Privacy Policy.

Welcome to Ali Yoga v/ Alina Kachan, located at Robert Jacobsens Vej 44L, 2300 København S, Denmark, registered under CVR number 44607999. We respect your privacy and are committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, and protect your personal data when you visit our website at https://aliyoga.dk/ ("the Site") or use our services, including class bookings and memberships. We comply with the General Data Protection Regulation (GDPR) and the Danish Data Protection Act (Databeskyttelsesloven).

We act as the data controller for all personal data collected in connection with our services, including data collected through our booking system. If you have questions, contact us at info@aliyoga.dk.

Contact form data: When you contact us through our website, we collect your name, email address, phone number (if provided), and the content of your message.

Membership and booking data: When you create a profile or book classes through our booking system (YOGO), the following data is collected on our behalf: name, email address, phone number, postal address, date of birth, membership type, class registrations, and attendance history.

Payment data: Payment transactions are processed securely through YOGO. We do not store your payment card details on our own systems.

Website usage data: We automatically collect technical data when you visit the Site, including IP address, browser type, and pages visited, to maintain and improve the Site.

We only process your personal data when we have a valid legal basis under GDPR Article 6:

• -Contract (Art. 6(1)(b)): Processing necessary to fulfil your membership or class booking with us.
• -Legitimate interests (Art. 6(1)(f)): Responding to inquiries, improving our services, and website analytics.
• -Legal obligation (Art. 6(1)(c)): Compliance with Danish bookkeeping law and other legal requirements.
• -Consent (Art. 6(1)(a)): Sending marketing emails or newsletters, and use of non-essential cookies. You may withdraw consent at any time.

• -Managing your membership, class bookings, and attendance.
• -Processing payments and maintaining financial records.
• -Communicating with you and responding to inquiries.
• -Sending updates or promotional content (only where you have consented).
• -Maintaining and improving the Site and our services.
• -Complying with legal obligations.

• -Membership and booking data: Retained for as long as your membership is active. If your account has been inactive for 36 months (no class attendance), your account will be deactivated and personal data removed. A pseudonymised record may be retained for reporting purposes.
• -Financial and transaction records: Retained for 5 years to comply with Danish bookkeeping law (Bogføringsloven).
• -Contact form messages: Retained for up to 24 months unless an ongoing relationship requires longer retention.
• -Marketing consent records: Retained until you withdraw consent, plus a reasonable period to document compliance.
• -Website usage data: Retained in anonymised or aggregated form for up to 26 months.

You may request account deactivation at any time by contacting us directly.

We use the following third-party service providers (data processors) who process personal data on our behalf. Each operates under a data processing agreement that complies with GDPR Article 28.

YOGO (booking and membership platform) — YOGO.DK ApS, Njalsgade 21F, 6. sal, 2300 København S, CVR: 39467542. YOGO processes membership and booking data solely on our behalf. Their infrastructure is hosted on Amazon Web Services (AWS) servers in Frankfurt, Germany (within the EU). Data is not transferred outside the EU/EEA without appropriate safeguards.

YOGO uses the following sub-processors to operate the platform:

• -Amazon Web Services: IT infrastructure and data storage (EU, Frankfurt).
• -Mailgun: Email delivery from the system.
• -Gateway API: SMS delivery from the system.

Formspree (contact form submission) — Formspree, Inc., 340 S Lemon Ave #9007, Walnut, CA 91789, USA. When you submit our contact form, your name, email address, and message are transmitted to Formspree, which delivers the message to us. Formspree acts as our data processor for this purpose. Data may be transferred to the United States; Formspree provides appropriate safeguards under GDPR (Standard Contractual Clauses). For more information, see Formspree's Privacy Policy.

As the data controller, we remain responsible to you for how your data is handled by our processors. If you have questions, contact us at info@aliyoga.dk.

We do not sell your personal data. We may share it in the following circumstances:

• -YOGO (data processor): As described in Section 6, YOGO processes booking and membership data on our behalf under a formal data processing agreement.
• -Formspree (data processor): As described in Section 6, contact form submissions (name, email, message) are transmitted via Formspree under a formal data processing agreement.
• -Legal requirements: When required by law, court order, or to protect our legal rights.
• -Business transfers: In connection with a merger, acquisition, or sale of assets. We will notify you before your data is transferred and becomes subject to a different privacy policy.

We use cookies and similar technologies on the Site. Cookies fall into three categories:

• -Strictly necessary: Required for the Site to function. No consent required.
• -Analytics: Help us understand how visitors use the Site. Placed only with your explicit consent.
• -Marketing: Used for promotional purposes. Placed only with your explicit consent.

When you first visit the Site, you will be asked to accept or decline non-essential cookies via our cookie banner. You may manage or withdraw cookie consent at any time through your browser settings or our cookie preferences tool.

You have the following rights under GDPR Articles 15–22. To exercise any of them, contact us at info@aliyoga.dk. We will respond within 30 days.

• -Access (Art. 15): Request a copy of the personal data we hold about you.
• -Rectification (Art. 16): Request correction of inaccurate or incomplete data.
• -Erasure (Art. 17): Request deletion of your data where applicable.
• -Restriction (Art. 18): Request that we limit processing in certain circumstances.
• -Data portability (Art. 20): Receive your data in a structured, machine-readable format.
• -Object (Art. 21): Object to processing based on legitimate interests or for direct marketing.
• -No automated decision-making (Art. 22): Not to be subject to solely automated decisions that significantly affect you.
• -Withdraw consent (Art. 7(3)): Where processing is based on consent, withdraw it at any time without affecting prior lawful processing.

If you believe we have processed your personal data unlawfully, you may lodge a complaint with the Danish Data Protection Authority (Datatilsynet):

• -Website: www.datatilsynet.dk
• -Email: dt@datatilsynet.dk
• -Phone: +45 33 19 32 00

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, or loss. These include access controls, encrypted data transmission (HTTPS), and formal data processor agreements. YOGO is contractually required to maintain security measures in accordance with GDPR Article 32. No transmission or storage system can be guaranteed 100% secure.

In the event of a personal data breach, YOGO is required to notify us within 36 hours. If the breach poses a risk to your rights, we will notify Datatilsynet within 72 hours and, where required, inform you directly.

We may update this policy to reflect changes in our practices or legal requirements. Material changes will be communicated via a notice on our Site and an updated "last updated" date above.

Ali Yoga v/ Alina Kachan
Robert Jacobsens Vej 44L, 2300 København S, Denmark
CVR: 44607999
Email: info@aliyoga.dk