Privacy policy

Last updated: August 2026

1. Data protection at a glance

General notes

The following notes give you a simple overview of what happens to your personal data when you visit this website. Personal data is any data that can personally identify you.

You will find detailed information in the following sections of this privacy policy.

Data collection on this website

Who is responsible for data collection on this website?

Data processing on this website is carried out by Vinayaki-Yoga & Coaching GbR and by Anne Böhme as a freelance yoga teacher (“Vinayaki-Yoga”) — acting as joint controllers for the shared website. You will find the contact details in the section “Responsible parties”.

How do we collect your data?

On the one hand, we collect your data when you share it with us — for example by filling in a contact, registration or withdrawal form, or by contacting us by email or phone.

On the other hand, technical data is transmitted when you open our website — data that is needed to show you the pages at all, such as your IP address and details about your browser. We process this data solely to deliver the page and do not store it in log files. More on this in the section “Hosting and technical operation”.

What do we use your data for?

We process data in particular to provide the website securely, stably and free of errors, to handle your enquiries, to process registrations for events and courses and — only with your consent — to statistically evaluate how our offering is used.

What rights do you have regarding your data?

You have the right to receive information free of charge about the origin, recipients and purpose of your stored personal data at any time. You also have a right to correction or deletion of this data. If you have given consent, you can revoke it at any time with effect for the future.

Under the statutory conditions you also have the right to request that the processing of your personal data be restricted, to object to the processing and to request that your data be handed over in a common, machine-readable format.

You can contact us at any time about this and about any other questions on data protection. You also have the right to lodge a complaint with a data protection supervisory authority.

2. Responsible parties

The parties responsible for data processing on this website are:

For the website, the shared customer base, the forms and the future newsletter, Vinayaki-Yoga & Coaching GbR and Anne Böhme (freelance yoga teacher, “Vinayaki-Yoga”) are joint controllers within the meaning of Art. 26 GDPR. In an agreement we have determined that Vinayaki-Yoga & Coaching GbR takes the lead in fulfilling the information duties and that enquiries are coordinated centrally via datenschutz@vinayaki-yoga-und-coaching.com. Independently of this, you can assert your rights under the GDPR against either of the two controllers. Each provider is solely responsible for its own contract and invoice management.

The responsible party is the natural or legal person who alone or jointly with others decides on the purposes and means of processing personal data.

3. General notes and mandatory information

Data protection

We treat your personal data confidentially and in accordance with the statutory data protection regulations and this privacy policy.

Please note that data transmission on the internet — for example when communicating by email — can have security gaps. Completely protecting data against access by third parties is not possible.

Storage period

Unless a specific storage period is stated in this privacy policy, we store personal data only for as long as is necessary for the respective purpose.

If you assert a justified request for deletion or revoke consent, we delete your data unless other legally permissible reasons for continued storage exist. These can include statutory retention periods in particular, or the necessity to establish, exercise or defend legal claims.

Legal bases of processing

Where you have consented to processing, we process your personal data on the basis of Art. 6(1)(a) GDPR. Where the consent covers access to information on your device or the storage of such information, this is additionally based on Section 25(1) TDDDG.

Where processing is necessary to fulfil a contract or to carry out pre-contractual measures, it is based on Art. 6(1)(b) GDPR.

Where processing is necessary to fulfil a legal obligation, it is based on Art. 6(1)(c) GDPR.

Where processing is necessary to protect our legitimate interests or the legitimate interests of third parties, and no overriding interests, fundamental rights or fundamental freedoms of the data subject stand against it, it is based on Art. 6(1)(f) GDPR.

Recipients of personal data

We use service providers for individual technical and organisational services. Where necessary, they process personal data exclusively according to our instructions and on the basis of data processing agreements pursuant to Art. 28 GDPR.

Personal data is only passed on if this is necessary for fulfilling a contract, if a legal obligation exists, if there is a legitimate interest or if another legal basis permits the transfer.

Revoking your consent

You can revoke consent you have given at any time with effect for the future. The lawfulness of the processing carried out until the revocation remains unaffected.

Right to object under Art. 21 GDPR

Right to complain to the supervisory authority

In the event of breaches of the GDPR, data subjects have the right to lodge a complaint with a supervisory authority. Responsible is in particular the supervisory authority of the federal state of your habitual residence, your workplace or the place of the alleged breach.

SSL or TLS encryption

For security reasons and to protect the transmission of confidential content, this website uses SSL or TLS encryption. You can recognise an encrypted connection by the address bar of your browser starting with “https://” and by the padlock symbol.

4. Hosting and technical operation

This website is operated on technical infrastructure of netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany.

The technical operation of the website is handled by VYC Sahitya IT-Solutions GbR as a processor, exclusively according to our instructions and on the basis of a data processing agreement pursuant to Art. 28 GDPR. VYC Sahitya IT-Solutions GbR does not process personal data for its own purposes.

netcup GmbH provides the server and hosting infrastructure and processes personal data as a sub-processor within the scope of the hosting services.

No access logs

We do not keep access logs of visits to this website. Your IP address is technically required so that the pages can reach you at all, and is only processed transiently in doing so — we do not store it.

The system logs of our application record technical events only, such as start-up and error messages and blocked spam attempts. They contain no IP addresses and no information about who opened which page.

Hoster logs

As part of operating the servers, netcup GmbH logs connection data at infrastructure level, in particular to detect and defend against attacks and to ensure stable operation. According to netcup's documentation, log files containing personal data are retained for a maximum of 14 days and then deleted; this also applies to log data collected automatically in attack scenarios.

The purpose of this processing is the security and stability of the infrastructure; the legal basis is Art. 6(1)(f) GDPR (legitimate interest in secure and reliable operation). The processing takes place on the basis of a data processing agreement.

5. Domains and email communication

For managing our domain names, providing email mailboxes and sending email notifications from our forms we use ALL-INKL.COM – Neue Medien Münnich, owner René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany.

In particular, email addresses, communication content, metadata of the email communication and technical connection data can be processed.

The processing is carried out to handle your enquiry, to carry out pre-contractual measures or to fulfil a contract on the basis of Art. 6(1)(b) GDPR. Where there is no contract initiation or fulfilment, the processing is based on our legitimate interest in reliable business communication pursuant to Art. 6(1)(f) GDPR.

Domains and mailboxes are provided via VYC Sahitya IT-Solutions GbR, which acts as a processor on our behalf. In this context ALL-INKL.COM processes personal data as a sub-processor within the scope of these services. The processing takes place on the basis of data processing agreements pursuant to Art. 28 GDPR.

6. Cookie and privacy settings

Our website uses no third-party cookies and no tracking cookies.

We use only the technically required storage listed below. It serves to provide you with the functions you request and stores no information for advertising or cross-site tracking.

Cookie

• Name: NEXT_LOCALE
• Purpose: stores the language you selected
• Storage period: browser session; the cookie is deleted when the browser is closed

Local storage

• Name: vyc-sahitya-consent
• Purpose: stores your decision on the optional privacy settings for analytics and maps
• Storage period: until you delete the entry in your browser. You can change your decision itself at any time via the privacy settings; the entry is overwritten in the process.

• Name: vyc-sahitya-theme
• Purpose: stores the display mode you selected, including the accessibility settings
• Storage period: until you delete the entry in your browser

The processing and storage of this technically required information is based on Section 25(2) no. 2 TDDDG in conjunction with Art. 6(1)(f) GDPR. Our legitimate interest lies in providing the website in a user-friendly, low-barrier and technically functional way.

Privacy settings

On your first visit to our website the optional settings “Analytics” and “Maps” are deactivated. They are only activated if you consent via our privacy settings.

Your decision is stored locally in your browser. You can change or revoke your consent at any time with effect for the future via the link “Cookie- und Datenschutzeinstellungen” in the footer of our website. The lawfulness of the processing carried out until the revocation remains unaffected.

7. Contact, forms and registrations

Contact form, event registration and withdrawal form

When you write to us via a contact form, register for an event or use our withdrawal form, we process the data you enter in order to handle your request.

Depending on the form, this can include in particular your name, email address, phone number, your message or note, details of the desired event or course booking, your preferred payment method, and any further information you share with us voluntarily.

The processing is based on Art. 6(1)(b) GDPR where your enquiry or registration relates to fulfilling a contract or carrying out pre-contractual measures. In all other cases it is based on our legitimate interest in effectively handling the enquiries addressed to us pursuant to Art. 6(1)(f) GDPR. We additionally process a withdrawal declaration to fulfil our legal obligations pursuant to Art. 6(1)(c) GDPR.

Your form entries are transmitted by email to the responsible functional mailbox: contact enquiries to our contact mailbox, event enquiries to our event mailbox and withdrawal declarations to a separate withdrawal mailbox set up for that purpose. Mails are sent via a technical sender address of our own domain.

After sending a form you also receive an automatic acknowledgement of receipt at the email address you provided. It contains a summary of the details you submitted — for a withdrawal declaration additionally the date, time and case number of receipt. An acknowledgement of receipt only documents receipt; it is not a substantive confirmation of booking or effectiveness.

Contact and event enquiries are not stored in a database of this website; they are transmitted exclusively by email and processed in the mailboxes named above. Withdrawal declarations, however, are additionally stored in a database of this website: the declaration itself, the case number, the time of receipt and a log of the transmission attempts. This storage serves the legally required proof of receipt of your withdrawal declaration (Art. 6(1)(c) GDPR), protects your declaration against loss during technical failures and ensures that an accidentally re-sent declaration is not processed twice.

Different deletion periods apply depending on the form: we delete contact enquiries once processing is complete, at the latest six months after the last correspondence. We delete event enquiries at the latest six months after the event; statutory tax and commercial retention obligations for booking and payment records remain unaffected. Withdrawal declarations and the associated transmission log are retained for six years from the end of the calendar year of receipt, as proof of receipt and due to statutory retention obligations for business correspondence.

Spam protection and abuse prevention

To protect our forms against automated access and abuse we use a self-hosted ALTCHA captcha. No data is transmitted to an external captcha provider and no cookies are set.

In addition, your IP address is processed transiently only, as a rate-limit key, to limit repeated or abusive form requests. It is not stored permanently and not logged for this.

The processing is based on Art. 6(1)(f) GDPR. Our legitimate interest lies in protecting our website and communication channels against spam, abuse and technical attacks.

Enquiries by email or phone

If you contact us by email or phone, we process your enquiry including all personal data arising from it — such as name, contact details and the content of the enquiry — in order to handle your request.

Where necessary, the processing is based on Art. 6(1)(b) GDPR for carrying out pre-contractual measures or fulfilling a contract. Otherwise it is based on Art. 6(1)(f) GDPR, on our legitimate interest in reliable communication with the people interested in our offerings.

8. Web analytics with Umami

We use the self-hosted web analytics software Umami to statistically evaluate the use of our website and improve our offering.

Umami runs on our own technical infrastructure. No analytics data is transmitted to external analytics providers. Umami sets no cookies.

Umami is only activated if you have consented to the “Analytics” setting via the privacy settings. Without your consent the analytics script is not loaded. The processing is based on your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG.

Within the web analytics, in particular the page visited, the time of the page view, the referrer information, device type, browser, operating system and screen size are processed.

Your IP address is not stored in the process. It is combined with a random value that changes daily into a session identifier and used for a location lookup that runs entirely on our own server. Only its results are stored: country, region and city. This does not allow us to link the data to you as a person; the data is pseudonymous.

You can revoke your consent at any time with effect for the future via the link “Cookie- und Datenschutzeinstellungen” in the footer of this website. The lawfulness of the processing carried out until the revocation remains unaffected.

9. OpenStreetMap

On the contact page and on event detail pages we may use map material from OpenStreetMap.

The map is only loaded if you actively request it via the respective map function or have activated the “Maps” setting in the privacy settings.

When the map is loaded, a connection to servers of the OpenStreetMap Foundation, St John's Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom, is established. In particular, your IP address is transmitted to the OpenStreetMap Foundation.

The processing is based on your consent pursuant to Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can revoke your consent at any time via the cookie and privacy settings.

An adequacy decision of the European Commission exists for the United Kingdom.

10. Locally provided content

Fonts

For a uniform appearance we use the fonts Libre Baskerville, Playball and Atkinson Hyperlegible. These fonts are provided entirely by our own website.

When you open the website, no connection to servers of Google or other external font providers is established.

Videos

The video on the start page is delivered as a local file from our own website. No transmission to external video platforms takes place during playback.

11. Social media and external links

Our website contains links to our profiles on Instagram and Facebook, buttons for sharing content via Facebook, WhatsApp or email, a link for adding events to a calendar, and individual links to external offerings, such as course registration with the adult education centre (Volkshochschule).

When you open our website, no content from these platforms is embedded and no data is transmitted automatically to these providers.

Only when you click an external link is a connection to the respective platform or service established. The respective provider is responsible for the data processing there. Please note the privacy information of the respective provider.

12. Currency and changes to this privacy policy

This privacy policy is dated August 2026.

We will adapt it whenever this becomes necessary due to changed data processing, new technical features or changed legal requirements.