Privacy Policy

Last updated: 13 September 2026

This Privacy Policy explains how I collect, use, store and protect personal data when you visit www.nat.yoga, contact me, subscribe to my emails, register for a class or event, purchase a service, or participate in my yoga, coaching, retreat or community offerings.

I process personal data in accordance with the Swiss Federal Act on Data Protection (“FADP”) and, where applicable, the EU General Data Protection Regulation (“GDPR”).

1. Who is responsible for your data?

The controller responsible for processing your personal data is:

Natalija Fallocca-Bajric
Mühlebachstrasse 64
8008 Zürich
Switzerland

Email: nat@nat.yoga
Website: www.nat.yoga

Please contact me at the above email address if you have questions about this Privacy Policy or wish to exercise your data-protection rights.

2. What personal data I collect

Depending on how you interact with me, I may collect and process:

  • Your name

  • Email address

  • Telephone number

  • Billing address and payment-related information

  • Class, event, programme, retreat and appointment bookings

  • Information you submit through registration, application, feedback or reflection forms

  • Messages, emails, voice notes and other communications

  • Information you choose to share during yoga, coaching or community participation

  • Technical information such as your IP address, browser, device, approximate location, pages visited and interactions with the website

  • Marketing preferences and email engagement

  • Photographs, video or audio recordings, meeting transcripts, handwritten notes and AI-assisted session notes, where applicable and after the required information and permission have been provided

In connection with yoga or coaching, you may voluntarily provide information concerning your physical or mental health, wellbeing, injuries, personal circumstances or emotional experiences. This may constitute sensitive personal data or special-category data.

Please share only information that is relevant and that you are comfortable providing.

3. How I collect personal data

I may collect personal data:

  • Directly from you when you contact me, complete a form, make a booking or purchase, subscribe to emails, or participate in an offering

  • Through the website and cookies or similar technologies

  • Through service providers used to manage bookings, payments, communications, classes, forms, video calls and online communities

  • Through your interactions with my emails or social-media content

  • From publicly available sources or referrals, where appropriate and lawful

4. Why I use your personal data

I may process your personal data to:

  • Respond to enquiries

  • Arrange discovery calls and appointments

  • Register you for classes, workshops, masterclasses, programmes and retreats

  • Deliver yoga, coaching, retreat and community services

  • Personalise your participation and provide appropriate support

  • Process payments, refunds and invoices

  • Manage accounts, bookings, cancellations and memberships

  • Send confirmations, access information, recordings and service-related updates

  • Send newsletters and promotional emails where you have subscribed or otherwise provided valid consent

  • Maintain the safety, confidentiality and integrity of my offerings and communities

  • Create appropriate session notes and summaries

  • Improve my website, services and communications

  • Understand website use and campaign performance where analytics or advertising technologies have been activated with the required consent

  • Use fully anonymised and de-identified themes or client language to communicate and improve my work

  • Comply with legal, accounting and tax obligations

  • Establish, exercise or defend legal claims

  • Prevent misuse, fraud or security incidents

I do not sell your personal data.

5. Legal bases for processing

Where the GDPR applies, I rely on one or more of the following legal bases:

  • Performance of a contract or steps before entering into a contract: for bookings, purchases, programme participation and delivery of requested services

  • Consent: for newsletters, optional marketing, non-essential cookies, identifiable testimonials, certain recordings and the processing of sensitive information where consent is required

  • Legitimate interests: for responding to enquiries, operating and improving my business, maintaining security, communicating with existing clients, creating de-identified insights and protecting legal interests, provided these interests are not overridden by your rights

  • Legal obligations: for accounting, tax, regulatory and record-keeping requirements

  • Establishment, exercise or defence of legal claims: where relevant

Where I process health information or other special-category data under the GDPR, I do so with your explicit consent or where another legal basis permitted by law applies.

You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing that occurred before consent was withdrawn.

6. Website hosting and Squarespace

The published website is created and hosted through Squarespace.

When you visit the website, Squarespace may process technical data such as your IP address, device and browser information, access times, pages viewed and security-related information. Squarespace may also place cookies that are necessary for the website to function.

I may also use Squarespace to:

  • Manage website forms

  • Store contact information

  • Send email campaigns

  • Manage newsletter subscriptions

  • Measure email delivery, opens and link interactions

Further information is available in the Squarespace Privacy Policy.

7. Contact forms, registration forms and Google Forms

When you submit a website form or Google Form, I process the information you provide for the purpose described on that form.

Forms may be used for:

  • Enquiries

  • Masterclass or event registration

  • Programme applications

  • Pre-session reflections

  • Mid-programme and final reflections

  • Feedback and testimonials

  • Retreat or yoga registrations

Google Forms and related information may be stored through Google Workspace or Google Drive.

Further information is available in the Google Privacy Policy.

Please do not include unnecessary sensitive information in an ordinary website or registration form.

Where a form specifically requests health, wellbeing or similarly sensitive information, I use that information only for the stated purpose and to support the safe and appropriate delivery of the relevant service.

8. Email communications and newsletters

If you register for an event, book a service or join a programme, I may send you emails that are necessary to administer and deliver that offering. These may include confirmations, access links, schedule information, reminders and follow-up materials.

I send newsletters and promotional emails where you have subscribed or otherwise provided valid consent, or where such communication is otherwise permitted by applicable law.

You can unsubscribe from promotional emails at any time by using the unsubscribe link in the email or contacting nat@nat.yoga.

Unsubscribing from promotional emails does not prevent me from sending essential administrative messages relating to a booking, purchase or active programme.

Registration for a particular masterclass or event does not automatically constitute consent to receive unrelated ongoing marketing unless this is made clear at registration and the required consent has been obtained.

9. Calendly

I use Calendly to allow you to schedule appointments and discovery calls.

When you make a booking, Calendly may process information including your name, email address, timezone, appointment details and any answers you provide through the booking form.

Further information is available in the Calendly Privacy Notice.

10. Momoyoga

I use Momoyoga to manage yoga schedules, bookings, cancellations, passes, memberships and related communications.

When you register or book through Momoyoga, Momoyoga may process your contact details, account information, booking history, membership information and payment status.

Further information is available in the Momoyoga Privacy Statement.

11. Zoom, online classes and group-session recordings

I use Zoom to deliver online yoga classes, workshops, masterclasses, group programmes, discovery calls and individual coaching sessions.

Zoom may process your name, email address, IP address, device information and meeting-participation data. Depending on your settings and how you participate, your profile name, voice, image and chat messages may be visible to me or other participants.

Recorded classes and group sessions

Online classes and group classes are recorded so that replays can be made available to registered participants or programme members.

Participants are informed that recording forms part of these offerings. Zoom also provides an automatic notification when recording begins or resumes.

If you do not wish your image or voice to appear in a recording, you may keep your camera and microphone switched off during recorded portions and avoid sharing personal information in the meeting chat.

Personal coaching “hot-seat” portions are not recorded. I pause the Zoom recording before a hot seat begins and resume it only after that portion has ended. Other personal or confidential parts of a session may also be excluded from the recording where appropriate.

Participants must not independently record, download, reproduce, share or distribute sessions unless I have expressly authorised this and everyone affected has provided any required permission.

Recordings are made available only for the purpose and access period communicated for the relevant class, programme or event.

Sessions that are not recorded

Discovery calls and individual coaching sessions are generally not recorded for replay.

However, I may take handwritten notes or, after informing you, use an AI-assisted note-taking or transcription service to create session notes or summaries.

The use of an AI note-taking service does not mean that a replay recording will be provided. The service may nevertheless process live audio, a temporary audio stream or a transcript to produce notes.

You will be informed before an AI-assisted note-taking service is activated. Where required, it will be used only with your explicit consent.

Further information about Zoom is available in the Zoom Privacy Statement.

12. Circle community

I may use Circle to provide programme materials, discussions, community spaces, live sessions and recordings.

When you join a Circle community, Circle may process your name, email address, profile information, posts, comments, reactions and usage information.

Information you voluntarily publish in a shared Circle space may be visible to other members of that space. Please do not share information that you do not want other participants to see.

Community members are expected to respect the confidentiality and privacy of others. However, no online community can guarantee that another participant will comply with these expectations.

Further information is available in the Circle Privacy Policy.

13. WhatsApp

I may use WhatsApp for direct communication, service updates, mentoring support and, where applicable, community announcements or group communication.

When you communicate with me through WhatsApp, your name, telephone number, profile information, messages, voice notes and attachments may be processed by WhatsApp.

If you participate in a WhatsApp group or community feature, certain account information may be visible to other participants depending on the feature and your privacy settings.

Please do not use WhatsApp to send highly sensitive personal or health information unless this has been specifically agreed and is necessary for the service.

Further information is available in the WhatsApp Privacy Policy.

14. Payments through Stripe

I use Stripe to process online payments.

Stripe may collect and process your name, billing details, payment-card information, transaction information, IP address and fraud-prevention information.

I do not ordinarily receive or store your complete payment-card number.

Stripe processes payment information under its own privacy and security obligations.

Further information is available in the Stripe Privacy Policy.

15. Cookies

Cookies are small files stored on your device when you visit a website.

The website may use:

  • Strictly necessary cookies, which are required for security and essential website functions

  • Preference cookies, which remember selected settings

  • Analytics cookies, which help me understand how visitors use the website

  • Advertising and marketing cookies, which may measure campaigns or support personalised advertising

Strictly necessary cookies may operate without consent where legally permitted.

Analytics and advertising cookies are activated only where they are actually used and after the required consent has been obtained.

You must be able to accept, refuse or withdraw consent through the website’s cookie settings. Refusing non-essential cookies will not prevent you from accessing the basic website.

16. Google Analytics

I may use Google Analytics to understand how visitors use the website and to improve its content and performance.

Google Analytics may process information such as your IP address, approximate location, device and browser details, pages visited, referral source and website interactions.

Google Analytics will be activated only if this service is installed and after you provide consent through the cookie banner where consent is required. You can withdraw your consent through the website’s cookie settings.

Where available, privacy-enhancing settings such as limited data retention and restricted data sharing will be used.

Further information is available in the Google Privacy Policy.

17. Meta Pixel

I may use the Meta Pixel to measure the effectiveness of advertising, understand actions taken after viewing an advertisement and create or measure advertising audiences.

Meta may receive information about your browser, device, IP address, website activity and interactions with advertisements. If you have a Meta account, Meta may associate this information with your account according to its own policies.

The Meta Pixel will be activated only if this service is installed and after you provide consent through the cookie banner where consent is required. You can withdraw your consent through the website’s cookie settings.

Further information is available in the Meta Privacy Policy.

18. Social-media links and embedded content

The website may contain links to social-media platforms or external websites.

If content from an external platform is embedded directly into the website, that provider may receive technical and usage information when the content loads.

Where required, embedded content that involves non-essential tracking will not load until consent has been provided.

When you leave my website or interact directly with another platform, that provider’s privacy policy applies.

19. Anonymous client language, testimonials and promotional material

In developing and communicating my work, I may draw upon recurring themes, questions and expressions that arise through my classes, coaching sessions, discovery calls, programmes and client feedback.

I may use generalised, paraphrased or fully de-identified client language on my website, in newsletters, on social media, in teaching materials or in descriptions of my services.

Before using such material, I remove names and personal details and alter or omit contextual information that could reasonably identify the individual concerned.

This may include general expressions describing a challenge, desire, insight or experience. It will not include identifiable personal stories, sensitive details or information that could reasonably be connected to a particular client.

By participating in my services, you acknowledge that fully anonymised and de-identified themes or paraphrased client language may be used in this way.

I request separate permission before publishing:

  • A verbatim or recognisable quotation from a private session

  • A personal story or case study

  • A testimonial

  • A client’s name, initials, photograph, voice or image

  • Details that could reasonably allow the client or their circumstances to be identified

Providing this permission is voluntary and is not a condition of receiving my services.

Where permission has been provided, the client may choose whether the material is published anonymously, with their first name or with other agreed identifying information.

Consent for future use may be withdrawn at any time by contacting nat@nat.yoga. Withdrawal does not affect processing that occurred before consent was withdrawn, but I will take reasonable steps to discontinue future use of the material under my control.

20. Notes, AI-assisted note-taking and confidentiality

Information shared during coaching, discovery calls or within confidential group spaces is treated with care and used to deliver and administer the relevant service.

I may take handwritten working notes to support continuity, record agreed goals, remember relevant context or prepare for future sessions.

For certain discovery calls or coaching sessions, I may use an AI-assisted note-taking or transcription service.

Where such a service is used:

  • You will be informed before the service is activated

  • Any consent required for the processing will be obtained

  • The service may process audio, transcripts and information shared during the session

  • The resulting notes or summary will be used for coaching, administrative or follow-up purposes

  • The information will not be used for identifiable advertising or public content without separate permission

  • Access will be limited to me and authorised service providers

  • The information will be deleted or anonymised when it is no longer required, subject to legal retention obligations

Because coaching conversations may include health information, emotional experiences or other sensitive personal data, AI-assisted processing will be limited to what is reasonably necessary for the stated purpose.

Participants in group programmes may be asked to agree to confidentiality rules. Nevertheless, I cannot guarantee the conduct of other participants and cannot provide the same degree of confidentiality in a group environment as in private communication.

21. Service providers and recipients

I share personal data only where necessary and with appropriate recipients, which may include:

  • Website, hosting and email-service providers

  • Booking and scheduling platforms

  • Payment processors

  • Video-conferencing and recording providers

  • Community platforms

  • Cloud-storage and form providers

  • AI-assisted transcription or note-taking providers, where their use has been disclosed

  • Accountants, professional advisers and technical-support providers

  • Public authorities where disclosure is legally required

  • Other participants where the nature of a group service makes this clear

These providers may process personal data on my behalf or as independent controllers, depending on the service and circumstances.

Their processing is subject to their respective contractual obligations, security measures and privacy policies.

22. International data transfers

Some service providers are based outside Switzerland, the European Union or the European Economic Area, or may process data in other countries, including the United States.

Where personal data is transferred internationally, I rely on appropriate safeguards where required. These may include:

  • A country recognised as providing an adequate level of data protection

  • The Swiss-US or EU-US Data Privacy Framework where applicable to a certified recipient

  • Approved standard contractual clauses

  • Contractual, organisational and technical protections

  • Your explicit consent where legally permitted and appropriate

Despite these safeguards, foreign authorities may in certain circumstances be able to access data under the laws of the country concerned.

23. How long I keep personal data

I retain personal data only for as long as necessary for the purpose for which it was collected, including legal, contractual, accounting and security requirements.

In general:

  • Enquiry information may be retained for up to 12 months after the last meaningful contact unless a client relationship begins

  • Booking, programme and client-administration information may be retained for the duration of the service and for an appropriate period afterwards

  • Accounting, invoice and transaction records are generally retained for 10 years where required by Swiss law

  • Newsletter information is retained until you unsubscribe or the mailing list is discontinued

  • Suppression information may be retained to ensure that an unsubscribe request continues to be respected

  • Handwritten coaching notes, AI-generated notes, transcripts and sensitive information are deleted, securely destroyed or anonymised when they are no longer needed for the coaching or administrative purpose, subject to legal or claim-related retention requirements

  • Class and group-session recordings are retained and made available only for the period communicated for the relevant offering, after which they are deleted or archived only where another valid purpose and legal basis applies

  • Temporary audio or transcripts processed by an AI note-taking provider are subject to the provider’s configured retention settings and are deleted as soon as reasonably possible when no longer required

  • Cookie and analytics data is retained according to the selected provider settings and the choices made through the cookie banner

Data may be retained for longer where necessary to establish, exercise or defend legal claims or comply with a legal obligation.

24. Data security

I take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure.

These measures may include controlled access, password protection, secure service providers, software updates and appropriate storage practices.

No internet transmission or electronic-storage system is completely secure. I therefore cannot guarantee absolute security.

25. Your rights

Depending on the law that applies to you, you may have the right to:

  • Request information about the personal data I process about you

  • Obtain a copy of your personal data

  • Correct inaccurate or incomplete data

  • Request deletion of your data

  • Request restriction of processing

  • Object to certain processing

  • Receive certain data in a portable format

  • Withdraw consent at any time

  • Object to direct marketing

  • Lodge a complaint with a competent data-protection authority

These rights may be subject to legal limitations or exceptions.

To exercise your rights, contact nat@nat.yoga. I may need to verify your identity before fulfilling a request.

If you are in Switzerland, you may contact the Swiss Federal Data Protection and Information Commissioner:

Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1
3003 Bern
Switzerland
www.edoeb.admin.ch

If the GDPR applies, you may also lodge a complaint with the data-protection authority in the EU or EEA country where you live, work or believe an infringement occurred.

26. Children and young people

My website is not intended to collect personal data directly from children without appropriate involvement from a parent or legal guardian.

Where a person below the age legally permitted to provide consent independently wishes to participate in an offering, parental or guardian consent may be required.

If you believe that a child has provided personal data without the necessary permission, please contact nat@nat.yoga.

27. External links

The website may contain links to websites or services operated by third parties.

I am not responsible for their content, security or privacy practices. Please review the relevant third party’s privacy information before providing personal data.

28. Changes to this Privacy Policy

I may update this Privacy Policy when my services, technology providers or legal obligations change.

The current version will always be published on this page. The date of the latest revision appears at the top.

29. Contact

For privacy-related questions or requests, please contact:

Natalija Fallocca-Bajric
Mühlebachstrasse 64
8008 Zürich
Switzerland

Email: nat@nat.yoga