Your data with us

The controller for data processing on this website is Sangam Projects S.L. (bodhana wellness centre), C/ Benito Jerónimo Feijoo 2, Local 12, 07181 Puerto Portals, Calvià, Mallorca, [email protected].

Contact and voucher forms: When you write to us via a form, we process the data you provide (name, email, optional phone and message; for vouchers also the recipient's name, your choice and personal message), solely to answer your request or prepare the voucher. The legal basis is Art. 6(1)(b) and (f) GDPR.

Applications: If you apply through our “Join our Team” form, we process the details you give there (name, phone, email, the area you live in and your voluntary answers, for example about experience, techniques, languages and availability) to review your application and to keep it for future selection processes. Your application reaches us by email via Resend; it is not stored on the website itself. The legal basis is your consent under Art. 6(1)(a) GDPR. We keep your application for one year at most and delete it afterwards. You can withdraw your consent at any time by writing to [email protected]; we will then delete your application.

Paying for a gift voucher: If you pay for a voucher directly on this website, the payment is handled by Stripe Payments Europe, Limited (Ireland). Stripe receives your email address, the amount, the description of the voucher you bought (for a treatment voucher that is the name of the treatment) and the details you enter in the payment window. The recipient's name and your personal message do NOT go to Stripe, they stay with us. You enter your card details directly with Stripe, we never see or store them. Stripe also processes data outside the EU, including in the USA. The legal basis is Art. 6(1)(b) GDPR, performance of the purchase contract. More is set out in Stripe's privacy policy at stripe.com/privacy.

The voucher itself: What you ordered we keep in a list of our own: voucher number, chosen treatment or amount, the recipient's name, your personal message, your email address and whether the voucher has already been redeemed. Without those details it could neither be sent nor redeemed with us. We keep them for as long as the voucher is valid, and beyond that for as long as tax and commercial law require. The email with the voucher and the PDF is delivered by the same service provider as our other messages, Resend (Ireland); the recipient's name, your message and the name of the treatment pass through its systems. If someone opens the payment window and then does not pay, we delete their details automatically after thirty days.

Delivery: To deliver form messages by email we use the service provider Resend. The contents are transmitted technically; a data processing agreement is in place.

Staying in touch: If you sign up for news, we process your email address, the time you signed up and the time you confirmed. The sign-up only takes effect when you click the link in the confirmation email. The sending is operated for us by StudioMeyer on a server in Nuremberg, Germany, and the email itself is delivered by Resend. The legal basis is your consent under Art. 6(1)(a) GDPR. You can withdraw it at any time, through the unsubscribe link in every email or by writing to [email protected].

Chat assistant: In the bottom right corner you can type a question into a chat window. Your message is passed to our service provider Anthropic (USA), which generates the reply; this involves a transfer to the USA. We do not store the conversations. Please do not enter health data or other sensitive details in the chat — for anything personal, use the contact form or give us a call. The legal basis is Art. 6(1)(f) GDPR.

Map: We show our location via Google Maps. The map does not load on its own — as long as you do not click “Load map”, nothing is requested from Google and no data leaves you. Only your click loads the map from Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland); Google then receives your IP address, and a transfer to the USA may take place. We do not pass on the address of the page you are on. The legal basis is your consent given by that click (Art. 6(1)(a) GDPR); you can withdraw it by reloading the page and not clicking again.

Hosting and delivery: This website runs on a server of Hetzner Online GmbH in Nuremberg, Germany, maintained by StudioMeyer. In front of it sits the network of Cloudflare, Inc. (USA), which delivers the pages faster and blocks automated attacks. Cloudflare processes your IP address and technical details of your request, and operates servers outside the EU as well. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in a secure and fast website.

Cookies: This website sets no marketing cookies and no cookies for measuring reach. The only cookie we set is a technically necessary one that remembers your choice of language.

Measuring reach: So that we can see which pages are read, we count views with Umami. Umami runs on StudioMeyer's own server in Nuremberg, Germany, sets no cookies and builds no profile of you. What is stored is the page, the time, where the visit came from and rough technical details such as device type and language. Your IP address is only computed with and never stored. The legal basis is Art. 6(1)(f) GDPR.

Abuse protection: So that forms and chat cannot be flooded automatically, the server keeps your IP address in memory for at most one minute and then discards it. No lasting record is created. The legal basis is Art. 6(1)(f) GDPR.

Retention: We keep enquiries only for as long as needed to handle them.

Your rights: You have the right to access, rectification, erasure and objection at any time. Simply write to [email protected].