Privacy Policy

Last updated: Oct 24, 2026

Who we are

The Cozy Retreat respects your privacy and only uses your personal data in the ways described here. This policy explains what we collect through www.cozyretreatthailand.com, our forms, emails and social media, and how we protect it.

The data controller is Harmony Peace Living Co.Ltd, operating as The Cozy Retreat, 524 Moo 2, Ban Ao Nang, Krabi 81000, Thailand. Contact us about privacy at aonangretreats@gmail.com.

We follow Thailand's Personal Data Protection Act B.E. 2562 (2019) (PDPA). Where the EU or UK General Data Protection Regulation (GDPR) applies to you, we also follow it.

What we collect

We only collect what we need to answer you, run your training or retreat, and keep in touch if you ask us to.

Contact and booking details: name, email, phone or WhatsApp number, country, the training or retreat you are interested in, preferred dates, and anything you write in your message.
Booking and payment records: what you booked, amounts paid and payment dates. Card details are handled by our payment provider; we do not store them.
Training records: attendance, assessments and certificates, which we need to issue your Yoga Alliance certificate.
Health information you choose to share: see "Health information" below.
Newsletter data: your email address, the date you subscribed, and whether you open or click our emails.
Website data: technical details such as IP address, browser and pages visited, collected through cookies (see "Cookies").
Photos and videos: taken during classes, trainings and retreats, used publicly only with your permission.

How and why we use it

Each use below relies on a lawful basis under the PDPA and GDPR.

Answering your questions and booking requests: steps you ask us to take before a contract
Running your training or retreat, issuing certificates: contract
Keeping accounting and tax records: legal obligation
Sending our newsletter and offers: your consent
Using health information to teach you safely: your explicit consent
Sharing photos or videos of you publicly: your consent
Keeping the website secure and working, blocking spam: legitimate interests

We never sell your personal data or rent our mailing list to anyone.

Newsletter and marketing emails

We only send newsletters and offers to people who have opted in, by ticking the consent box on our signup form. After signing up, you will get an email asking you to confirm your subscription.

Booking a training or contacting us does not add you to our newsletter. You can unsubscribe at any time with the link at the bottom of every email, or by writing to us. Unsubscribing does not affect any booking you have with us.

Health information

Before a training or retreat, we may ask about injuries, health conditions or pregnancy so we can teach you safely. Sharing this is your choice, and we only collect it with your explicit consent.

Only your teachers see it, and only to adapt your practice. We delete it within one year after your training or retreat ends, unless you ask us to delete it sooner.

Services we use

We share personal data only with providers who help us run The Cozy Retreat, and only what each one needs.

Wix hosts our website and its contact forms. Data may be processed in the United States and other countries.
Brevo sends our newsletter and stores subscriber emails. Data is processed in the European Union.
Google reCAPTCHA blocks spam on our forms. Data may be processed in the United States and other countries.
Instagram and Threads (Meta) host our social media pages and messages. Data may be processed in the United States and other countries.

We may also share data with authorities when the law requires it, and with Yoga Alliance when registering your certification, if you ask us to.

Cookies

Our website uses cookies, small files stored in your browser. Essential cookies make the site and its forms work. Analytics cookies, set by our website host Wix, help us understand which pages people visit.
You can block or delete cookies at any time in your browser settings. Blocking essential cookies may stop parts of the site, such as our forms, from working.

International transfers

Some of our providers process data outside Thailand, as listed above. When that happens, we rely on the provider's legal safeguards, such as standard contractual clauses, so your data stays protected to the standard Thai and EU law require.

How long we keep it

We keep personal data only as long as we need it.

Enquiries that don't lead to a booking: 12 months after our last contact
Booking and payment records: as long as Thai tax and accounting law requires, usually 5 years
Training records and certificates: 10 years, so we can confirm your certification if asked
Health information: 12 months after your training or retreat
Newsletter subscription: until you unsubscribe

Your rights

You have the right to:

see the personal data we hold about you and get a copy
correct anything that is wrong or incomplete
ask us to delete your data, or limit how we use it
withdraw your consent at any time, including unsubscribing from emails
object to how we use your data
receive your data in a format you can take elsewhere
complain to Thailand's Personal Data Protection Committee (PDPC), or to the data protection authority in your country

To use any of these rights, email aonangretreats@gmail.com. We will reply within 30 days.

Security, children and changes

We protect your data with password-protected accounts, limited access, and providers with strong security. No system is perfectly secure, so if a breach puts your data at risk, we will tell you and the authorities as the law requires.

Our trainings and retreats are for adults. We do not knowingly collect data from anyone under 20 without a parent or guardian's consent.

We may update this policy from time to time. The date at the top shows the latest version, and we will email subscribers about any major change.

Questions? Contact us at aonangretreats@gmail.com.