1. Who is responsible for your data

The controller responsible for the processing described in this policy is:

grounds Nora Al-Kassab & Nieves Simon GbR, Am Strandkai 17, 20457 Hamburg, Germany. Email: hello@groundsretreats.com.

2. The data we collect, and why

2.1 Joining the waitlist

When you join our waitlist, we collect the information you provide in the waitlist form — typically your name, email address, and any details you choose to share about yourself or your interest in a retreat.

Purpose: to review your application and, if we invite you to join a retreat, to get in touch. Legal basis: your consent (Art. 6(1)(a) GDPR) and our legitimate interest in building a considered, well-matched community for our retreats (Art. 6(1)(f) GDPR).

Joining the waitlist does not create a contract or any binding obligation on either side. It simply allows us to consider you for a future invitation.

2.2 Invitation and booking

If we invite you to a retreat, we will ask for further information needed to organise your stay and issue an invoice — such as your full name, billing address, and any information relevant to your travel and accommodation.

Purpose: to prepare and manage your booking, issue invoices, and fulfil our contractual obligations to you. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with our legal obligations as a business, in particular German commercial and tax law (Art. 6(1)(c) GDPR).

2.3 Payment information

Payments are currently made by bank transfer directly to our business account, based on the invoice we send you. We do not currently process card payments or store your banking details ourselves — your bank handles the transfer.

2.4 Health and safety information

Once you are confirmed as a participant, we will ask you to complete a Medical Disclosure Form covering matters such as emergency contacts, dietary preferences and allergies, relevant medical conditions, pregnancy, physical limitations, accessibility needs, and other information relevant to your safety and wellbeing during the retreat.

This counts as a 'special category' of personal data under Art. 9 GDPR (health data), which receives extra protection under law. We only collect it with your explicit, separate consent (Art. 9(2)(a) GDPR), and only use it to keep you safe and comfortable — for example, briefing our facilitators and, where relevant, on-site chefs or emergency services, and adapting activities to your needs. We do not use this information for any marketing or commercial purpose, and we do not share it beyond those directly involved in delivering and safeguarding your retreat.

2.5 Photography and video

Photos and videos may be taken during retreats for our own archive and, where you have given consent, for marketing purposes (such as our website or social media). See our separate Photography & Media Consent policy for details, including how to opt out.

2.6 Correspondence

If you email us, message us, or otherwise get in touch, we process the content of that correspondence and your contact details to respond to you and, where relevant, keep a record of our conversation.

Legal basis: legitimate interest in managing our communications and providing good service (Art. 6(1)(f) GDPR), or performance of a contract where the correspondence relates to an existing booking.

2.7 Website usage data

Our website is built on Squarespace, which automatically processes certain technical data when you visit — such as IP address, browser type, device information, referring pages, and timestamps — in order to deliver the site securely and reliably. This is standard technical processing necessary to operate any website (Art. 6(1)(f) GDPR).

3. Optional modules - activated only when in use

The sections below describe tools grounds may use in future as the website and business grow. None of these are currently active. Each should only be enabled on the live site, and this policy updated accordingly, once the relevant tool is actually implemented and, where required, once a valid consent mechanism (e.g. a cookie banner) is in place.

3.1 Google Analytics

Google Analytics (Google Ireland Ltd.) is used to understand how visitors use our website, on the basis of consent obtained via our cookie banner.

3.2 Google Search Console

Google Search Console is used to monitor and maintain our site's presence in Google Search results, and the categories of data processed.

3.3 Meta Pixel

Not currently active. If enabled, this section will explain that Meta Pixel (Meta Platforms Ireland Ltd.) is used for advertising measurement and retargeting on Instagram and Facebook, on the basis of your consent, and will describe the data shared with Meta and how to withdraw consent.

3.4 Newsletter / email marketing

Not currently active. If enabled, this section will name the email marketing provider used, confirm the double opt-in process, describe the data processed (e.g. name, email address, engagement statistics), and explain how to unsubscribe at any time.

3.5 Payment providers (Stripe / PayPal)

Not currently active. See section 2.3 above.

3.6 Calendly

Not currently active. If enabled, this section will explain that Calendly is used to schedule calls or consultations, and describe the data processed (e.g. name, email, selected time slot) and Calendly's role as a data processor.

3.7 Instagram and LinkedIn

Our social media profiles on Instagram and LinkedIn are operated by grounds but hosted on third-party platforms, which process data according to their own privacy policies. If social media feeds or 'follow' buttons are embedded directly on our website, this section will be expanded to describe that integration and its data protection implications.

4. Who we share your data with

We do not sell your personal data. We share it only where necessary to run grounds and deliver your retreat, including with:

• Squarespace, our website hosting provider, acting as a data processor.

• Accommodation providers, venues, chefs, facilitators, and other independent contractors directly involved in delivering your retreat, limited to the information they genuinely need.

• Local partner organisations for optional volunteering or community activities included in a retreat, where you choose to take part.

• Professional advisors (such as our accountant or lawyer), where necessary for legal or tax compliance.

• Public authorities, where we are legally required to disclose information.

5. International data transfers

Because grounds organises retreats around the world — including destinations outside the European Economic Area (EEA) — some of your personal data (typically your name, dietary or health-relevant information, and emergency contact details) may need to be shared with accommodation providers, local partners, or facilitators in the destination country, purely to organise and run your retreat safely.

Where this involves a transfer of personal data outside the EEA to a country without an EU adequacy decision, we rely on appropriate safeguards under Art. 44–49 GDPR, in particular the European Commission's Standard Contractual Clauses (SCCs), or your explicit consent for a specific transfer necessary to perform your contract (Art. 49(1)(b) GDPR), such as sharing your dietary requirements with a villa's kitchen team ahead of arrival.

6. How long we keep your data

• Waitlist entries that do not lead to an invitation: kept for a reasonable period to allow us to consider you for future retreats, then deleted or anonymised unless you ask us to remove them sooner.

• Booking, invoicing, and payment-related records: retained for ten years in line with German commercial and tax retention obligations (§ 147 Abgabenordnung, § 257 Handelsgesetzbuch).

• Health and medical disclosure information: retained only for as long as needed to plan for and safely deliver your retreat, and deleted shortly afterwards unless a longer period is required for documented safety or legal reasons.

• Photography and video: retained in line with the consent given, until you withdraw consent or ask for specific content to be removed.

• Correspondence: retained for as long as reasonably necessary to handle your query or as required by law.

7. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you (Art. 15).

• Have inaccurate data corrected (Art. 16).

• Have your data deleted, where applicable (Art. 17).

• Restrict how we use your data in certain circumstances (Art. 18).

• Receive your data in a portable format (Art. 20).

• Object to processing based on our legitimate interests (Art. 21).

• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3)).

• Lodge a complaint with a supervisory authority - in Hamburg, this is the Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (HmbBfDI).

To exercise any of these rights, simply write to us at hello@groundsretreats.com. We will respond as quickly as we can, and in any event within the timeframe required by law.

8. Data security

We use reasonable technical and organisational measures to protect your personal data against loss, misuse, and unauthorised access, appropriate to the sensitivity of the information involved — particularly health data, which we treat with additional care.

9. Changes to this policy

As grounds grows and our tools and processes evolve, we will update this policy to reflect that. The version published on our website is always the current one. - July, 2026