Privacy Policy

This page explains what happens to your information when you use this website, in particular when you submit the private application. It is written to describe what the system actually does, not a general template.

For the purpose of data protection law, the data controller for information submitted through this website is:

Plazma Saal d.o.o.
Vodnikova ulica 4, 10000 Zagreb, Croatia

Plazma Saal d.o.o. is registered in Republic of Croatia and is subject to the EU General Data Protection Regulation (GDPR) and Croatian data protection law. It is a separate company from Q Ayurveda™'s day-to-day retreat operations, and has been designated as the controller responsible for information collected through this website.

For any question about this policy or your information, contact us at info@qayurveda.com.

When you submit the private application, we collect: your name, email address, country, preferred contact method, what you would like to address (in your own words), your primary interest (Recovery and Deep Detox, Performance and Elite Sport, Longevity and Rasayana, or not sure yet), preferred retreat format and duration, approximate dates if given, who is travelling with you, and the level of privacy you require.

We also record, technically, that you confirmed you are willing to complete an initial consultation and that you accept how your information will be handled, since these are required checkboxes on the form itself.

We do not use cookies, and we do not run any analytics, advertising or tracking service on this website. No browser storage, such as local storage, is used to identify or track you.

The public application is deliberately short. The form itself asks you not to include diagnoses, medication lists, medical documents, detailed health history or test results. If your initial review is positive, more detailed information, where it is genuinely needed to plan your retreat safely, is collected separately, through a more secure process, not through this public form.

What you write in the "what you would like to address" field may still touch on health or wellbeing in general terms, since that is the point of the question. We treat this field, and everything else submitted, with the same care regardless of its content.

We use what you submit to review your application, judge whether Q Ayurveda™ appears suitable for you, decide what the next step should be, and contact you about it. We also use minimal technical information, see §9, to protect the form against spam and abuse.

We do not use your information for advertising, profiling, or to train any system. No automated process decides whether your application is accepted; every application is reviewed by people.

Some of what you tell us, particularly in your own free-text answer, may relate to health or wellbeing in a general sense. This is not the same as a medical record, and the public form is intentionally not designed to collect one. Where genuinely detailed health information becomes relevant, it is gathered later, through the secure Stage 3 process, not through this website form.

Your application is reviewed by the Q Ayurveda™ team members involved in evaluating and arranging retreats. It is not shared with anyone else, except the technical service providers necessary to operate our hosting and email, see §8, or where we are legally required to share it with an authority.

We do not sell your information, and we do not share it with unrelated third parties or business partners.

This website and the application form run on hosting provided by GoDaddy. Submitted applications are delivered by email using the server's own mail system, to info@qayurveda.com, and are also stored directly on the server, in a location outside the publicly accessible part of the website, so they cannot be reached by visiting a web address.

We do not use a third-party form service, a separate email marketing platform, or an external database to handle this data. GoDaddy, as our hosting provider, necessarily has technical access to the server this runs on.

Submitted applications are stored in a server location that is not publicly accessible through the website, with file permissions restricted so that only the hosting account itself can read them. The form includes automated protections against spam and abuse, including a check that rejects bot-like submissions and a limit on how many applications can be submitted from the same connection in a short period; this limit works by recording a one-way cryptographic hash of your IP address, not the address itself. The site is served over HTTPS, and a Content Security Policy is in place to restrict what can run in your browser when you visit.

No system is completely secure, and we do not claim otherwise. We have designed the process to collect as little as possible through the public form, precisely because that reduces what would be at risk in the first place.

We do not currently set any cookies through this website, and we do not run Google Analytics, Google Tag Manager, Meta Pixel, or any comparable analytics or advertising tool. If this changes, this section will be updated, and a consent mechanism will be added before any non-essential cookie is set.

Our hosting provider injects a third-party script into every page served from this account, outside our control. Our security policy, a Content Security Policy, blocks this script from running in your browser, so it does not function as an active tracker on this site; we are raising it here for the sake of transparency rather than because it collects anything from you.

Applications that do not result in an active client relationship are kept for up to 12 months after our last substantive communication with you, then deleted automatically. If nothing further happens after you apply, for example your application is not accepted, or you decide not to proceed, this is measured from that last exchange, and deletion follows once the 12 months pass. It is not something we do by hand: application files are checked on a regular schedule, and deletion is based on whichever timestamp on a file is most recent, so anything genuinely still active is never affected.

If you do become a client, the information needed for that ongoing relationship is transferred into your client record. From that point it is kept under a separate retention policy that applies to client records generally; this 12-month rule no longer applies to it.

Because the data controller named in §2 is established in Croatia, your rights over the information we hold about you are provided under the EU General Data Protection Regulation (GDPR) and Croatian law. You may have the right to access, correct or delete the information we hold about you, to object to or restrict how it is used, to receive a copy of it, and to withdraw any consent you have given.

You may lodge a complaint with the Croatian data protection authority, the Agencija za zaštitu osobnih podataka (AZOP), azop.hr, or with the supervisory authority in your own EU member state, if different.

For any question about this policy or your information, contact us at info@qayurveda.com. This mailbox is active and already used to receive Stage 1 applications.

We may update this page as the website and application process develop. The version published here reflects how the system actually works at the time it was last updated.