1. Who is responsible for your data

The controller responsible for the processing described in this policy is:

grounds Nora Al-Kassab & Nieves Simon GbR, Am Strandkai 17, 20457 Hamburg, Germany. Email: hello@groundsretreats.com.

2. The data we collect, and why

2.1 Joining the waitlist

When you join our waitlist, we collect the information you provide in the waitlist form — typically your name, email address, and any details you choose to share about yourself or your interest in a retreat.

Purpose: to review your application and, if we invite you to join a retreat, to get in touch. Legal basis: your consent (Art. 6(1)(a) GDPR) and our legitimate interest in building a considered, well-matched community for our retreats (Art. 6(1)(f) GDPR).

Joining the waitlist does not create a contract or any binding obligation on either side. It simply allows us to consider you for a future invitation.

2.2 Invitation and booking

If we invite you to a retreat, we will ask for further information needed to organise your stay and issue an invoice — such as your full name, billing address, and any information relevant to your travel and accommodation.

Purpose: to prepare and manage your booking, issue invoices, and fulfil our contractual obligations to you. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and compliance with our legal obligations as a business, in particular German commercial and tax law (Art. 6(1)(c) GDPR).

2.3 Payment information

Payments are currently made by bank transfer directly to our business account, based on the invoice we send you. We do not currently process card payments or store your banking details ourselves — your bank handles the transfer.

2.4 Health and safety information

Once you are confirmed as a participant, we will ask you to complete a Medical Disclosure Form covering matters such as emergency contacts, dietary preferences and allergies, relevant medical conditions, pregnancy, physical limitations, accessibility needs, and other information relevant to your safety and wellbeing during the retreat.

This counts as a 'special category' of personal data under Art. 9 GDPR (health data), which receives extra protection under law. We only collect it with your explicit, separate consent (Art. 9(2)(a) GDPR), and only use it to keep you safe and comfortable — for example, briefing our facilitators and, where relevant, on-site chefs or emergency services, and adapting activities to your needs. We do not use this information for any marketing or commercial purpose, and we do not share it beyond those directly involved in delivering and safeguarding your retreat.

2.5 Photography and video

Photos and videos may be taken during retreats for our own archive and, where you have given consent, for marketing purposes (such as our website or social media). See our separate Photography & Media Consent policy for details, including how to opt out.

2.6 Correspondence

If you email us, message us, or otherwise get in touch, we process the content of that correspondence and your contact details to respond to you and, where relevant, keep a record of our conversation.

Legal basis: legitimate interest in managing our communications and providing good service (Art. 6(1)(f) GDPR), or performance of a contract where the correspondence relates to an existing booking.

2.7 Website usage data

Our website is hosted by Squarespace Ireland Limited, Le Pole House, Ship Street Great, Dublin 8, Ireland (“Squarespace”). When you visit our website, Squarespace automatically processes technical data such as your IP address, browser type, device information, referring page, and the date and time of your visit, in order to deliver the site securely and reliably.

Legal basis: our legitimate interest in operating a secure, functioning website (Art. 6(1)(f) GDPR). Squarespace acts as our data processor under a data processing agreement (Art. 28 GDPR). Squarespace may transfer data to its parent company Squarespace, Inc. in the United States; see section 5.

2.8 Cookie consent tool

Our website uses the cookie banner built into Squarespace to ask for your consent before any non-essential cookies or similar technologies are used. The banner lets you accept all categories, decline them, or choose individual categories under “Preferences”.

To remember your choice, the tool stores small cookies on your device (for example ss_marketingCookiesAllowed and ss_performanceCookiesAllowed). These record only your consent decision, not who you are. They remain until you change your choice or delete your cookies.

Legal basis: storing your choice is strictly necessary to provide the consent function you request (§ 25(2) No. 2 TDDDG) and to meet our obligation to document consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR). You can change or withdraw your consent at any time via the “Cookie preferences” link in the footer of our website.

2.9 Squarespace Analytics

We use Squarespace’s built-in analytics to understand how our website is used – for example, which pages are visited, how visitors find us, and which device types they use. This helps us improve our content and the experience of the site.

For this purpose, Squarespace sets analytics cookies (ss_cvr and ss_cvt) that recognise returning visitors and group page views into visits. Squarespace processes usage data such as pages viewed, time and duration of the visit, referring website, approximate location (derived from your IP address), browser and device type. We see this information only in aggregated form and cannot identify you from it.

Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), given via our cookie banner under the “performance” / “analytics” category. These cookies are only set if you consent, and you can withdraw your consent at any time with effect for the future. Squarespace acts as our data processor. Further information: Squarespace Privacy Policy.

2.10 Google reCAPTCHA

To protect our waitlist and contact forms against spam and automated abuse, we use Google reCAPTCHA, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (“Google”). reCAPTCHA checks whether a form is being submitted by a person or by an automated program.

For this purpose, reCAPTCHA analyses information such as your IP address, browser and device information, the time spent on the page, and mouse or touch interactions, and may set or read cookies. This data is sent to Google and may be transferred to Google LLC in the United States (see section 5). reCAPTCHA is only loaded on pages that contain a form.

Legal basis: our legitimate interest in protecting our website and forms from spam and misuse (Art. 6(1)(f) GDPR); accessing information on your device for this purpose is necessary to provide the form you are using (§ 25(2) No. 2 TDDDG). Further information: Google Privacy Policy and Google Terms of Service.

2.11 Meta Pixel

With your consent, we use the Meta Pixel, a service of Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland (“Meta”). The Meta Pixel helps us measure how effective our advertising on Instagram and Facebook is, understand which visitors arrive through our ads, and show our ads to people who may be interested in grounds (including people who have visited our website before).

When you visit our website, the Meta Pixel sets a cookie (_fbp, stored for up to 90 days) and sends information to Meta such as your IP address, browser and device information, the pages you visit and actions you take (for example, joining the waitlist), and a pixel ID. If you are logged in to Facebook or Instagram, Meta may link this information to your account. Meta may transfer data to Meta Platforms, Inc. in the United States (see section 5).

We and Meta are joint controllers (Art. 26 GDPR) for the collection of this data on our website and its transmission to Meta, under Meta’s Controller Addendum. Meta is solely responsible for any further processing. You can exercise your data protection rights directly with Meta.

Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), given via our cookie banner under the “marketing” category. The Meta Pixel only loads if you consent, and you can withdraw your consent at any time via the “Cookie preferences” link in our footer. You can also manage ad preferences in your Facebook or Instagram settings. Further information: Meta Privacy Policy.

3. Optional modules - activated only when in use

The tools described in sections 2.7 to 2.11 are active on our website today. The tools below are not currently active; this policy will be updated before any of them is switched on.

3.1 Google Analytics

Google Analytics (Google Ireland Ltd.) is used to understand how visitors use our website, on the basis of consent obtained via our cookie banner.

3.2 Google Search Console

Google Search Console is used to monitor and maintain our site's presence in Google Search results, and the categories of data processed.

3.3 Newsletter / email marketing

Not currently active. If enabled, this section will name the email marketing provider used, confirm the double opt-in process, describe the data processed (e.g. name, email address, engagement statistics), and explain how to unsubscribe at any time.

3.4 Payment providers (Stripe / PayPal)

Not currently active. See section 2.3 above.

3.5 Calendly

Not currently active. If enabled, this section will explain that Calendly is used to schedule calls or consultations, and describe the data processed (e.g. name, email, selected time slot) and Calendly's role as a data processor.

3.6 Instagram and LinkedIn

Our social media profiles on Instagram and LinkedIn are operated by grounds but hosted on third-party platforms, which process data according to their own privacy policies. If social media feeds or 'follow' buttons are embedded directly on our website, this section will be expanded to describe that integration and its data protection implications.

4. Who we share your data with

We do not sell your personal data. We share it only where necessary to run grounds and deliver your retreat, including with:

• Squarespace, our website hosting and analytics provider, acting as a data processor.

• Google, for spam protection on our forms (reCAPTCHA).

• Meta, for advertising measurement on Instagram and Facebook, if you have consented to marketing cookies (joint controllership, see section 2.11).

• Accommodation providers, venues, chefs, facilitators, and other independent contractors directly involved in delivering your retreat, limited to the information they genuinely need.

• Local partner organisations for optional volunteering or community activities included in a retreat, where you choose to take part.

• Professional advisors (such as our accountant or lawyer), where necessary for legal or tax compliance.

• Public authorities, where we are legally required to disclose information.

5. International data transfers

Because grounds organises retreats around the world — including destinations outside the European Economic Area (EEA) — some of your personal data (typically your name, dietary or health-relevant information, and emergency contact details) may need to be shared with accommodation providers, local partners, or facilitators in the destination country, purely to organise and run your retreat safely.

Where this involves a transfer of personal data outside the EEA to a country without an EU adequacy decision, we rely on appropriate safeguards under Art. 44–49 GDPR, in particular the European Commission's Standard Contractual Clauses (SCCs), or your explicit consent for a specific transfer necessary to perform your contract (Art. 49(1)(b) GDPR), such as sharing your dietary requirements with a villa's kitchen team ahead of arrival.

Some of the website tools we use are provided by companies whose parent companies are based in the United States (Squarespace, Inc., Google LLC, Meta Platforms, Inc.). Where personal data is transferred to the US, the transfer is based on the EU Commission’s adequacy decision for the EU–U.S. Data Privacy Framework, where the recipient is certified under it, and otherwise on Standard Contractual Clauses (Art. 46(2)(c) GDPR).

6. How long we keep your data

• Waitlist entries that do not lead to an invitation: kept for a reasonable period to allow us to consider you for future retreats, then deleted or anonymised unless you ask us to remove them sooner.

• Booking, invoicing, and payment-related records: retained for ten years in line with German commercial and tax retention obligations (§ 147 Abgabenordnung, § 257 Handelsgesetzbuch).

• Health and medical disclosure information: retained only for as long as needed to plan for and safely deliver your retreat, and deleted shortly afterwards unless a longer period is required for documented safety or legal reasons.

• Photography and video: retained in line with the consent given, until you withdraw consent or ask for specific content to be removed.

• Correspondence: retained for as long as reasonably necessary to handle your query or as required by law.

7. Your rights

Under the GDPR, you have the right to:

• Access the personal data we hold about you (Art. 15).

• Have inaccurate data corrected (Art. 16).

• Have your data deleted, where applicable (Art. 17).

• Restrict how we use your data in certain circumstances (Art. 18).

• Receive your data in a portable format (Art. 20).

• Object to processing based on our legitimate interests (Art. 21).

• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Art. 7(3)).

• Lodge a complaint with a supervisory authority - in Hamburg, this is the Hamburgische Beauftragte für Datenschutz und Informationsfreiheit (HmbBfDI).

To exercise any of these rights, simply write to us at hello@groundsretreats.com. We will respond as quickly as we can, and in any event within the timeframe required by law.

8. Data security

We use reasonable technical and organisational measures to protect your personal data against loss, misuse, and unauthorised access, appropriate to the sensitivity of the information involved — particularly health data, which we treat with additional care.

9. Changes to this policy

As grounds grows and our tools and processes evolve, we will update this policy to reflect that. The version published on our website is always the current one. - October, 2026