Privacy Policy

This policy explains how THE WAY, operated by [Business Legal Name] trading as the Welsh Academy of Yoga (“we”, “us”), collects and uses your personal data, and your rights under UK data protection law (the UK GDPR and the Data Protection Act 2018). We are the data controller for this information.

Who we are

[Business Legal Name], [registered address]. Contact for privacy matters: hello@dianabrook.com. [If registered with the ICO: ICO registration number [number].]

The data we collect

• Account data — your email address and, if you provide it, your name.
• Learning data — the immersions and programmes you enrol in, your progress, banked CPD hours, and any notes you save.
• Community data — anything you post in community spaces.
• Technical data — essential sign-in cookies that keep you logged in. We do not use advertising or tracking cookies.

How we use your data and our legal basis

• To provide your account, deliver the training and track your progress — on the basis of our contract with you.
• To send you service messages such as sign-in links and important updates — contract and our legitimate interests in running the platform.
• To keep the platform secure and to improve it — our legitimate interests.
• For any marketing emails, only with your consent, which you can withdraw at any time.

Who we share it with

We do not sell your data. We share it only with service providers who help us run the platform, under contract and only as needed:

• Supabase — secure database and authentication (stores your account and learning data).
• Vercel — hosting and delivery of the application.
• [Email provider — delivery of sign-in and service emails, if you use a separate provider.]

Some of these providers may process data outside the UK. Where they do, we rely on appropriate safeguards (such as UK-approved standard contractual clauses) to protect it.

How long we keep it

We keep your account and learning data for as long as you have an account, and for a reasonable period afterwards to meet our record-keeping and legal obligations (for example, evidence of CPD hours and certificates issued). You can ask us to delete your account at any time.

Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you;
• ask us to correct data that is wrong or incomplete;
• ask us to delete your data (where the law allows);
• object to or restrict certain processing;
• ask for a copy of your data in a portable format;
• withdraw consent where we rely on it.

To exercise any of these, email hello@dianabrook.com. We will respond within one month.

Data security

We use reputable providers and sensible measures to protect your data, including encrypted connections and access controls. No system is completely secure, but we take reasonable steps to keep your information safe.

Children

THE WAY is intended for adults (18+). We do not knowingly collect data from children.

Changes to this policy

We may update this policy from time to time. We will post the current version here with a new “last updated” date.

Complaints

If you have a concern we have not resolved, you can contact us at [contact email]. You also have the right to complain to the UK’s Information Commissioner’s Office (ICO) at ico.org.uk.