Datenschutzerklärung

Zuletzt aktualisiert: 11. November 2026

Dieses Dokument ist auf Englisch verfasst. Wird es in einer anderen Sprache angezeigt, ist die englische Fassung rechtlich verbindlich.

1. Who we are

7 Buddhas Yoga and Massage Center Paphos is operated by AA7 LTD (HE 495504, VAT 60398932Q), Adamantiou Korai 2, House 2, Tala 8577, Paphos, Cyprus (“we”, “us”). We are the data controller for the personal data described in this policy. Contact: info@7buddhas.com, +357 95 557774, Poseidonos Avenue 47, Limnaria Westpark, Phase 1, Shop 50, Paphos 8042, Cyprus.

This policy explains what personal data we collect, why, on which legal basis, who we share it with, how long we keep it and what rights you have under the EU General Data Protection Regulation (GDPR) and Cyprus law (Law 125(I)/2018).

2. What data we collect

Contact and booking data: your name, phone number, email address (if given), the service, date and time, number of guests, preferred therapist and any messages you send us by WhatsApp, phone, email or our website.

Health data: information you give us about medical conditions, injuries, medication, allergies or pregnancy, so that your treatment is safe. This is special category data and we use it only for your treatment.

Gift voucher data: buyer’s name and email, the names and message to appear on the voucher, voucher code, value and status, and confirmation of payment. If you pay by card on our website, your card details are entered directly with our payment provider, Stripe. We do not see or store them.

Website data: if you accept statistics cookies, Google Analytics collects information about how the website is used (pages, buttons, approximate location, device and browser). If you choose to show the map, Google Maps may collect data. See our Cookie Policy.

We do not knowingly collect data from children under 18.

3. Why we use your data and the legal basis

To arrange, confirm, change and provide your bookings and to contact you about them: performance of a contract (GDPR Art. 6(1)(b)).

To keep your treatment safe using the health information you give us: your explicit consent (GDPR Art. 9(2)(a)), which you may withdraw at any time; without it we may not be able to provide certain treatments.

To issue, send and manage gift vouchers and process payments: performance of a contract.

To keep accounting and tax records: legal obligation (GDPR Art. 6(1)(c)).

To protect our business, staff and guests, to keep records of missed or late-cancelled bookings and conduct incidents, and to establish, exercise or defend legal claims: our legitimate interests (GDPR Art. 6(1)(f)).

To measure website use with Google Analytics and to show Google Maps: your consent (GDPR Art. 6(1)(a)), which you may withdraw at any time in Cookie settings.

4. Who we share data with

We do not sell your personal data. We share it only where needed: with the therapist providing your treatment; with service providers who process data for us, such as WhatsApp (Meta), our email provider, Stripe (card payments), Netlify (website hosting and voucher records) and Google (Analytics and Maps, only with your consent); with our accountant and auditors; and with authorities, courts or police where the law requires it or to protect our rights, staff or guests.

5. Transfers outside the EU

Some service providers (for example Meta, Google, Stripe and Netlify) may process data outside the European Economic Area, including in the United States. Such transfers rely on an adequacy decision of the European Commission (such as the EU–US Data Privacy Framework) or on the European Commission’s Standard Contractual Clauses.

6. How long we keep data

Booking messages and contact details: as long as needed to provide your bookings and for up to 2 years after your last visit, unless a longer period is needed for a claim.

Health information: only as long as you are our client and for up to 2 years after your last visit, unless a longer period is needed to defend a legal claim.

Gift voucher records: until the voucher has been used or has expired, and then as part of our accounting records.

Accounting and tax records: for the period required by Cyprus law (normally 7 years).

Records of conduct incidents and missed bookings: as long as needed to protect our staff and business.

Analytics data: according to the retention set in Google Analytics (up to 14 months).

7. Security

We take reasonable technical and organisational measures to protect your data against loss, misuse and unauthorised access. No method of transmission over the internet or electronic storage is completely secure, so we cannot guarantee absolute security.

8. Your rights

You have the right to access your data, to have it corrected, to have it deleted, to restrict or object to its use, to data portability, and to withdraw your consent at any time (this does not affect processing done before). Some rights are limited by law, for example where we must keep accounting records.

To use your rights, write to info@7buddhas.com. We may ask you to confirm your identity. We reply within one month.

You also have the right to complain to the Office of the Commissioner for Personal Data Protection, Iasonos 1, 1082 Nicosia, Cyprus, www.dataprotection.gov.cy.

9. Automated decisions

We do not make decisions about you based solely on automated processing, and we do not use your data for profiling.

10. Changes

We may update this policy at any time. The current version is always on this page, with the date it was last updated.