Privacy Policy

This policy explains how PranaSomatics SL processes personal data when you use this website and our services. It is based on the EU General Data Protection Regulation (GDPR, Regulation (EU) 2016/679), Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD) and Spanish Law 34/2002 (LSSI-CE).

1. Controller

PranaSomatics SL, Ur. Eagles Village, 6 1 Pta. 6, Edif. El Nogal, La Quinta Golf, 29679 Benahavís (Málaga), Spain. CIF B88979703. Email: mail@pranasomatics.com.

PranaSomatics SL is the controller for all its websites: pranasomatics.com, kaihill.de and lydiahillcoaching.com. For any question about your data, or to exercise your rights, please write to mail@pranasomatics.com.

2. Hosting and server log files (Squarespace)

This website is hosted by Squarespace Ireland Limited, Le Pole House, Ship Street Great, Dublin 8, Ireland, which works with its group company Squarespace, Inc. (USA). Each time you visit, Squarespace processes technical data in server log files: IP address, browser type and version, operating system, referrer URL, the pages you open, and the date and time of access. We need these data to deliver the website and keep it secure. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Squarespace processes these data on our behalf under a data processing agreement.

3. Cookies and consent

We use strictly necessary cookies without consent (Art. 22(2) LSSI-CE). We use all other cookies, and embedded third-party content that stores information on your device or sends your data to its provider, only if you have given your consent in our cookie banner (Art. 6(1)(a) GDPR). You can change or withdraw your consent at any time with the "Cookie settings" link in the footer. Withdrawing consent does not affect processing carried out before the withdrawal. Details are in our Cookie Policy.

4. Website statistics (Squarespace Analytics)

If you consent, we use the analytics built into Squarespace to understand in aggregate how our website is used: pages visited, traffic sources, device type and approximate location. Legal basis: your consent (Art. 6(1)(a) GDPR).

5. Fonts

This website loads fonts from Google Fonts, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When the fonts load, your browser sends your IP address to Google's servers. Google may also process data in the USA. Legal basis: our legitimate interest in a consistent, readable presentation of our website (Art. 6(1)(f) GDPR), together with your consent where it is required (Art. 6(1)(a) GDPR).

6. Other external resources

Some pages load animation scripts from the jsDelivr content delivery network (cdn.jsdelivr.net) and images from Unsplash's servers (images.unsplash.com; Unsplash Inc.). When they load, your IP address is sent to the respective provider. Legal basis: our legitimate interest in a well-functioning website (Art. 6(1)(f) GDPR).

7. Contact by email, contact form or WhatsApp

If you contact us, we process the details you give us (such as name, email address, phone number and your message) to answer your enquiry. Legal basis: steps taken at your request before a contract, or our legitimate interest in answering enquiries (Art. 6(1)(b) and (f) GDPR). We delete enquiries once they have been dealt with, unless a contract follows or the law requires us to keep them. WhatsApp is provided by WhatsApp Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland, which processes your phone number and metadata under its own terms. If you prefer, write to us by email instead. Please do not send detailed health information by WhatsApp.

The contact form on this website is stored and forwarded by Squarespace. It is protected against spam by Google reCAPTCHA (Google Ireland Limited), which analyses your interaction with the form and may process your IP address and device data. Legal basis: our legitimate interest in protecting the form against abuse (Art. 6(1)(f) GDPR).

8. Newsletter and free resources (Kit)

If you subscribe to our newsletter or request a free resource, we send you emails with practices, invitations to events and information about our offers. We send them with Kit, a service of ConvertKit LLC (USA), which processes your data on our behalf. We use a double opt-in procedure: you are only subscribed once you confirm your subscription via the link in our confirmation email. We store the time of sign-up and confirmation and your IP address so that we can prove your consent. Kit records whether you open our emails and which links you click, which helps us improve them. Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 21 LSSI-CE). You can unsubscribe at any time with the link at the end of every email, or by writing to mail@pranasomatics.com. After you unsubscribe, we keep your email address only on a suppression list, so that you receive no further emails (Art. 6(1)(f) GDPR). If you have bought something from us, we may send you information about our own similar offers to the email address you gave us; you can object to this at any time (Art. 21(2) LSSI-CE).

9. Booking calls (Calendly)

You can book calls and sessions through Calendly, a service of Calendly LLC, 115 E Main St, Ste A1B, Buford, GA 30518, USA. Calendly processes your name, email address, the time you choose and your answers in the booking form, on our behalf. Legal basis: taking steps at your request before a contract and performing it (Art. 6(1)(b) GDPR). If the Calendly widget is embedded on a page, it loads only with your consent; without consent you can still use the direct link to Calendly. Please do not enter health information in booking forms.

10. Info sessions and live training (Zoom)

Our free info sessions and live training weekends take place on Zoom, a service of Zoom Communications, Inc., 55 Almaden Blvd, San Jose, CA 95113, USA. Zoom processes your name, email address, IP address and device data, and your image and voice if you switch on your camera and microphone. Other participants can see the name you display and, if switched on, your camera image. Legal basis: performance of the booking or contract (Art. 6(1)(b) GDPR).

Recordings: we record the teaching segments and guided practices of live sessions so that participants can watch them later. Partner exercises, breakout rooms and sharing rounds are never recorded. If you speak during a recorded segment, for example to ask a question, your name, image and voice may appear in the recording. Recordings are only available to participants of the respective training, through our online learning platform. Legal basis: performance of the contract and our legitimate interest in providing recordings to participants who miss sessions (Art. 6(1)(b) and (f) GDPR). You can switch off your camera or rename yourself at any time.

11. Enrolment and participation in our trainings

To enrol you and deliver the training, we process your contact, billing and contract data, your contributions, your practice logs and your certification submissions (Art. 6(1)(b) GDPR). The on-demand library and the participant forum are provided on our online learning platform. Joining the participant WhatsApp groups is voluntary; other members of a group can see your phone number. If you share health information with us, for example so that we can support you safely, we process it only with your explicit consent and only for that purpose (Art. 9(2)(a) GDPR). You can withdraw this consent at any time. Certification submissions may include recordings of your practice clients; you must obtain their consent before recording. We keep certification submissions only as long as necessary to assess and document your certification. If you take part through the YogaEasy Academy partner access, we process the data needed to verify your eligibility and give you access.

12. Payments (Stripe)

Payments are processed by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Stripe processes your name, email address, billing address and payment details; for instalment plans it also stores a recurring payment authorisation. We do not receive your full card details. For fraud prevention and its own legal obligations, Stripe acts as an independent controller. Legal basis: performance of the contract and our legal obligations (Art. 6(1)(b) and (c) GDPR). We keep accounting records and invoices for six years (Art. 30 Spanish Commercial Code), and tax-relevant data for the periods required by tax law.

13. Videos on this website

The film on our home page is hosted by Squarespace, so no data is sent to other video providers.

14. Social media

We maintain profiles on Instagram and Facebook, services of Meta Platforms Ireland Limited, Merrick Road, Dublin 4, Ireland. Our website only links to these profiles: no data is sent to Meta until you click a link. When you visit our profiles, Meta processes your data under its own privacy policy. For the page statistics that Meta provides to us (Page Insights), we are joint controllers with Meta under Art. 26 GDPR (see facebook.com/legal/terms/page_controller_addendum). Legal basis: our legitimate interest in communicating with you (Art. 6(1)(f) GDPR). We do not use the Meta Pixel or other advertising trackers on this website.

15. Recipients and transfers outside the EU

We share personal data only with the service providers named in this policy, who process it on our behalf under data processing agreements or, where stated, as independent controllers. We also share it with our tax and accounting advisers, and with public authorities where the law requires it. Some providers process data in the USA. Such transfers take place on the basis of the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023), where the provider is certified under it, and otherwise on the basis of the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR). Transfers to Canada are based on the European Commission's adequacy decision.

16. How long we keep data

We delete personal data as soon as it is no longer needed for its purpose. Where the law requires us to keep data, we block it (Art. 32 LOPDGDD) and delete it when the retention period ends. As a guide: enquiries are kept for up to 12 months after they have been dealt with; newsletter data until you unsubscribe; contract and invoice data for six years after the end of the calendar year in which the contract ended.

17. Your rights

You have the right to access your data (Art. 15 GDPR), to rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can object to processing based on legitimate interest or for direct marketing (Art. 21). You can withdraw any consent at any time with effect for the future (Art. 7(3)). To exercise your rights, write to mail@pranasomatics.com; we may ask you to confirm your identity. You also have the right to lodge a complaint with a supervisory authority, in particular the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es, or with the authority in your EU country of residence.

18. Automated decisions

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

19. Minors

Our offers are for adults unless we expressly state otherwise. We do not knowingly process data of persons under 14 without the consent of a parent or legal guardian (Art. 7 LOPDGDD).

20. Security

This website uses TLS encryption. We take appropriate technical and organisational measures to protect your data (Art. 32 GDPR), and we take particular care with health information.

21. Changes

We update this policy when our services or the law change. The current version is always available on this page.

Last updated: 26 October 2026