Privacy Policy
Last updated: July 30, 2026
Yoga La Source respects your privacy and is committed to protecting your personal data. This policy explains what personal data we collect, why we collect it, who we share it with, and what rights you have under the General Data Protection Regulation (GDPR) and Luxembourg law.
1. Who we are
Yoga La Source is the data controller responsible for your personal data.
- Business name: Yoga La Source
- Siège Social: 25, rue Josy Welter, L-7256 Walferdange
- RCS Registration number: B161069
- Contact email: info@yoga.lu
2. What personal data we collect
Depending on how you interact with our site, we collect:
Account and registration data: name, email address, phone numbers (optional) and information about the classes, terms, or events you register for. If you ever attended an INFINY workshop, we asked for your street address and nationality. INFINY no longer exits but these records remain and can be expunged upon your request.
Newsletter data: if you create an account with us, you are automatically subscribed to three account-related newsletters:
- Registration Renewal (priority re-registration reminders each term)
- Term Schedule
- Workshop & News
Every newsletter includes an unsubscribe link, and you can manage these subscription preferences at any time from your profile (top right of the site).
Separately, if you don't have an account, you can opt-in to a general newsletter through a sign-up form (Google Forms), which also includes an unsubscribe link in every email.
Payment data: when you pay by credit card, your card details are entered directly into Stripe's secure payment form and are never seen or stored by us. We retain only the resulting transaction record (amount, date, payment status). If you pay by bank transfer, we retain the amount owed/paid and related registration details.
Technical and usage data: if you consent to analytics and advertising cookies through our cookie banner (see Section 6), we (via Google Tag Manager) collect information, without knowing it's you, such as pages viewed, links and buttons clicked, general context (page language/course/event), and similar interaction data, associated with cookies or similar identifiers stored on your device so we can offer more what interests students.
3. Why we use your data
| Purpose | Data used |
|---|---|
| Processing your class, term, or event registration | Account/registration data |
| Processing your payment | Payment data |
| Sending registration confirmations and related service emails | Account/registration data, email |
| Sending account-related newsletters (Registration Renewal, Term Schedule, Workshop & News) | Newsletter data |
| Sending our general newsletter to non-account subscribers | Newsletter data |
| Understanding site usage and improving our services (analytics) | Technical/usage data |
| Measuring the effectiveness of our advertising | Technical/usage data |
| Complying with legal obligations (e.g. accounting records) | Payment/transaction data |
You may withdraw consent (newsletter, analytics, advertising cookies) at any time without affecting the lawfulness of processing carried out before withdrawal.
4. Who we share your data with
We use the following third-party service providers ("processors") to operate our site and services. Each only receives the data necessary to perform its function for us, and each has its own privacy policy governing how it handles data.
Amazon Web Services, Inc. (AWS) — hosts our website and the underlying database, including account, registration, and transaction records stored on our behalf. AWS Privacy Notice
Stripe, Inc. / Stripe Payments Europe, Ltd. — processes credit and debit card payments for registrations. Your full card details are handled directly by Stripe and are not stored on our servers. Stripe Privacy Policy
The Rocket Science Group LLC (Mailchimp), via Mandrill — Mandrill is Mailchimp's email delivery service, used to send our newsletter to subscribers. Mailchimp Privacy Policy
Google LLC — Google Forms is used to collect newsletter subscription requests (name, email, consent). Google Tag Manager and Google Analytics (GA4) are used to understand how visitors use our site via cookies and similar technologies. Google Privacy Policy
Meta Platforms, Inc. (Facebook Pixel) — (soon to be removed) used to measure and improve the effectiveness of our advertising by tracking certain registration events (e.g. course or waitlist registrations) via cookies. This may allow Meta to associate this activity with a Facebook or Instagram account, subject to your cookie/ad preferences with Meta. Meta Privacy Policy
Rubyroid Labs — our website development partner, with access to our codebase and underlying database as needed to build, update, and maintain the site's features. Rubyroid Labs Privacy Policy
We do not sell your personal data to third parties.
5. Cookies
- Strictly necessary purposes (e.g. keeping you logged in, remembering your registration in progress) — these do not require consent.
- Analytics (Google Analytics via Google Tag Manager) — helps us understand how the site is used.
- Advertising measurement (Meta/Facebook Pixel - soon to be removed) — helps us measure the effectiveness of our advertising.
We use a cookie consent banner, provided by Silktide, when you first visit our site. It lets you choose to accept only strictly necessary cookies, or to also allow analytics and advertising cookies. Non-essential cookies (including Google Analytics and Meta/Facebook Pixel) are not set until you consent. You can change your cookie preferences at any time using the cookie settings link available on our site.
6. How long we keep your data
- Account and registration data: for as long as you have an active relationship with us, and for 10 years afterward as required for accounting and legal purposes under Luxembourg law.
- Payment/transaction records: 10 years, in line with Luxembourg accounting record-keeping requirements.
- Newsletter data: until you unsubscribe or withdraw consent.
- Analytics/advertising cookie data: in line with the retention periods set by Google Analytics and Meta (typically 14–26 months).
7. Your rights
Under the GDPR, you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate or incomplete data
- Erase your data ("right to be forgotten"), subject to legal retention obligations
- Restrict or object to certain processing
- Data portability — receive your data in a portable format
- Withdraw consent at any time, for processing based on consent
- Lodge a complaint with a supervisory authority
To exercise any of these rights, contact us at info@yoga.lu.
If you believe your data protection rights have not been respected, you have the right to lodge a complaint with Luxembourg's data protection authority:
Commission Nationale pour la Protection des Données (CNPD) 1, avenue du Rock'n'Roll, L-4361 Esch-sur-Alzette, Luxembourg, cnpd.public.lu
8. Data security
We take reasonable technical and organizational measures to protect your personal data against unauthorized access, loss, or misuse, including relying on the security measures provided by our hosting and payment providers (AWS, Stripe).
9. Children
Our services are not directed at children, and we do not knowingly collect personal data from children without appropriate parental consent where required by law.
10. Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top will reflect the most recent revision. Significant changes will be communicated where appropriate.
11. Contact us
For any questions about this policy or how we handle your data, contact us at info@yoga.lu.