Privacy & Cookies
Last updated 25 October 2026
We collect as little as possible. This page explains what we collect when you visit this website or book a retreat, why we need it, how long we keep it, and what your rights are.
Who we are
The data controller for this website (amadaretreats.com) is AMADA Retreats, operated by Linda Leppänen. You can reach us at amadaretreats@gmail.com.
When you visit the website
The website is hosted by Hetzner in Helsinki, Finland. Our server automatically records your IP address, the date and time of your visit, the page requested and basic browser information. We use this only to keep the site secure and working. The legal basis is our legitimate interest in running a secure website (GDPR Art. 6(1)(f)).
These server logs are deleted automatically after 14 days.
Analytics, only with your consent
We use Google Analytics 4 to understand which pages are visited and how people find us. It is switched on only if you click Accept in the cookie banner. If you click Reject, no Google Analytics code is loaded and no analytics cookies are set.
When enabled, Google Analytics collects pages viewed, approximate location, device and browser type, and how you arrived at the site. We do not use it to identify you by name or email. The legal basis is your consent (GDPR Art. 6(1)(a)).
Event data is kept for 2 months and user-level data for 14 months, after which it is deleted automatically. You can change your mind at any time with Cookie Settings in the footer; rejecting removes the analytics cookies from your browser.
Cookies and local storage
We use no advertising or marketing cookies.
| Name | Purpose | Duration | Needs consent |
| _ga | Google Analytics: tells visitors apart | Up to 2 years | Yes |
| _ga_YSRHMM13GP | Google Analytics: keeps session state | Up to 2 years | Yes |
| amada_consent (local storage) | Remembers your cookie choice | 12 months | No, strictly necessary |
Booking a retreat
Bookings and enquiries are made through a Google Form. You enter your name, contact details and anything else you choose to tell us, such as dietary requirements or injuries. We use this to manage your booking, stay in touch and organise the retreat. The legal basis is taking steps at your request before a contract and performing the contract (GDPR Art. 6(1)(b)). If you share health information, we use it only to look after you during the retreat, based on your explicit consent (GDPR Art. 9(2)(a)), which you can withdraw at any time.
We delete booking data 12 months after the end of the retreat. Invoices and accounting records are kept for as long as accounting law requires.
Emails
If you write to us, we use your message and email address to reply. Our email runs on Gmail. Conversations are deleted 24 months after the last message, unless you have booked and we must keep related records by law.
Guest Book
Testimonials in the Guest Book are published only with the permission of the guest. If you would like yours changed or removed, email us and we will do it promptly.
Links to other services
The website links to Instagram and to Google Forms. We do not embed Instagram, so no Instagram code runs on our pages. Once you open those services, their own privacy policies apply.
Who receives your data
We use two service providers: Google (Analytics, Forms and Gmail) and Hetzner (hosting). We do not sell your data or share it for advertising. Google may process data outside the European Economic Area, including in the United States, under the EU–US Data Privacy Framework.
Your rights
Under the GDPR you can ask us to:
- give you a copy of your data (access);
- correct it (rectification);
- delete it (erasure);
- limit how we use it (restriction);
- send it to you in a portable format (portability);
- stop processing it, where we rely on legitimate interest (objection).
Where we rely on your consent, you can withdraw it at any time. Email amadaretreats@gmail.com and we will reply within one month.
Complaints
If you believe we have handled your data incorrectly, you can complain to the Finnish Data Protection Ombudsman (Tietosuojavaltuutettu), tietosuoja.fi, or to the data protection authority in your country of residence.
Children
Our retreats and this website are intended for people aged 18 and over. We do not knowingly collect data from children.
Changes to this page
If we change how we handle data, we will update this page and the date at the top.