where Data Subjects voluntarily subscribe to receive such material;
      14. To enable the studio to present offers to recommending clients where and as applicable;
      15. For research and analytical purposes to enable Baobab Yoga Therapy to improve its content, services and products and monitor the usage of the service;
      16. To detect, prevent and address technical issues while managing and facilitating the operation and security of the Website and online platforms;
      17. To prevent fraudulent purchases where possible;
      18. To comply with legal obligations
      19. To allow participation with interactive features of the studio’s service;
   2. Should Baobab Yoga Therapy need to process Personal Data for reasons, other than those noted above, the studio endeavours to request the Data Subjects’ consent, which consent may be withdrawn at any time, provided that the withdrawal of consent shall not affect the lawfulness of processing based on consent provided before its withdrawal. Consent will to the largest extent possible be obtained in writing, providing that exceptions may apply based on the use of digital technologies, and depending on the individual circumstances of the Service User.
   3. In view that our online platforms make use of cookies, cookies are furthermore used to deliver the following services on our website:
      • To recognise Data Subjects’ device/s to avoid them from having to provide the same information repeatedly;
      • To select and deliver content that is interesting and relevant to Data Subjects including news and updates;
      • To detect and track fraudulent or illegal activity;
      • To enhance your experience on the Site,
      • To administer the Site effectively. 
      • This is in addition to the information outlined in Clause 3.3, where further details regarding data collection from Cookies and their usage are specified.
   4. Baobab Yoga Therapy’s website relies on third party service providers (such as hosting and server co-location services, communications and content delivery networks (CDNs), data and cyber security services, billing and payment processing services, domain name registrars, fraud detection and prevention services, web analytics, etc, who in turn make use of their own cookies. Baobab Yoga Therapy thus notifies its Clients and Data Subjects that such third-party services placing cookies or utilizing other tracking technologies through our website may have their own policies regarding how they collect and store information. Such practices are not covered by Baobab Yoga Therapy’s Privacy Policy, and though we undertake to ensure that related agreements are entered into where legally necessary or possible, the studio does not have any control over such third parties and shall thus not accept any responsibility for any deficiency in such other parties’ practices.
   5. Baobab Yoga Therapy’s website makes use of Google Analytics, to provide statistical information about use and traffic on the website.  These services use IP addresses and other information from cookies to provide, for instance, the number of page views, number of users, what browsers users are using, and location data of users. This statistical information allows Baobab Yoga Therapy to better understand its audience/s, reach its target audience and develop and customise its content and services accordingly. With regards to analytics, Personal Data is collected and processed on the basis of the studio’s legitimate business and operational interest. For more information about how Google uses information from sites or apps that use their services, one may refer to their Privacy & Terms web page by clicking here or visiting: https://policies.google.com/technologies/partner-sites?hl=en-GB&gl=uk
6. How is data stored?
   1. Data and information are stored securely on the studio’s computers, with data and devices (including computers and laptops) being password-protected to ensure added security. Passwords are restricted to authorized personnel on a need-to-know basis, and this also applies to Personal Data. Hard copy forms are stored in locked and secure filing systems to ensure they are only accessible by authorized personnel.
7. For How Long Is Data Stored?
   1. Unless otherwise requested by Data Subjects, Personal Data is retained indefinitely for potential future reference regarding the medical history of the individual, should the individual decide to make use of Baobab Yoga Therapy’s services again in the future. However, after five years, access to Personal Data will be further restricted by placing it in a separate, secure folder for added protection. Data Subjects will nonetheless have the right to request erasure, restriction of processing, or updates to ensure the accuracy and completeness of their Personal Data.
   2. In the event that Data Subjects exercise their right of erasure, Baobab Yoga Therapy will erase the data in line with the respective regulations and within the stipulated timeframes.
   3. Subject to the studio being informed, Personal Data will be retained for a maximum of two years in an archived format after the individual’s passing. This period allows for any necessary legal or administrative follow-ups. After this period, the data will be completely erased or securely shredded, in accordance with applicable laws and regulations regarding data retention and the rights of Data Subjects posthumously. Access to this data during the retention period will only be granted subject to legal access requirements in line with relevant laws, and only upon the necessary presentation of appropriate documentation.
8. Data Protection Rights
   1. Baobab Yoga Therapy respects its Clients’ privacy and ensures that Clients are aware of their rights as noted below:
      1. The Right to Access Personal Data: Data Subjects may request from Baobab Yoga, details about the data held about them. Baobab Yoga Therapy will revert within the stipulated timeframes in line with the GDPR.
      2. The Right to Data Rectification: Data Subjects may requestto have their data updated for accuracy purposes. In the event of incomplete information, Data subjects may request to have such data completed also for accuracy purposes.
         1. Baobab Yoga Therapy takes every reasonable step to ensure that the Personal Data it holds is accurate and correct. Therefore, it asks Data Subjects to assume responsibility to ensure that Personal Data held by the studio is correct and accurate, conveying any updates as and when necessary. The studio undertakes to take all necessary action thereafter to ensure that such data is updated in all formats and places where such data is held, although the studio also ensures that data is minimalized for security purposes, minimising therefore the risks of accessibility by unauthorised persons.
      3. The Right to Data Erasure/Right to be Forgotten: Data Subjects may request Baobab Yoga Therapy to erase their Personal Data. Personal Data will be erased as soon as possible, provided that such Personal Data are no longer necessary in relation to the purposes for which they were collected or processed, this being specified in section 7 of this policy.
         1. Should a request for data erasure be made, then the studio may need to terminate the business relationship with the individual in question, any subscriptions that were previously voluntarily activated, any correspondence relating to updates regarding offers that may have been previously communicated as well as that relating to other updates in relation to the studio’s products and services and the business relationship.
         2. When consent is withdrawn and/or a request for data erasure is made, data held in hard copy format is shredded while data held in soft copy format is erased in such a way to ensure that this cannot be retrieved and/or accessed by any natural persons other than those authorised.
         3. While the studio endeavours to erase data within the regulatory time period, some data may need to be retained for longer periods for security purposes, as may be the case for CCTV recordings, which, though regularly overwritten, may be held for varying periods depending on the place of operation. This is one such instance but not exhaustive. When data cannot be erased within the regulatory time frame, it will be erased as soon as possible, and the exact timing for erasure will be determined on a case-by-case basis. The Data Subjects will be notified as soon as the data is erased, for confirmation purposes.
         4. The Data Controller shall have the obligation to erase Personal Data without undue delay where one of the following grounds applies, as long as the processing is not necessary:
            • The Personal Data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
            • The data subject withdraws consent;
            • The data subject objects to the processing and there are no overriding legitimate grounds for the processing;
            • The Personal Data have been unlawfully processed;
            • The Personal Data must be erased for compliance with other legal obligations;
            • The Personal Data have been collected in relation to the offer of information society services referred to in Article 8(1) of the GDPR.
         5. Data Subjects may manage or prevent cookies from being installed on their device/s by adjusting the settings on their browser, although Baobab Yoga Therapy advises that by doing so, website and online platforms functionality may be limited.
      4. Right to Restrict Processing: Data Subjects may also request that Baobab Yoga Therapy restricts processing of their Personal Data in the following situations:
         • the accuracy of the Personal Data is contested, restricting therefore the processing of data until such time as to verify the accuracy of the Personal Data;
         • the processing of data is unlawful and the Data Subject opposes the erasure of the Personal Data held by the studio, requesting instead that the studio simply restricts its use;
         • Baobab Yoga Therapy no longer needs the Personal Data for the purposes of the processing, but is required by the Data Subjects to establish, exercise or defend legal claims;
         • The data subject has objected to processing pending the verification as to whether the legitimate grounds of the controller override those of the data subject;
         • Should Baobab Yoga Therapy proceed to restrict the processing of Personal Data pursuant to any of the grounds listed in the preceding section, the studio shall, as the Data Controller, inform the Data Subjects making such a request in writing before the restriction of processing is lifted.
      5. Right to Data Portability: Data Subjects may request to have their Personal Data transferred to them or to another Data Controller designated by themselves. This will be released in a structured, commonly used and machine-readable format. In exercising their right to data portability, Data Subjects may upon request have their Personal Data transmitted directly from one Data Controller to another, where technically feasible and when doing so does not adversely affect the rights and freedoms of others.
      6. The Right to Object to Processing: Data Subjects have the right to object to the processing of their Personal Data by Baobab Yoga Therapy at any time. In cases where Data Subjects exercise this right, Baobab Yoga Therapy will cease processing their Personal Data, unless there are compelling legitimate grounds for continuing the processing. Such grounds may include the necessity for the processing to meet the establishment, exercise, or defence of legal claims, or where the legitimate interests of Baobab Yoga Therapy override the interests, rights, and freedoms of the Data Subjects.
         1. This right also applies to profiling to the extent that it is related to direct marketing. Data Subjects can exercise this right by unsubscribing from marketing communications at any time. This can be done by clicking the “unsubscribe” link in the footer of any marketing email, or by submitting a written request via email with the word “unsubscribe” in the subject line, specifying which content or subscription they wish to opt out of.
         2. While Baobab Yoga Therapy can control the sending of marketing communications and ensure that unsubscribing requests are honoured, Data Subjects should be aware that certain data may be automatically collected through digital technologies, such as cookies, website analytics, or third-party tracking tools. These technologies may collect data for purposes such as website functionality, performance improvements, or analytics, which may not be fully under our control. Data Subjects have the ability to manage their preferences for these technologies through their browser settings or the specific cookie consent options provided on our website.
      7. Should Data Subjects wish to exercise any of the above rights, they are kindly requested to contact the Data Controller in writing, as noted in section 2.7. Data subjects must submit their ID number, full name and address with the request, in line with section 10.
      8. The studio is committed to reply to Data Subjects’ requests as promptly as possible and in line with the associated regulations’ timeframes, unless there is good reason for delay. When requests cannot be met within a reasonable timeframe, the reason will be explained in writing to the Data Subject who is making the request.
      9. The right to lodge a complaint with a supervisory authority: Should Data Subjects feel that their rights under the GDPR and Data Protection Act have been violated by Baobab Yoga Therapy, they may lodge a complaint with the relevant supervisory authority for data protection in Malta, this being the Data Protection Commissioner (https://idpc.org.mt).
      10. The Information and Data Protection Commissioner
          • Address: The Information and Data Protection Commissioner may be contacted at:
          • Level 2, Airways House,
          • High Street, 
          • Sliema  SLM 1549
          • Telephone:  23287100 
          • Email:  idpc.info@gov.mt
      11. Baobab Yoga Therapy however, encourages and welcomes the opportunity, and makes every effort to satisfactorily deal with Data Subjects’ complaints amicably before approaching any such supervisory authority, also to ensure client satisfaction.
9. Basis of Data Processing
   1. Data is processed on the basis of the following principles:
      1. the data subject has given consent to the processing of one’s own Personal Data for one or more specific purposes, although such consent may be withdrawn at any time in accordance with this Privacy Policy.
      2. for the provision of products and/or services delivered by Baobab Yoga Therapy, essentially considered a contract to which the Data Subject is party, or to take steps at the request of the Data Subject prior to entering into a contract;
      3. for compliance with a legal obligation to which Baobab Yoga Therapy as the Data Controller is subject;
      4. to protect the vital interests of the Data Subject or of another individual;
      5. to perform a task in the interest of the public or in the exercise of official authority vested in the controller;
      6. to protect the legitimate commercial interests pursued by the studio or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the Data Subject which require protection of Personal Data, in particular where the data subject is a minor. Baobab Yoga Therapy processes data to run a lawful business and to promote and innovate that business while preventing fraud or criminal activities.
10. Consequences of Not Providing Personal Data
    1. Data Subjects have every right not to provide the studio with Personal Data however, this may entail that a business relationship cannot be entered into and that transactions may thus not be effected. As noted above, data is collected to also protect the individual interests of those who enter into a business relationship with Baobab Yoga Therapy and thus such data is otherwise required.
    2. The consequences of exercising data protection rights are communicated in section 8.
    3. By using or accessing the studio’s products/services and/or digital platforms, Data Subjects agree to this Privacy Policy. Should they not agree to the terms of this Privacy Policy, they are advised/encouraged not to use or access the studio’s products/services and/or digital platforms.
11. Data Security
    1. Data Subjects’ Personal Data will be processed in accordance with the provisions of the GDPR. Baobab Yoga Therapy takes appropriate precautions and reasonable measures to preserve Data Subjects’ rights and to prevent any access, alteration, disclosure, or destruction, corruption, loss, or damage of Personal Data.
    2. Should Data Subjects exercise their rights as detailed in section 8, Baobab Yoga Therapy will request confirmation of identification prior to proceeding with the request to ascertain that the request is being made by the Data Subjects to which the Personal Data relates, preventing therefore any malicious requests. Confirmation of identification is made by requiring one’s ID number, full name and address to be submitted with each request. The studio may also request copies of identification documentation and/or query the person with questions that relate to the Data Subject in question, without divulging Personal Data. As added security.
    3. Baobab Yoga Therapy invests in software that supports cyber security. In the event that the studio’s systems are compromised and suffer a data breach whereby the Personal Data of clients and Data Subjects become exposed, Baobab Yoga Therapy undertakes to promptly inform the Data Subjects in question and the Office of the Data Protection Commissioner in Malta.Baobab Yoga Therapy’s representatives may access Personal Data strictly on a “need to know/use” basis for the performance of their duties.
    4. Baobab Yoga Therapy representatives are aptly aware of the confidential nature of Personal Data and how they should handle it to ensure it is collected, processed, managed and erased in strictest confidence and with utmost security. All personnel involved in data processing are obliged to comply with the data protection laws. The studio’s security measures are constantly being revised in line with technological developments.
    5. Data transmission over the internet cannot be completely secured from third-party access. Baobab Yoga Therapy, processes Personal Data in a manner that ensures appropriate security in line with this policy and the relevant stipulated regulations to protect Data Subjects against unauthorised or unlawful processing and against accidental loss, destruction or damage. However, the studio’s website is run on software, hardware and networks, any component of which may, from time to time, require maintenance and/or experience problems and/or breaches of security beyond the studio’s control.
    6. Service users are thus advised that despite the studio’s best intentions and guidelines outlined in this Privacy Policy, no data transmission over the Internet, encryption method or electronic storage can be guaranteed to be 100% secure.Service users are responsible for maintaining their security settings and the confidentiality of their privacy details including username and password, as may be applicable.
    7. Baobab Yoga Therapy does not sell, trade, rent, or share Personal Data about its clients and/or service users to any third parties, unless otherwise stipulated herein or with the express and written consent of the individual. This includes, but is not limited to, any attempts to exchange or lease Personal Data for commercial purposes.
12. Is Personal Data Disclosed to Third Parties?
    1. Where necessary, Baobab Yoga Therapy may need to disclose Data Subjects’ Personal Data to third parties, however, only the necessary data would be disclosed on a need-to-know basis. Baobab Yoga Therapy purposely selects and shares only the data that is required for the processing task at hand rather than all the Personal Data about a Data Subject. Baobab Yoga Therapy uses such third parties to assist in the processing of data for financial and accounting purposes, administrative, ICT and/or marketing.
    2. Personal Data may be made accessible or passed on to the following third parties in the following instances:
       • To employees, teachers, representatives, partners, agents and/or any associated companies/persons that Baobab Yoga Therapy works with/for, whether existing or in the future to ensure data subjects’ safety through modified and adapted practices in accordance with individual needs.
       • To service providers: Baobab Yoga Therapy may, for instance, engage a supplier to carry out professional, administrative and/or operational work in support of its relationship with its clients (ex: online payment processing service providers, survey and contest administration, marketing partners, analytics and research service partners, accountants etc).
       • To government, police, regulators or law enforcement agencies in the unlikely event that the studio deems such disclosure legally obligatory or prudent to do so, provided that the Personal Data requested is necessary by the said public authority/regulator/s to carry out a particular inquiry in the general interest, in accordance with European Union or Member State law. Baobab Yoga Therapy may also disclose Personal Data if it becomes legally obliged to do so, in pursuance of a judgment or court order, to enforce the studio’s Terms of Use and/or protect its rights.
       • To third parties who assist the studio with the development and enhancement of its services, (ex: analytics providers), and with ascertaining that the studio is effecting its services in as correct a manner as possible (ex: third parties engaged to support the studio in protecting IT systems and other business-related functions).
       • To medical practitioners: in case studio representatives would need to communicate with Data Subjects’ medical practitioner/s in the interest of the Data Subjects, then Personal Data may need to be disclosed, if deemed necessary by the studio for the well-being of the Data Subject/s in question, although consent would normally be obtained from the Data Subject before doing so.
       • To collaborating partners to enable the studio to deliver as holistic a service as possible in a safe and efficient manner and/or to better the service to its clients, in support of its relationship with its clients.
    3. Our website is built by NB Marketing, who use their own platforms and hosting services for the development and technical maintenance of the site. The website allows us to sell or market our products and services to you. Your data may be stored through NB Marketing’s hosting platforms, data storage, databases, and related applications. These platforms employ secure servers and data security policies to protect your information.​
    4. Such service providers are permitted to use the information to provide the services to Baobab Yoga Therapy but are contractually not permitted to use the information for their own unrelated purposes, except as stipulated within this policy.
    5. When Baobab Yoga Therapy shares personal information with third parties, the studio requires such third parties to respect the security of its clients’ and Data Subjects’ Personal Data, by entering whenever possible into agreements stipulating the need to respect such security of Personal Data, and to treat it in accordance with the GDPR and Data Protection Act. However, Data Subjects are informed that such third parties’ own privacy policy will normally apply in regards to how they subsequently use such personal information, and Baobab Yoga Therapy cannot therefore be held responsible for their actions. Baobab Yoga Therapy does not endorse and is not responsible for the information practices or privacy policies of websites operated by others that may be linked to its website, including the websites of its partners and sponsors. Service users should thus consult each website’s privacy policy.
    6. This Privacy Policy governs only information that Baobab Yoga Therapy collects/processes. It does not govern other websites, services or applications that do not link to this Privacy Policy or that are maintained or controlled by other companies or organizations, including third party websites linked to/from the studio’s Website. The inclusion of a link or reference on the studio’s website and/or online platforms does not imply endorsement of the linked website by the studio.
13. Transferring Personal Data Outside The EEA
    1. There may be instances where Data Subjects’ Personal Data may need to be transferred and processed in one or more non-EEA countries. In any such instances, Baobab Yoga Therapy will take all the necessary steps to ensure that Personal Data receives the same level of protection as though it remained within the EEA, including by entering into data transfer agreements, using the European Commission’s approved contractual clauses for data transfers to third countries, or by relying on certification schemes such as the EU – US Privacy Shield or other valid mechanisms for data transfers wherever possible.
    2. Data Subjects may request information on the protective measures implemented for any third country transfers of Personal Data. Data Subjects should note, however, that third party service providers may transfer Personal Data outside the EEA in accordance with their own practice, and in such instances, Baobab Yoga Therapy cannot be held responsible for this.
14. Notifying Changes to this Policy
    1. Baobab Yoga Therapy keeps its Privacy Policy under review. Clauses within this Policy may be amended from time to time. Baobab Yoga Therapy undertakes to publish the updated version of this Policy on its website and/or online platforms. The studio recommends its clients and Service Users to consult with this Privacy Policy on a regular basis. The date when the privacy policy was last updated will be indicated with each revision. Changes will become effective immediately and thus the studio uses Personal Information according to the terms of the Privacy Policy in effect at the time of Personal Data use.
    2. Data Subjects may also request a hard copy of this Policy at any given time.
15. Minor’s Privacy
    1. Our Digital Platforms are not intended for individuals under the age of 16. We do not knowingly collect personal information from children. If we become aware that we have collected such information, we will take steps to delete it.
16. Governing Law
    1. By choosing to use Baobab Yoga Therapy’s products and services, visit our digital platforms, or provide any information to us, Service Users agree that any disputes related to privacy or the terms outlined in this Privacy Policy will be governed by the laws of Malta. Service Users further agree to comply with all and any Terms and Conditions, Privacy Policy available at www.baobabyogatherapy.com, or other agreement that we have with the Service User.

Thank you for trusting Baobab Yoga Therapy with your personal information.

_____

Update History:

• 21^st November 2019
• 19^th April 2023
• 18^th August 2024
• 9^th March 2025