Privacy Policy

As of October 9, 2026

1. Introduction

At The OM LAB, we take the protection of your personal data seriously. This privacy policy explains how we collect, use, store, and protect your personal data when you visit our website. https://www.the-om-lab.com you visit our website or contact us in connection with our offerings in the areas of yoga, sound healing, workshops, immersions and private lessons.

The processing of personal data is carried out in accordance with the General Data Protection Regulation (GDPR) and the applicable German data protection laws.

2. Responsible parties

The entity responsible for data processing on this website is:

The OM LAB
Janina Schneider
Steady and Aligned Yoga
Steinheilstrasse 2
80333 Munich
Germany

E-mail: privacy@the-om-lab.com

3. Supervisory authority

You have the right to lodge a complaint with a competent data protection supervisory authority.

In Bavaria, the following supervisory authority is responsible for non-public bodies under the GDPR:

Bavarian State Office for Data Protection Supervision (BayLDA)
Promenade 18
91522 Ansbach
Germany

Website: https://www.lda.bayern.de/

4. Your rights

Under the GDPR, you have the following rights regarding your personal data, subject to the applicable legal requirements:

Right to information about your personal data (Art. 15 GDPR)
Right to rectification of inaccurate or incomplete data (Art. 16 GDPR)
Right to erasure (Art. 17 GDPR)
Right to restriction of processing (Art. 18 GDPR)
Right to data portability (Art. 20 GDPR)
Right to object to processing (Art. 21 GDPR)
Right to withdraw consent at any time with effect for the future (Art. 7 para. 3 GDPR)
Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

If the processing is based on consent, the lawfulness of the processing carried out until the withdrawal of consent remains unaffected.

If you wish to exercise any of these rights, please contact us at:

privacy@the-om-lab.com

5. Legal basis for data processing

We only process personal data if there is a valid legal basis. Depending on the processing purpose, the following legal bases may be considered in particular:

Article 6 paragraph 1 letter a GDPR – Consent
Article 6 paragraph 1 letter b GDPR – Contract performance or implementation of pre-contractual measures
Article 6(1)(c) GDPR – Compliance with a legal obligation
Article 6(1)(f) GDPR – Legitimate interests

Our legitimate interests may include operating a secure and functional website, answering general inquiries, and efficient business communication.

If special categories of personal data, such as health data, are processed, an additional legal basis is required in accordance with Article 9 GDPR.

The applicable legal basis depends on the specific processing operation and is explained in the relevant sections of this privacy policy.

6. What data we collect

Contact details

If you contact us via our contact form, email, WhatsApp or other communication channels, we may collect the following data:

First and Last Name
E-mail address
Telephone number, if provided
Content of your message
Type of requested event or service
Number of participants
Desired dates and duration
Selected experiences or services
Additional information that you voluntarily submit in connection with your request

We use this information to process your request, communicate with you and, if necessary, prepare or process a booking.

Health data

In connection with private lessons, workshops or other services, you may voluntarily provide us with information about injuries, physical limitations, illnesses, pregnancy or other health conditions that may be relevant to your participation.

We only use this information to the extent necessary to appropriately adapt the practice and support your safe participation.

Since health data constitutes a special category of personal data within the meaning of the GDPR, we process it only to the extent permitted by law. This includes, where necessary, your explicit consent in accordance with Article 9(2)(a) GDPR.

Insofar as the processing is based on your express consent, you can revoke this consent at any time with effect for the future.

Health data is treated confidentially and not used for marketing purposes.

Please do not submit sensitive health data via general contact forms on the website unless you have been explicitly asked to do so and there is a suitable legal basis.

Technical data

When you visit our website, certain technical information related to the operation and security of the website may be processed automatically.

This can include:

IP address
Browser type and browser version
Operating system and device information
Referrer URL
Date and time of access
Pages or resources accessed
Technical connection and error information

This data is primarily processed to ensure the technical operation, stability, availability and security of the website.

The legal basis is Art. 6 para. 1 lit. f GDPR based on our legitimate interest in operating a secure and functional website.

7. Contact forms and inquiries

Our website offers contact forms through which you can request information about workshops, private lessons and other services.

When you submit a contact form, we process your information to answer your request and, if necessary, prepare a booking.

Our website is powered by the United Domains website builder, which uses Duda technology.

Form submissions are processed via the website platform and stored in its form management system. We can view and manage them there.

In addition, we receive notifications about incoming form requests at our designated business email address.

An automatic confirmation of receipt can be sent to the email address provided in the form.

The processing is carried out on the following legal bases:

Article 6 paragraph 1 letter b GDPR, if your request relates to a booking, a contract or pre-contractual measures.
Article 6 paragraph 1 letter f GDPR for other general inquiries, based on our legitimate interest in answering messages.

We store the information from inquiries only as long as necessary to process the inquiry and any resulting business relationship. Statutory retention obligations remain unaffected.

We delete information that is no longer needed from the systems accessible to us in accordance with applicable legal requirements. The regulations of the respective service provider may apply to the retention of technical backup copies.

Information from contact forms will not be automatically used for newsletter registrations or marketing purposes.

8. How we obtain your data

Your personal data may be collected if:

You contact us via a contact form or by email.
You subscribe to a newsletter, if one is offered.
You communicate with us via WhatsApp
You visit or interact with our website
You interact with our Instagram presence
You make a booking or payment
You voluntarily provide health data in connection with an inquiry, booking or participation in our offers.

9. Purposes of data processing

We process personal data for the following purposes:

Answering inquiries and customer support
Management of bookings and private lessons
Conducting yoga classes, immersions, workshops and sound healing sessions
Sending newsletters and relevant news, provided valid consent has been obtained.
Maintaining and improving website functionality
Website security and technical administration
Payment processing
Fulfillment of legal obligations

We do not use personal data without a suitable legal basis for purposes that are incompatible with the purposes described in this privacy policy.

10. Communication via WhatsApp

If you contact us voluntarily via WhatsApp, we process your phone number, the content of your messages and other information you provide in order to answer your request.

Depending on the nature of your request, processing is based on Art. 6 para. 1 lit. b GDPR or Art. 6 para. 1 lit. f GDPR.

WhatsApp is a service provided by Meta Platforms. When using WhatsApp, personal data may also be processed by WhatsApp/Meta in accordance with its own privacy policy.

You can find more information in the WhatsApp Privacy Policy.

11. Instagram

Our website contains links to our Instagram page.

These are external links. If you click on them, you will leave our website and be redirected to Instagram.

When you use Instagram or interact with our Instagram presence, personal data may be processed by Meta Platforms in accordance with their own privacy policy.

You can find more information in the Instagram's privacy policy.

12. Payments via Stripe

We use Stripe as a payment service provider for processing online payments.

Our website may contain links to payment pages provided by Stripe, through which workshops and other paid services can be booked.

If you follow a payment link, you will be redirected to Stripe's payment environment.

Depending on the payment process, personal data such as your name, billing address, email address, payment details and transaction information may be processed by Stripe and participating payment partners.

The legal basis for the processing of personal data required for payment processing and fulfillment of a booking is Art. 6 para. 1 lit. b GDPR.

Additional processing by Stripe may occur if required by law or if it serves payment security and fraud prevention. The respective legal requirements apply in this case.

Payment information is processed in accordance with Stripe's applicable data protection regulations and the data protection roles of the parties involved.

You can find more information in the Stripe's privacy policy.

13. Hosting and website builder

Our website is powered by the United Domains website builder.

Services and infrastructure from or in connection with United Domains, IONOS SE and Duda Inc. are used for the provision and technical operation of the website.

When you access our website, technical information may be processed to provide website content and to ensure availability, security and performance.

This may include IP addresses, requested resources, referrer information, browser and device information, access times, and technical connection data.

The website also uses the infrastructure of Content Delivery Networks (CDN) to provide technical resources such as images, stylesheets, JavaScript files and fonts.

Resources can be delivered via the following domains, among others:

cdn.website-editor.net
static-cdn.website-editor.net
le-cdn.website-editor.net
static-cdn.dwhitelabel.com

Other technical service providers may be involved in the deployment infrastructure, including providers of content delivery networks and cloud infrastructure.

When such resources are accessed, technical connection data, including the visitor's IP address, may be transmitted to the infrastructure responsible for delivering the requested resource.

The legal basis for operating the website and providing technically necessary resources is Art. 6 para. 1 lit. f GDPR based on our legitimate interest in a secure, stable and functional website.

Information on possible processing outside the European Economic Area can be found in the section on international data transfers.

14. Fonts

Our website uses different fonts to ensure a consistent appearance.

Stylesheets and font files are provided via our website provider's content delivery infrastructure, including cdn.website-editor.net.

Technical tests of the website showed that the fonts on the tested pages were delivered via the website provider's infrastructure and not directly from Google's font servers.

When accessing these resources, technical connection data, including the visitor's IP address, may be transmitted to the respective infrastructure provider.

The processing of technically necessary connection data is based on Art. 6 para. 1 lit. f GDPR and our legitimate interest in a functional and uniform presentation of the website.

15. Cookies and similar technologies

Our website may use technically necessary storage mechanisms and similar technologies that are required for the functionality and security of the website and the provision of requested services.

This may include technically necessary browser storage, caching mechanisms and other functions of the website platform.

The optional analytics and tracking features available via the United Domains website builder are currently disabled.

Technical tests of the examined pages revealed no active tracking by Google Analytics or Meta Pixel during the logged page views.

These observations do not rule out the possibility that, under other circumstances, technical storage mechanisms or services may be used that are activated by user interaction.

Insofar as access to or storage of information on a user's terminal device is absolutely necessary to provide a service expressly requested by the user, consent may be unnecessary in accordance with Section 25 Paragraph 2 TDDDG.

Should technologies requiring consent be introduced, they will only be used after the necessary consent has been obtained in accordance with applicable legal requirements.

You can also manage certain storage settings via your browser.

16. Storage duration

We only store personal data for as long as is necessary for the purposes for which it was collected or as long as further storage is required by law.

The storage period depends on the type of information and the processing purpose.

In particular, the following applies:

General inquiries will be kept for as long as necessary to answer them and to process any relevant follow-up questions.
Booking and transaction documents may be stored for the applicable statutory accounting, tax and commercial law retention periods.
Data relating to newsletter registration will be processed until consent is withdrawn or the subscription is cancelled. Legally required documentation of consent remains unaffected.
Health data is stored only as long as it is necessary for the respective purpose and as long as a valid legal basis continues to exist.
Technical access and security data are stored in accordance with the applicable operational and security-related requirements of the responsible service providers.

Once the respective purpose ceases to apply and statutory retention periods have expired, personal data will be deleted or anonymized in accordance with applicable legal requirements.

17. Disclosure of data to third parties

We do not sell your personal data.

Personal data may be transferred to or made accessible to third parties to the extent necessary for the purposes described in this privacy policy.

Depending on the service used, this may include:

Providers of website hosting and technical infrastructure
Provider of the website builder and form processing
Email and communication service provider
Newsletter service provider, if used
Payment service provider
Providers of appointment scheduling and booking services
Authorities, insofar as a legal disclosure obligation exists

Depending on their role in the respective processing, service providers may act as data processors on our behalf or as independent controllers.

Where legally required, appropriate contractual agreements will be concluded, including data processing agreements pursuant to Article 28 GDPR.

18. Data transfers outside the European Economic Area

Some of the technical and external services used in connection with our website, communication or payment processing may involve the processing of or access to personal data outside the European Economic Area (EEA).

When transferring personal data to countries outside the EEA, we take into account the applicable requirements of Chapter V of the GDPR.

Depending on the service provider and the specific circumstances, transfers may be based on an adequacy decision by the European Commission or suitable safeguards, such as the European Commission's standard contractual clauses.

Where legally required, additional measures will be taken to ensure an adequate level of protection.

For information on the guarantees applicable to a specific data transfer, you can contact us at privacy@the-om-lab.com contact.

19. Data security

We implement appropriate technical and organizational security measures to protect personal data against loss, misuse, unauthorized access, alteration or disclosure.

Our website uses HTTPS to encrypt communication between visitors' browsers and the website.

Access to personal data is restricted to individuals and service providers who need it for the respective processing purposes.

However, complete security of data transmission over the Internet cannot be guaranteed.

20. Children

Our offers and our website are not specifically aimed at children under 16 years of age.

Where parental consent is required under applicable data protection law, we do not knowingly process personal data of children on the basis of consent without the necessary approval.

21. Changes to this Privacy Policy

We may update this privacy policy as needed to reflect legal, technical, or business developments.

The most current version is published on this website.

22. Contact

For questions regarding data protection, personal data, or this privacy policy, please contact:

The Om Lab
Janina Schneider
E-mail: privacy@the-om-lab.com