White Lotus Yoga Studio by Vicky Tomsky 

 

Last updated: 20 October 2026

  1. Introduction

At White Lotus Yoga Studio by Vicky Tomsky (“White Lotus”, “we”, “us” or “our”), we respect your privacy and are committed to protecting your personal information.

This Privacy Policy explains how we collect, use, store and protect your personal data when you visit our website, attend classes at our studio in Kifissia, Athens, purchase a membership or class package, book a private session, participate in a workshop or retreat, receive our emails, or engage with our services online.

We process personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”), applicable Greek data protection legislation, including Law 4624/2019 where applicable, and other relevant legal requirements.

Please read this policy carefully to understand how your information is handled and what rights you have.

  1. Who Is Responsible for Your Personal Data?

The data controller responsible for processing your personal information is White Lotus Yoga Studio by Vicky Tomsky.

For the purposes of the GDPR, the data controller is the person or business that determines how and why personal data is processed.

  1. What Personal Information Do We Collect?

The information we collect depends on how you interact with White Lotus.

  1. Information you provide directly

When you contact us, register for a class, purchase a membership, book a private session, or participate in an event, we may collect:

  • Your name and surname.
  • Email address and telephone number.
  • Booking, registration and attendance information.
  • Membership, class-package and payment-status information.
  • Details of your enquiries, requests and communications with us.
  • Information you voluntarily provide when registering for workshops, retreats or other events.
  • Information you provide when subscribing to our newsletter or other communications.

We collect only the information reasonably necessary for the relevant purpose.

  1. Payment and membership information

When you purchase a class, membership, private session, workshop, retreat or other service, we may process information relating to your purchase, including the service purchased, amount paid, payment status, transaction reference and relevant billing information.

Payments may be processed by third-party payment providers. Where applicable, your card details are handled directly by the relevant provider in accordance with its own privacy and security practices.

We do not intend to store full payment-card details unless this is specifically required and lawfully handled through an appropriate payment system.

We may also retain relevant records to manage memberships, class balances, cancellations, refunds, transfers, membership freezes and payment disputes, as well as to comply with our legal and accounting obligations.

  1. Health and wellbeing information

If you participate in yoga therapy, private yoga sessions, hypnotherapy, Ayurvedic consultations or related wellbeing services, you may choose to share information relevant to your session.

Depending on the service, this may include information about physical limitations, injuries, medical history, medications, stress, emotional wellbeing, lifestyle, dietary habits or other health-related matters.

Health information is considered a special category of personal data under the GDPR and receives additional protection.

We will collect and process such information only where necessary for the relevant service and where an applicable legal basis under the GDPR permits it. Where required, we will obtain your explicit consent or another valid legal basis before processing it.

Please share only the information relevant to your session. You are not required to provide health information simply to browse our website or receive general studio information.

  1. Website and technical information

When you visit our website, certain technical information may be collected automatically, depending on the website functionality and your cookie preferences. This may include:

  • IP address and device information.
  • Browser type and operating system.
  • Pages visited and interactions with the website.
  • Date and time of visits.
  • Referring website or source.
  • Cookie identifiers and similar technical data, where applicable.

We use this information where necessary to operate, maintain and secure our website, understand website performance and improve the visitor experience.

Non-essential analytics or advertising technologies will be used only in accordance with applicable consent requirements.

  1. How Do We Use Your Information?

We use your personal information for the following purposes:

  • To manage class registrations, bookings and attendance.
  • To administer memberships, class packages, payments and related requests.
  • To provide private yoga, yoga therapy, hypnotherapy, Ayurvedic consultations and other services you request.
  • To organise workshops, retreats and events.
  • To respond to enquiries and communicate with you about your bookings or services.
  • To send booking confirmations, important updates, cancellations or changes to studio schedules.
  • To manage refunds, membership freezes, transfers and other membership-related matters.
  • To send newsletters, invitations, promotions and information about new offerings where legally permitted.
  • To maintain our website, understand its use and improve its functionality.
  • To protect the security of our services and prevent misuse or fraud.
  • To maintain appropriate business and accounting records.
  • To comply with legal obligations and establish, exercise or defend legal claims where necessary.

We will not use your personal information for purposes that are incompatible with the purposes described above without providing any additional information and obtaining consent where required.

  1. Legal Grounds for Processing

Under the GDPR, we must have a valid legal basis for processing personal data.

Depending on the circumstances, we rely on one or more of the following:

Performance of a contract: To manage your bookings, provide services you have purchased, administer memberships and process related requests.

Legal obligations: To maintain accounting and tax records, respond to lawful requests and comply with applicable Greek or EU legislation.

Legitimate interests: To manage our business, maintain the security of our website, respond to enquiries, protect our legal rights and improve our services, provided these interests do not override your rights and freedoms.

Consent: To send marketing communications where consent is required, use non-essential cookies where applicable, or process health-related information when explicit consent is the appropriate legal basis.

Other applicable legal grounds: Where relevant, we may rely on another legal basis expressly permitted by the GDPR.

Where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

  1. Health Information and Confidentiality

We understand that information shared during private sessions and wellbeing consultations can be personal and sensitive.

We aim to handle such information with care, discretion and confidentiality.

Health-related information will be accessible only to those who need it for a legitimate and authorised purpose. We will not disclose information about your private sessions or consultations to other students, members or retreat participants.

We will not use information about your health, emotional wellbeing or private consultations for marketing purposes without a separate, appropriate legal basis.

We may disclose information where required by law or where another valid legal ground permits disclosure.

Please note that not every wellbeing service is legally classified as healthcare. The legal basis for processing sensitive information will depend on the nature of the service and the applicable circumstances.

  1. Newsletters and Marketing Communications

If you subscribe to our newsletter or choose to receive promotional communications, we may use your name and email address to send you information about:

  • Yoga classes and studio updates.
  • Workshops, retreats and special events.
  • Hypnotherapy and Ayurvedic services.
  • Online programmes, guided meditations and audio recordings.
  • New offerings, promotions and other relevant news from White Lotus.

Where required, we will obtain your consent before sending marketing emails.

You can unsubscribe at any time by clicking the unsubscribe link in the relevant email or contacting us directly.

Unsubscribing from marketing communications will not prevent us from sending essential messages relating to an existing booking, purchase, membership or other service where those messages are necessary.

We may use a third-party email marketing provider to manage subscriptions and deliver emails. Such providers may process your information on our behalf in accordance with applicable data protection requirements.

  1. Cookies, Analytics and Advertising

Our website may use cookies and similar technologies to support essential website functions, remember preferences, measure website performance and, where enabled, support marketing activities.

Cookies may be set by our website or by third-party services integrated into it.

Depending on the tools installed on our website, these services may include website analytics, social media integrations, advertising measurement or payment functionality.

Strictly necessary cookies may be used where legally permitted. Non-essential analytics and advertising cookies will be activated only where the required consent has been obtained.

You can manage your cookie preferences through the cookie settings available on our website, where provided, and through your browser settings.

If we use Google Analytics, Meta Pixel or similar advertising technologies, their use will be subject to the applicable consent requirements and the privacy terms of the relevant provider.

The specific cookies and third-party technologies in use may change as our website develops. We will provide appropriate information about the technologies actually used on our website.

  1. Who May Receive Your Personal Information?

We do not sell your personal data.

We may share personal information only where necessary and lawful with the following categories of recipients:

Service providers: Website hosting, booking and scheduling systems, email marketing platforms, payment processors, online service providers and IT support providers.

Professional advisers: Accountants, legal advisers and other professional service providers where necessary.

Public authorities: Tax authorities, courts, regulators or law enforcement authorities where disclosure is required by law or is otherwise lawfully permitted.

Event and retreat providers: Where a retreat or event is organised jointly with another provider, we may share the information necessary to manage your participation, provided there is an appropriate legal basis and you have been adequately informed.

We require service providers processing personal data on our behalf to meet applicable data protection obligations. Where required by law, appropriate data processing agreements will be in place.

We do not share sensitive information from private sessions with third parties for unrelated purposes.

  1. International Data Transfers

Some of the service providers we use may process or store personal information outside Greece or the European Economic Area (EEA).

Where personal data is transferred outside the EEA, we will ensure that the transfer complies with the GDPR and that an appropriate safeguard or other lawful transfer mechanism is in place where required.

Such safeguards may include an applicable European Commission adequacy decision or approved Standard Contractual Clauses.

Further information about relevant safeguards may be requested using our usual communication channels.

  1. How Long Do We Keep Your Information?

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, subject to applicable legal requirements.

Retention periods depend on the type of information and the reason for processing.

  • Bookings and membership records: For the duration of the relevant membership or service and for a reasonable period afterwards to manage queries, disputes and related obligations.
  • Financial and accounting records: For the periods required by applicable Greek tax and accounting legislation.
  • Health and consultation information: Only for as long as necessary for the relevant service, applicable legal obligations and any legitimate need to establish or defend legal claims.
  • Newsletter subscriptions: Until you unsubscribe or withdraw your consent, subject to limited records retained where necessary to document your preferences.
  • Website and technical data: For the period necessary for security, analytics or other disclosed purposes, according to the relevant settings and provider retention policies.
  • Legal claims and disputes: For as long as necessary to establish, exercise or defend legal claims, where applicable.

When personal data is no longer required, we will delete it or anonymise it securely, unless we are legally required or otherwise lawfully permitted to retain it.

  1. How Do We Protect Your Information?

We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

These measures may include access restrictions, secure systems, appropriate password practices and the use of service providers with suitable security measures.

Where payment information is handled by third-party providers, the security measures of those providers also apply.

However, no method of electronic transmission or storage is completely secure. Although we take reasonable precautions, we cannot guarantee absolute security.

If a personal data breach occurs, we will take the steps required under applicable data protection law, including notifying the relevant supervisory authority or affected individuals where required.

  1. Your Rights Under the GDPR

Subject to the conditions and limitations set out in applicable law, you may have the right to:

  • Access: Request confirmation of whether we process your personal data and obtain a copy.
  • Rectification: Request correction of inaccurate or incomplete information.
  • Erasure: Request deletion of your personal data where the legal requirements are met.
  • Restriction: Request that we restrict certain processing activities.
  • Data portability: Receive certain data you have provided in a structured, commonly used and machine-readable format, where applicable.
  • Object: Object to processing based on legitimate interests, where applicable.
  • Withdraw consent: Withdraw consent at any time where processing is based on consent.
  • Object to direct marketing: Stop the use of your personal data for direct marketing.
  • Lodge a complaint: Submit a complaint to the competent data protection supervisory authority.

You may exercise these rights by contacting White Lotus through our usual communication channels.

We may need to verify your identity before responding. We will respond within the time limits required by the GDPR, generally within one month of receiving your request, subject to lawful extensions where permitted.

Some requests may be subject to legal exceptions. For example, we may need to retain certain financial records to comply with tax legislation even if you request their deletion.

  1. Complaints to the Supervisory Authority

If you believe that your personal data has been processed in breach of applicable data protection law, you may contact us so that we can try to address your concerns.

You also have the right to lodge a complaint with the competent supervisory authority.

In Greece, the supervisory authority is:

Hellenic Data Protection Authority (HDPA)

Website: https://www.dpa.gr/

The Authority provides information about data protection rights and the procedure for submitting complaints.

  1. Links to Other Websites

Our website may contain links to third-party websites, booking platforms, payment providers, social media platforms or other external services.

We are not responsible for the privacy practices of websites that we do not operate.

When you visit an external website or use a third-party service, we encourage you to review its privacy policy and terms of use.

  1. Photographs, Testimonials and Social Media

From time to time, we may wish to share photographs, videos, testimonials or other content relating to our classes, workshops, retreats or community activities.

We will seek the necessary permission or other appropriate legal basis before publishing identifiable photographs, testimonials or personal information where required by law.

Participation in a yoga class, workshop or retreat does not automatically mean that you agree to have your image or personal story published.

You may ask about the use of your image or testimonial, or withdraw consent where consent is the applicable legal basis. Withdrawal will not affect the lawfulness of use before withdrawal.

We will not publish details of your private consultations, health information or personal disclosures for promotional purposes without a separate and appropriate legal basis.

  1. Children’s Privacy

Our services and website are primarily intended for adults.

If a class, retreat, workshop or other service is offered to a child, we will handle the child’s personal data in accordance with applicable law and take account of the child’s age, the nature of the service and any required parental or guardian involvement.

We do not knowingly collect children’s personal data for unrelated purposes.

If you believe that a child has provided personal information to us inappropriately, please contact us through our usual communication channels so that we can review the matter and take any necessary action.

  1. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our services, website functionality, business practices or legal obligations.

The latest version will be published on our website with the updated “Last updated” date.

Where required by law, we will provide additional notice of material changes.

We encourage you to review this policy periodically.

  1. Contact Us

If you have questions about this Privacy Policy, how your personal information is used, or how to exercise your data protection rights, you may contact White Lotus Yoga Studio through the communication channels available on our website.

Scroll to Top