GDPR Compliance Information

Last updated: August 14, 2026

Our Commitment to Data Protection

Nordic Yoga Studio is committed to complying with the General Data Protection Regulation (GDPR) and protecting your personal data. This page provides detailed information about your rights and how we handle your information.

Data Controller

Nordic Yoga Studio acts as the data controller for personal information collected through our website and services. We determine how and why your personal data is processed.

Contact details:
Nordic Yoga Studio
Drottninggatan 45
111 21 Stockholm
Sweden
Email: [email protected]

Your Rights Under GDPR

Right to Access

You have the right to request a copy of the personal data we hold about you. We will provide this information in a structured, commonly used, and machine-readable format within one month of your request.

Right to Rectification

If you believe any personal data we hold about you is inaccurate or incomplete, you have the right to request correction. We will update the information promptly upon verification.

Right to Erasure

Also known as the "right to be forgotten," you can request deletion of your personal data when:

• The data is no longer necessary for the purposes it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed
• Legal obligations require erasure

Right to Restriction of Processing

You can request that we limit how we use your personal data in certain circumstances, such as when you contest the accuracy of the data or object to processing.

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used format and to transmit it to another data controller where technically feasible.

Right to Object

You may object to processing of your personal data based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds.

Right to Withdraw Consent

Where we process your data based on consent, you have the right to withdraw that consent at any time. This does not affect the lawfulness of processing based on consent before withdrawal.

Right to Lodge a Complaint

If you are dissatisfied with how we handle your personal data, you have the right to lodge a complaint with the Swedish supervisory authority:

Integritetsskyddsmyndigheten (IMY)
Box 8114
104 20 Stockholm
Sweden
Website: www.imy.se

How to Exercise Your Rights

To exercise any of your rights, please contact us at [email protected] with the following information:

• Your full name and email address used for registration
• Clear description of the right you wish to exercise
• Any supporting information to help us process your request

We will respond to your request within one month. In complex cases, this period may be extended by two additional months, and we will inform you of any such extension.

Data Processing Activities

Types of Data We Process

• Identity data: name
• Contact data: email address
• Service data: class registrations, preferences, booking history
• Technical data: IP address, browser type, access times

Purpose of Processing

• Providing yoga and meditation services
• Managing class registrations and scheduling
• Communicating about services and updates
• Responding to inquiries and providing support
• Improving our services and website

Legal Basis for Processing

• Consent for marketing communications
• Contractual necessity for service delivery
• Legitimate interests in business operations and service improvement
• Legal obligations under Swedish and EU law

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, including legal, accounting, or reporting requirements. Retention periods vary based on:

• Active customer relationships: duration of relationship plus 2 years
• Accounting records: 7 years as required by Swedish law
• Marketing consent: until withdrawn or 3 years of inactivity

Data Security

We implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls limiting data access to authorized personnel
• Staff training on data protection obligations

International Transfers

Your personal data is processed and stored within the European Economic Area. We do not transfer data to countries outside the EEA unless appropriate safeguards are in place as required by GDPR.

Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

Updates to This Information

We may update this GDPR information to reflect changes in our practices or legal requirements. Significant changes will be communicated through our website.