Who is the controller
The controller of your personal data is SIA “Pirts skola Lielzemenes”, reg. no. 40103332219, address: Stabu iela 15-1, Riga, LV-1010, Latvia. The Art of Sauna is run by Matīss Vilde. For anything about your data, write to info@theartofsauna.com. We reply within one month at the latest.
If a company issues the invoice for a programme, that company is a separate controller for the invoice data. Its name and details are on the invoice.
What we collect and why
We only collect what you send us yourself, and we use it only for what you sent it for. We do not sell data or pass it to advertisers. We do not make automated decisions or create profiles.
Course (Sauna Academy)
Data: name, email, chosen language, whether and when you agreed to receive news, and the time you signed up and last signed in. Purpose: to create your account, send you a sign-in code and give you access to the course. Basis: a service you ask for yourself (GDPR Article 6(1)(b)). We send news about new issues and courses only if you tick the box when you sign up. The basis is your consent (Article 6(1)(a)), and you can withdraw it in your course profile or by writing to us. Retention: as long as you have an account. If you ask us to delete it, we delete the account and all data linked to it within one month.
Waiting list and magazine news
Data: your name and email from the form. Purpose: sending news about the school, programmes and the magazine. Legal basis: your consent (Article 6(1)(a) of the General Data Protection Regulation, GDPR). Retention: until you unsubscribe. If we stop using the list, we delete it within 3 years at the latest.
Programme applications
Data: name, email, phone and what you write in your application, such as your room choice and flight times. Purpose: replying, booking your place, arranging accommodation and meeting you at the airport. Legal basis: steps before entering into a contract and performing the contract (GDPR Article 6(1)(b)). Retention: if you do not take part, we delete it within 12 months after the programme. If you do take part, we keep your contact details for up to 3 years after the programme so we can answer questions or claims.
Correspondence
If you email us, message us on WhatsApp or call, we use the conversation to reply to you. Legal basis: our legitimate interest in answering your question, or steps before a contract (GDPR Article 6(1)(f) and (b)). Retention: no longer than 3 years after our last contact.
Payments and invoices
Data: name, address, company details if a company pays, and payment information (amount, date, account). Purpose: invoicing and bookkeeping. Legal basis: the contract and a legal obligation (GDPR Article 6(1)(b) and (c)). Retention: as long as accounting and tax law requires, usually 5 years in Latvia. We never see or store bank card details.
Technical data
When you open the website, our hosting provider Vercel automatically logs your IP address, browser type and the page requested. This keeps the site working and protected against attacks. Legal basis: legitimate interest (GDPR Article 6(1)(f)). Vercel keeps these logs for a short time, and we do not use them to identify people.
Photos and video
At programmes we photograph or film participants only with their consent, and we publish only what you have agreed to. You can withdraw your consent at any time; we then stop using those images in new material.
Health information
The sauna is a physical load, so we ask you to tell us about any health conditions that may matter for your safety (for example heart conditions, blood pressure or pregnancy). This is special category data.
- Purpose: only to adjust heat, cold and load so that you stay safe.
- Legal basis: your explicit consent (GDPR Article 9(2)(a)), which you can withdraw at any time. If a life is in danger, we may share the information with emergency services (Article 9(2)(c)).
- Who knows it: only the sauna master leading the programme and, if needed, the coordinator.
- Retention: deleted within 30 days after the programme ends.
If you would rather not write health information in the form, you can tell us in person before the programme.
Cookies
Our website does not use cookies, advertising pixels or analytics tools, so there is nothing for you to accept. The only thing the site stores on your device is your chosen language (in the browser’s local storage, under the name tas-lang). It is never sent anywhere, and you can delete it in your browser settings.
The course app (/studenti) also keeps what it needs to work in your browser: your sign-in session, so you don’t need a new code every time, the stories you have read and your text size. Reading progress stays on your device only, and the session is deleted when you sign out.
Fonts and images load from our own server, not from Google or other platforms. If we ever add analytics or advertising tools, we will ask for your consent first and update this policy.
Who receives your data
Only those who need it for the work:
- Vercel Inc. (USA): website hosting.
- Supabase Inc. (USA): course accounts, sign-in codes and course content. The data is stored in the EU, in Stockholm (Sweden).
- Web3Forms: forwards form submissions to our email.
- Zoho: the email service that holds our mailbox info@theartofsauna.com and sends the course sign-in codes.
- WhatsApp (Meta): if you choose to contact us there.
- The programme team and the accommodation: only what is needed to organise your stay, such as your name, arrival time, room and dietary needs.
- Our accountant, the company that issues the invoice, and the bank or payment service you pay through.
- Public authorities, where the law requires it.
Data outside the EU
Some providers (for example Vercel, Supabase, Web3Forms and Meta) may process data outside the European Economic Area, including in the USA. In those cases the transfer relies on the safeguards set out in the GDPR: a European Commission adequacy decision (such as the EU–US Data Privacy Framework) or standard contractual clauses.
Your rights
You have the right to:
- find out what data we hold about you and get a copy;
- correct inaccurate data;
- ask us to delete your data;
- restrict processing;
- receive your data in a portable format;
- object to processing based on legitimate interest;
- withdraw your consent at any time. This does not affect anything that happened before you withdrew it.
Write to info@theartofsauna.com and we will reply within one month. If you believe we handle your data wrongly, you can complain to the Data State Inspectorate of Latvia or to the data protection authority in your country. We would be grateful if you wrote to us first.
Unsubscribing
Every news email has an unsubscribe option. You can also reply “unsubscribe” to any of our emails or write to info@theartofsauna.com.
Security
The site runs only over HTTPS, with a strict security policy that blocks third-party scripts. Only the team has access to the mailbox. We do not keep health information in public or shared folders.
Children
Our programmes and mailing lists are for adults (18+). We do not knowingly collect data about children.
Changes
If we change this policy, the new version will appear on this page with a new date. People on our list will be told about important changes by email.
Questions about this page: info@theartofsauna.com