Privacy Policy
Last updated: 31/01/26
This policy explains how DEYA Retreats ("DEYA," "we," "us," or "our") collects, uses, and protects your personal information when you visit deyaretreats.com, apply for or book a retreat, subscribe to our newsletter, or contact us. We take privacy seriously. This policy is written to be clear about what we do with your information and what rights you have. If anything is unclear, please email us at connect@deyaretreats.com.
1. Who we are
DEYA Retreats is operated by DEYA Retreats Pty Ltd, registered in Australia (ABN 72 692 291 348).
Registered address: Level 1/100 Havelock St, West Perth, WA 6005
For the purposes of UK GDPR and EU GDPR, DEYA Retreats is the data controller for the personal information described in this policy.
2. What information we collect
We collect personal information from you in the following ways:
When you apply for a supported retreat place:
Your name, email, country, Instagram handle, website or work link
Your written responses to application questions, which may include information about your creative practice, contemplative practice, beliefs, or other personal reflections you choose to share
When you book a retreat:
Name, email, address, phone number
Payment information (processed by Stripe or Wise, not stored by us)
Dietary requirements, accessibility needs, and any health or wellbeing information you choose to disclose for the safe running of the retreat
Emergency contact details
When you subscribe to our newsletter:
Name and email
Any preferences you set
When you contact us by email or through the website:
Name, email, and the contents of your message
When you visit deyaretreats.com:
Cookies and similar technologies (see Section 9)
Standard web log data (IP address, browser type, pages visited, referring site)
We do not knowingly collect information from anyone under 18.
3. Special category data
Some of the information you may share with us — particularly in retreat applications, contemplative practice reflections, or dietary and health disclosures — could include "special category data" under GDPR. This may include data about your beliefs, religious or philosophical practice, or your health.
We process special category data only with your explicit consent, and only for the specific purpose for which you provided it (selection for a retreat, safe running of a retreat, or to respond to a direct request from you). You can withdraw your consent at any time by emailing connect@deyaretreats.com.
4. Why we collect your information and our lawful basis
We collect and use your information for the following purposes:
To process retreat applications and manage selection. Lawful basis: Performance of pre-contractual steps at your request (Article 6(1)(b)) and, for any special category data, your explicit consent (Article 9(2)(a)).
To run retreats you have booked. Lawful basis: Performance of a contract (Article 6(1)(b)).
To send you our newsletter and marketing communications. Lawful basis: Your consent (Article 6(1)(a)). You can withdraw consent at any time by clicking "unsubscribe" in any email.
To respond to enquiries you send us. Lawful basis: Legitimate interests (Article 6(1)(f)) — specifically, our interest in responding to people who contact us.
To run, secure, and improve our website. Lawful basis: Legitimate interests (Article 6(1)(f)) for essential cookies and basic analytics; consent (Article 6(1)(a)) for non-essential cookies.
To meet legal and regulatory obligations (e.g. tax records, accident records). Lawful basis: Legal obligation (Article 6(1)(c)).
5. Who we share your information with
We share personal information only with the following recipients:
Service providers who process data on our behalf (under written agreements that require them to protect your data):
Squarespace — website hosting and form submissions
Flodesk — email marketing and newsletters
Stripe & Wise — payment processing
Google Workspace — form submission and email correspondence
Retreat facilitators and selection panel members for supported retreat places and similar applications. Panel members read applications under a confidentiality agreement and use the data only for selection.
Retreat hosts and guides receive limited information necessary to run the retreat (e.g. names, dietary requirements, emergency contacts).
Professional advisers (accountants, lawyers, insurers) where required.
Authorities where we are legally obliged to disclose information.
We do not sell your personal information.
6. International data transfers
Some of our service providers (including Squarespace and Flodesk) are based in the United States or process data outside the UK and EU. When data is transferred internationally, we rely on the safeguards required under UK and EU GDPR — including the EU-US Data Privacy Framework, UK Extension to the Data Privacy Framework, and Standard Contractual Clauses where applicable.You can request more information about specific transfer mechanisms by contacting us at connect@deyaretreats.com.
7. How long we keep your information
We hold your information only as long as we need it for the purpose we collected it for, and as required by law.
Retreat applications (unsuccessful) - Up to 90 days after the selection decision, then deleted
Retreat applications (successful recipient) - For the duration of the retreat plus 12 months
Retreat bookings and attendee records - 7 years (for tax and insurance purposes)
Newsletter subscribers - Until you unsubscribe, plus a short retention period for our records
Email correspondence - Up to 3 years from the date of last contact
Website analytics - Up to 26 months
After these periods, we either delete the information or anonymise it.
8. Your rights
Under UK and EU GDPR, you have the following rights in relation to your personal information:
Access — request a copy of the personal information we hold about you.
Rectification — ask us to correct information that is wrong or incomplete.
Erasure — ask us to delete your information ("right to be forgotten"), subject to legal limits.
Restriction — ask us to limit how we use your information.
Portability — receive your information in a structured, machine-readable format.
Objection — object to our use of your information where we rely on legitimate interests.
Withdraw consent — withdraw consent at any time, where we rely on consent.
Complain — lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner's Office. In the EU, you can complain to the supervisory authority in your country of residence.
To exercise any of these rights, please email connect@deyaretreats.com. We will respond within one month.
9. Cookies
Our website uses cookies and similar technologies. Some are essential for the site to work (e.g. remembering your form inputs); others help us understand how visitors use the site or support marketing.
You can manage your cookie preferences through the cookie banner shown when you first visit the site, and you can change your preferences at any time. Non-essential cookies are only set after you give consent.
10. Security
We use appropriate technical and organisational measures to protect your information, including secure hosting, restricted access on a need-to-know basis, and confidentiality agreements with anyone who reads applications or handles your data. No system is perfectly secure; if a breach occurs, we will notify the relevant supervisory authority and, where required, affected individuals.
11. Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top will reflect any changes. If the changes are significant, we will notify you by email or by a notice on the site.
12. Contact us
For any questions about this policy or about how we handle your information, please email connect@deyaretreats.com or write to us at Level 1/100 Havelock St, West Perth, WA 6005.