GDPR Privacy Policy

1. Purpose

The purpose of this policy is to outline how Arunachala Rejuvenation Centre collects, stores, uses, and protects personal data in compliance with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018. Our priority is to safeguard client, guest, staff, and supplier information while ensuring transparency, confidentiality, and security.

2. Scope

This policy applies to:

  • All clients, guests, and visitors of the retreat centre.

  • All employees, contractors, and volunteers.

  • Any third parties engaged in services requiring access to personal data (e.g., booking platforms, accounting, insurance providers).

3. Types of Data Collected

We collect and process the following categories of personal data:

  • Identification Data: Name, address, email, phone number.

  • Booking & Payment Data: Dates of stay, services booked, payment details (processed securely via third-party payment systems).

  • Health & Wellness Data: Relevant health information, allergies, or conditions provided for safe and appropriate treatment.

  • Staff and Contractor Data: Employment details, payroll information, and performance records.

  • Marketing Preferences: Consent status for newsletters, promotions, or service updates.

4. Lawful Basis for Processing

Data is processed under the following lawful bases:

Purpose

Booking and managing reservations

Delivering treatments and retreats safely

Managing payments and invoicing

Marketing communications

Legal, insurance, or compliance purposes

Lawful Basis

Contractual necessity

Vital interests / Explicit consent for health data

Legal and contractual obligations

Consent (opt-in only)

Legal obligation / Legitimate interests.

5. Data Collection and Consent

  • Clients provide explicit consent for any health-related data.

  • Consent is documented via signed intake or consent forms.

  • Clients may withdraw consent at any time without penalty.

6. Data Storage and Security

  • All digital data is stored on secure, password-protected systems.

  • Paper records are locked in secure filing cabinets with restricted access.

  • Data backups are encrypted and regularly updated.

  • Access to personal data is limited to authorised staff and practitioners only.

7. Data Sharing

Personal data will never be sold. Data may only be shared with:

  • Licensed practitioners delivering treatments.

  • Service providers (e.g., payment processors, booking platforms) under strict confidentiality agreements.

  • Legal or regulatory authorities where required by law.

8. Data Retention

  • Client treatment records: 7 years from the last visit (for insurance and legal compliance).

  • Booking and payment records: 6 years for accounting purposes.

  • Marketing consent records: Until consent is withdrawn.

  • Employee and contractor records: 6 years after termination of employment or contract.

9. Data Subject Rights

Clients, staff, and contractors have the right to:

  • Access their personal data.

  • Request corrections to inaccurate or outdated information.

  • Request deletion of data, where legally permissible.

  • Restrict processing or object to certain uses.

  • Request data portability.

  • Lodge a complaint with the Data Protection Commission (DPC) at https://www.dataprotection.ie/.

10. Data Breach Management

  • Any suspected data breach must be reported immediately to the Operations Leader

  • The DPO will investigate and, if required, notify the Data Protection Commission and affected individuals within 72 hours of detection, as required by GDPR.

11. Staff Training and Compliance

  • All staff and contractors handling data will receive GDPR awareness training.

  • Staff are required to sign confidentiality agreements and follow internal data security procedures.

12. Policy Review

This policy will be reviewed annually or whenever there are significant changes in legislation, operations, or data management systems.


Email: info@arunachala.ie
Phone: 083 483 7303
Postal Address: Deerpark, Mounthrath, Co. Laois, R32 W5F7