Ritual Roads

Privacy policy

What personal data Ritual Roads processes, on what legal basis, for how long, and what you can do about it.

To be completed. The controller's identification details (⟨LEGAL NAME⟩, ⟨TAX ID⟩, ⟨ADDRESS⟩) must be filled in by the organisation before publishing, and a professional should review this text. Everything else describes exactly what the platform does today.

1. Who processes your data

Controller: ⟨LEGAL NAME⟩ (⟨TAX ID⟩), hereinafter "Ritual Roads". Address: ⟨ADDRESS⟩. Contact: info@matrikayoga.com.

Ritual Roads is the travel project of Matrika Yoga School. Where this policy says "we", it means that organisation.

2. What we process, and why

2.1 Contact form

When you write to us we collect your name, email, phone if you fill it in, the trip you are asking about and your message, along with the language you wrote from.

  • Purpose: replying to you and following up.
  • Legal basis: your consent and pre-contractual steps taken at your request (art. 6.1.a and 6.1.b GDPR).
  • Retention: 24 months from the last contact, unless it becomes a booking.

2.2 Traveller account

If you sign up we store your user identifier, email, name and profile picture where your identity provider supplies it.

  • Purpose: giving you access to your private area.
  • Legal basis: performance of a contract (art. 6.1.b GDPR).
  • Retention: as long as your account is active.

2.3 Bookings

For each booking we store the trip, your role in the group, the booking status, related payments and any operational notes the team needs.

  • Purpose: running the trip and meeting our legal and accounting duties.
  • Legal basis: performance of a contract and legal obligation (art. 6.1.b and 6.1.c GDPR).
  • Retention: 6 years from the end of the financial year.

2.4 Internal activity log

Every action the team takes on your data is recorded: who, what and when.

  • Purpose: being able to audit who touched what. It is a security measure, not profiling.
  • Legal basis: legitimate interest in information security (art. 6.1.f GDPR).
  • Retention: 12 months.

3. What we do not do

  • We do not sell or share your data with third parties for commercial purposes.
  • We do not profile you or take automated decisions affecting you.
  • We use no advertising or third-party tracking cookies. The only cookies are your session and the one remembering your language (§6).
  • We do not record your browsing session. Our error-reporting tool has personal-data capture and session replay switched off.

4. Who else sees your data

We work with providers that process data on our behalf, under a data processing agreement:

| Provider | Purpose | Where | | -------- | -------------------------- | -------------------------------------- | | Vercel | Website hosting | EU / US (standard contractual clauses) | | Neon | Database | EU | | Kinde | Identity and access | EU / US (standard contractual clauses) | | Resend | Enquiry notification email | US (standard contractual clauses) | | Upstash | Rate limiting (anti-abuse) | EU | | Sentry | Technical error logging | EU |

We also share the minimum necessary with trip providers (accommodation, transport, insurance) when required to deliver the service you booked, and with public authorities where the law requires it.

5. Your rights

You may ask us to access, rectify, erase, restrict or object to the processing of your data, and to port it. Write to info@matrikayoga.com stating which right you wish to exercise; we will reply within one month.

If you believe we have not handled your request properly, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or your local supervisory authority.

6. Cookies

We only use strictly necessary ones, which is why you will not see a banner asking permission for something we do not do:

| Cookie | Purpose | Duration | | --------------------- | ------------------------- | -------- | | NEXT_LOCALE | Remembering your language | 1 year | | Kinde session cookies | Keeping you signed in | Session |

Fonts are served from our own domain: loading the site sends no request to third parties.

7. Security

We encrypt traffic, apply strict security headers, rate-limit requests to curb abuse and log the team's access to data. No system is infallible; should a breach affect your rights, we will tell you.

8. Changes

If this policy changes we will update the date above and, where the change matters, let you know by email.