Privacy Policy

Nadine Graves Yoga ("we", "us") is committed to protecting your personal data. This policy explains what we collect, why, and the rights you have. It applies to this website, our newsletter, enquiries, private bookings and the online shop. It is written to comply with the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

1. Controller

Nadine Graves Yoga, Chemin des Fancous 4, 1297 Founex, Switzerland · info@nadinegravesyoga.com

2. What we collect

• Enquiries and bookings: name, email, phone, company, message, preferred dates, group size.
• Newsletter: email address, confirmation time, source of sign-up.
• Shop orders: name, email, phone, billing and shipping address, items ordered, amounts paid, Stripe payment reference. Card details are entered on Stripe's secure pages and never reach our servers.
• Technical data: we use privacy-friendly, cookie-less analytics (aggregated page views, country, device type). We do not use advertising trackers. Your cart is stored only in your own browser.

3. Why we use it and on what basis

• To answer enquiries and deliver sessions, retreats and orders — performance of a contract.
• To send the newsletter — your consent (double opt-in; unsubscribe anytime via the link in every email).
• To send transactional emails about your enquiry or order — contract / legitimate interest.
• To keep accounting records — legal obligation (10 years under Swiss law).
• To secure and improve the website — legitimate interest.

4. Who we share it with

We never sell or rent your data. We use carefully selected processors who only access the data needed for their task:

• Supabase (database and file storage, EU region) — stores enquiries, orders, newsletter sign-ups and site content.
• Vercel (website hosting and analytics).
• Stripe (payment processing) — see Stripe's privacy policy for its own processing as a controller.
• Resend (transactional email delivery).
• Shipping carriers (name and address, to deliver your order).
• Authorities, where required by law.

Partner studios (Form Studio, Be.Pilates) and their booking platforms process group-class bookings under their own privacy policies.

5. International transfers

Some providers process data in the EU or the United States. Where data leaves Switzerland or the EU, we rely on adequacy decisions or the standard contractual clauses recognised by the Swiss Federal Data Protection and Information Commissioner.

6. Retention

Enquiries: up to 2 years after our last exchange. Newsletter data: until you unsubscribe. Orders and invoices: 10 years (accounting law). Analytics: aggregated and anonymous.

7. Your rights

You can ask us to access, correct, delete or export your data, to restrict or object to processing, and withdraw consent at any time. Write to info@nadinegravesyoga.com. You may also complain to the Swiss Federal Data Protection and Information Commissioner or, in the EU, to your local supervisory authority.

8. Cookies

This website sets only strictly necessary cookies (for example to keep the admin area signed in) and uses your browser's local storage for the shopping bag. No consent banner is needed because we do not use tracking cookies.

9. Security

Data is transmitted over HTTPS, stored with access controls and row-level security, and payment data is handled entirely by Stripe (PCI DSS Level 1).

10. Changes

We will publish any updates on this page with a new date.