Orba Yoga Retreat & Health Spa
Last updated: 1 September 2026
1. Who we are
Orba Yoga Retreat & Health Spa (“Orba”, “we”, “us”, “our”) is a sole trader business operated by Brídín Mullan, who is the data controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
- Address: 9 Tormore Road, Omagh, Co. Tyrone, Northern Ireland
- Email: namaste@orbayogaspa.com
- Phone: 07596 592117
- Website: orbayogaspa.com
2. What personal data we collect
Depending on how you interact with us, we may collect:
- Identity and contact details, such as name, email address, phone number, and postal address
- Booking and account information, such as class and treatment bookings, membership status, and attendance history
- Payment information, processed by our payment providers (see Section 4); we do not store full card details ourselves
- Health and wellbeing information, such as injuries, medical conditions, pregnancy, or mobility considerations you share with us before a class, treatment, or retreat. This is “special category data” under UK GDPR and is treated with extra care (see Section 3)
- Marketing preferences, such as whether you have opted in to newsletters or promotional emails
- Website usage data, via cookies and similar technologies (see Section 7)
- Correspondence, such as emails, enquiry forms, or messages you send us
3. Why we collect it and our legal basis
| Purpose | Legal basis |
|---|---|
| Taking and managing bookings, memberships, and payments | Performance of a contract |
| Sending you class, event, or retreat updates you have booked into | Performance of a contract / legitimate interest |
| Sending marketing emails and newsletters | Consent (you can withdraw at any time) |
| Analytics and marketing cookies / pixels | Consent |
| Improving our website and services | Legitimate interest |
| Meeting our legal and accounting obligations | Legal obligation |
Health and wellbeing information
We collect health and wellbeing information so that we can assess suitability, adapt our services where appropriate, and provide classes, treatments, and retreats safely. Our Article 6 lawful basis is performance of our contract with you and our legitimate interest in providing safe services. Our Article 9 condition for health information is your explicit consent. For accident, incident, insurance, or legal-claim records, we may also rely on the establishment, exercise, or defence of legal claims. You may withdraw your explicit consent at any time, but if you do, we may be unable to provide certain services safely.
4. Who we share your data with
We use a small number of trusted providers to run Orba. They only receive the data needed to provide their service and are bound by their own data protection obligations:
- Setmore, for class and appointment bookings
- GoCardless, for membership payments
- Stripe, for online payments
- AWeber, for email newsletters and marketing
- QuickBooks, for bookkeeping and accounts
- Our insurers, and legal or accounting advisers, where necessary
- IT and website hosting providers who support our systems
Some payment and platform providers, such as Stripe and GoCardless, may act as our processors and/or as independent controllers for payment processing, fraud prevention, and compliance; their own privacy notices also apply. We do not sell your personal data, and we do not share it with third parties for their own marketing. We may disclose data where required by law, for example to HMRC or another regulatory authority, or to the emergency services where necessary.
5. International transfers
Some providers may process personal data outside the UK, including in the United States (for example AWeber, Stripe, GoCardless, Setmore, QuickBooks, and any analytics or advertising tools we use). Where this happens, we rely on appropriate safeguards such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or a UK adequacy regulation (including the UK Extension to the EU-US Data Privacy Framework where applicable). Contact us for more information about the safeguards in place.
6. How long we keep your data
- Booking, membership, and customer account records: up to 6 years after your last transaction or interaction, for queries, complaints, tax, accounting, and legal claims
- Financial and accounting records: 6 years, in line with HMRC requirements
- Health questionnaires: usually up to 3 years after your last attendance, unless we need to keep them longer for an incident, complaint, insurance matter, or legal claim (for minors, incident records may be kept until the person reaches 21)
- Accident and incident records: as long as reasonably necessary for insurance and legal-claim purposes
- Marketing data: until you unsubscribe or withdraw consent (we may keep a suppression record so we know not to contact you again)
7. Your rights
Under UK GDPR, you have the right to:
- Access the personal data we hold about you
- Correct inaccurate or incomplete data
- Erase your data (“right to be forgotten”), where applicable
- Restrict or object to certain processing
- Data portability, receiving your data in a portable format
- Withdraw consent at any time, where processing is based on consent (for example marketing emails or health information)
To exercise any of these rights, contact us at namaste@orbayogaspa.com and we will respond within one month. If you are unhappy with how we have handled your data, you can complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk or on 0303 123 1113.
8. Cookies and tracking technologies
We use essential cookies to operate our website and booking functions; these do not require consent. We only use analytics, advertising, remarketing, or tracking cookies and pixels, including tools such as Google Analytics, the Meta (Facebook) Pixel, and PixelYourSite integrations, with your prior consent. These may collect information about your device, browsing activity, and interactions with our website, and may be used to measure performance or show relevant advertising.
You can accept, reject, or manage non-essential cookies using our cookie banner, and you can change or withdraw your consent at any time by selecting “Cookie settings” on our website. Blocking non-essential cookies will not prevent you from using our core website or booking services.
| Cookie / tool | Provider | Purpose | Type |
|---|---|---|---|
| Booking / session cookies | Website & Setmore | Essential booking functionality | Essential |
| Payment cookies | Stripe / GoCardless | Payment and fraud prevention | Essential |
| Analytics | Google Analytics | Understand website use | Analytics (consent) |
| Advertising / remarketing | Meta Pixel / PixelYourSite | Measure ads and show relevant ads | Marketing (consent) |
9. Marketing
We send marketing emails only where you have consented or, for existing customers, where the soft opt-in applies and you were given a clear opportunity to opt out at collection and in every message. You can unsubscribe at any time.
10. Children
Our services are intended mainly for adults. Where a minor takes part in a class or activity, we collect the minimum information necessary and require parental or guardian consent.
11. Security
We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.
12. Changes to this policy
We may update this privacy policy from time to time, for example if our services or legal obligations change. The “last updated” date at the top of this page reflects the most recent revision.
13. Contact us
If you have any questions about this privacy policy or how we handle your data, contact Brídín Mullan, Orba Yoga Retreat & Health Spa, 9 Tormore Road, Omagh, Co. Tyrone. Email namaste@orbayogaspa.com or call 07596 592117.