Data Processing

General Data Protection Regulation (GDPR)

Your trust in the Kriya Yoga Centre Europe organisation is very important to us, and the protection of your personal data is a major concern. Your personal data will be collected, processed and utilized where appropriate, and permitted with your consent, or when the collection, processing and use is allowed, or required by legal regulations- whether European or International.

(Definition: Personal data is defined as any information which refers to an identifiable, legitimate person).

The following General Data Protection Regulation gives you information on questions related to the specifics of collection, processing and utilization of data and, specifically, on your legal rights in this matter. The same applies to our subdomain info.kriya.eu.

Name and address of the responsible person

The responsible person, within the terms of the EU’s General Data Protection Regulation (GDPR) and of the relevant National Privacy Legislation, is:

Dr. Martin Gostentschnig

Kriya Yoga Centre Europe

Pottendorferstr. 69

2523 Tattendorf

Austria

A. General information on data processing

The extent of data processing

When you contact us verbally, by telephone, email, or in writing – via a form on our website especially for registration purposes (see below B.I.), or for initiation purposes (see below B.II.) – your personal data in the respective context is stored by us.

The scope of data processing

We process your personal data only if necessary and required.

Personal data submitted by you, is used exclusively for the fulfilment of the organisation’s scope and purpose: to process your requests and enquiries, for further contact in relation to mailings and information about our offers, and for identification purposes.(Please see below point B., for information on the extent of data processing in specific situations).

(Note: The purpose of the organisation, regulated in § 2 of the Bylaws of the Kriya Yoga Centre Europe, is the furtherance of the general public on ethical and spiritual levels and, in particular, to promote awareness of the authentic, original Kriya Yoga as it is taught by Paramahamsa Hariharananda, Paramahamsa Prajnanananda, and their authorized Kriya Yoga teachers.)

The legal base for data processing

Processing of your data occurs regularly only with your consent. Once we receive your consent, then Art. 6 para 1 lit. a, GDPR is the legal basis for the handling of your personal data.

The legal basis for handling and processing data in relation to membership, is Art. 6 para 1 lit. b, GDPR. This applies also to the processing operations which are necessary for the implementation of pre-contractual procedures.

The legal basis for handling personal data required for the fulfilment of other legal obligations, pertaining to our organisation Art. 6 para 1 lit. c, GDPR.

The legal basis for handling personal data required in relation to vital interests of an individual concerned or of other physical individuals, is Art. 6 para 1 lit. d, GDPR.

In the case of data processing required to safeguard a legitimate interest of our organisation, or of a third party, while your interests, fundamental rights and freedoms do not outweigh the aforementioned interests, then the legal basis is Art. 6 para 1 lit. f, GDPR. Art. 6 para 1 lit. f, GDPR.

The duration of storage and data deletion

Personal data is deleted or blocked as soon as the purpose of its storage is fulfilled. Storage of data can also occur in accordance with European or national legislatures. Blockage or deletion of data occurs also when the data retention period prescribed by the above-mentioned standards expires, unless there is a necessity for further storage related to a conclusion of a contract or contractual performance. Mandatory periods of data retention are for instance, fiscal, or commercial, law- related, storage periods.

B. Particulars on the extent of data processing in specific situations

I. Registration form (contact by email)

1. Description of the extent of data processing

When you want to register for a seminar, you can use the link on our website to access the registration form.

During that process, data is transferred to third parties (see below E.). In the process of using the registration form, the following data you have entered is transmitted to us:

– First name
– Surname
– Address
– Telephone number and type of phone line
– Email
– Gender
– Date of arrival
– Date of departure
– Kriya Yoga initiation: date and name of the initiating teacher

Once you send off your completed registration form, the following additional data is collected:

– IP address of the computer calling
– Date and time of registration

To process the relevant data within the registration procedure, your consent is required and you are referred to the data protection declaration.

Alternatively, contact can be established via the available email address, in which case, all personal data pertaining to the user’s email is collected and stored.

2. The scope of data processing

Processing of data is necessary for further contact, and to handle your request or query, in particular, for the identification and the establishment of fees for attending seminars at the Kriya Yoga Centre Europe.

Contact made by email justifies the processing of your data.

The remaining personal data handled during the dispatching process, is necessary to prevent a misuse of the contact form and to guarantee the safety of our information technology systems.

3. The legal basis for the processing of data

The legal basis for the processing of data, provided we have your consent is Art. 6 para 1 lit. a, GDPR.

The legal basis for the processing of data collected during the dispatch of an email is Art. 6 para 1 lit. f, GDPR.

In the case of email contact with the scope to perform a contract, the additional legal basis for processing data is Art. 6 para 1 lit. b, GDPR.

4. The duration of the storage

As a rule, data is retrievable for one year (for storage of the same data by third parties, please see below E.).

However, an archiving process occurs as well, which becomes available in case of need. It can generally be said that storage occurs until its purpose ceases to be applicable. In the case of data taken from the entry listings of the contact form, or those sent by email, the purpose ceases when the conversation with the specific user ends. A conversation is concluded when it can be determined from the circumstances that the situation in question has come to a resolution. Data collected during the dispatch process is part of a data set and is deleted when the other data is deleted.

5. The right of objection and removal option

The user has the right, at any time, to withdraw his-her consent to the processing of his-her personal data. The user who contacts us per email, can object to the retention of his-her personal data at any time. In that case, the conversation cannot continue.

A description on how to execute the withdrawal of consent and the objection of data storage is to follow, and, in which case, all personal data collected when establishing contact, is deleted.

II. Initiation form

1. Description of the extent of data processing

Whoever wants to get initiated at the Kriya Yoga Centre Europe, has to fill in the initiation form.

We collect the following data from the form:

– First name
– Surname
– Address
– Date of birth
– Telephone and mobile number
– Email
– Information provided by you to the question “Where did you hear about Kriya Yoga?”
– Information provided by you to the question “Where did you hear about this specific programme?”
– Information provided by you to the question “Have you previously practiced other meditation techniques and if “yes, which ones?”
– Information provided by you to the question “Are you teaching another type of yoga?”

For the processing of the relevant data, you give consent with your signature on the initiation form and you are referred to this data protection declaration.

In that respect, a transfer of data to a third party occurs (see below, E.).

2. The scope of data processing

Data processing serves as a safeguard against possible recourses, for the appropriate execution of your initiation and also for establishing contact, especially to identify you as an initiate in the authentic, original Kriya Yoga as it is taught by Paramahamsa Hariharananda, Paramahamsa Prajnanananda and their authorized Kriya Yoga teachers.

3. The legal basis for the processing of data

The legal basis for data processing is Art. 6 para 1 lit. a, GDPR.

4. The duration of the storage

All data is deleted as soon as it is not required anymore to achieve the purpose.

5. The right of objection and removal option

The user has the right, at any time, to withdraw his-her consent to the processing of his-her personal data. In that case, all personal data which had been stored during the storage of the initiation form, is deleted.

III. Other

It is not possible to establish general criteria for the extent of data processing. The extent depends specifically on the circumstances of each individual case and on the purpose behind the processing of data (see A.). Only data which is required to contact you is being stored.

C. Provision of the website and creation of log files

I. Description of the extent of data processing

Anytime our webpage is accessed, our system records data and information from the computer system related to the calling computer.

The following data is collected:

  • Websites through which the user’s system connects to our internet page
  • Websites which are called by the user’s system via our website
  • Date and time of access
  • Transferred data volume in Byte
  • Information on the type of browser and the version used
  • The user’s operating system
  • The user’s internet service provider
  • The user’s IP address

Data is stored within our system in log files. However, no storage occurs in relation to other personal, individual data of the user.

II. The scope of data processing

The transitory storage of your IP address is necessary, in order to enable the display of the website on your computer. For that purpose, the user’s IP address needs to be stored for the duration of the session.

The storage on log files is required to guarantee the operability of the website. Moreover the data enables the optimization of the website and ensures the security of our information technology systems. Data analysis for marketing purposes does not occur in this context.

III. The legal basis for data processing

The legal basis for the temporary storage of data on log files is Art. 6 para 1 lit. f, GDPR.

IV. The duration of storage

All data is deleted when it is no longer required for the purpose of its collection. In relation to data collection for the provision of the website, this is the case when the respective session is concluded. In relation to storage of data in log files, it is deleted within 24 hours.

V. The right of objection and removal option

Data collection for the provision of the website and storage of data in log files are necessary for operating the internet page. There is, therefore, no right of objection available to the user.

D. Cookies

We use on our webpage so-called “cookies” for the recognition of multiple usage of the website. They are small text files which, via your internet browser, are placed and stored on your computer. They do not cause any harm.

Most of the time they are “session-cookies” which are deleted after your visit, Some cookies, however, are stored on your device until you delete them, and they provide information in order to recognize you on your next visit. They help us to make our internet site more user- friendly and therefore more effective.

You can prevent the installation of cookies in the browser settings. The deactivation, however, could restrict the functionality of our website.

E. Transfer of personal data to third parties

I. Jot Form

Description of the extent of data processing

The registration form mentioned under B.I. is operated by the external provider Jot Form,

It can be accessed via a link on our home page. Data mentioned in B.I. is collected and stored by the provider Jot Form and then transmitted to us.

The legal basis for data processing

The legal basis for processing your personal data via the provider JotForm is Art. 6 para 1 lit. f, GDPR.

The scope of data processing

The utilisation of Jot Form ensures technical functionality of the form under B.1. and its appropriate display on the website. A basic registration per email would only be possible with a substantial effort. Even to integrate a self-made form into the website would only be possible with substantial investment. Jot Form allows a comfortable and secure registration for the developer, the participant, as well as for the administrator. This purpose simplification reflects also the legitimate purpose of data processing.

The duration of storage

Data is deleted as soon as the purpose of its storage is fulfilled: data is deleted manually after one year.

The right of objection and removal option

Data processing via JotForm can be prevented by registering for the programmes with an email addressed to the Kriya Yoga Centre Europe, or by registering over the phone. Already processed data can be deleted earlier, by putting in a request to the Kriya Yoga Centre Europe.

II. Lucky Cloud

Description of the extent of data processing

Data processed by the provider JotForm (see E. I.) – concerning registration at the Kriya Yoga Centre Europe, and seminar- related statements of accounts which are still being processed (current financial year) – are also stored and processed on an external Cloud belonging to the provider Lucky Cloud.

The legal basis for data processing

The legal basis for processing personal data is, in this case also Art. 6 para 1 lit. f, GDPR.

The scope of data processing

Personal data processing and storage on the external cloud, allows more than one individual to have access to the same data simultaneously.

The duration of storage

Data is deleted as soon as the purpose of its storage is fulfilled: data is deleted manually after one year.

The right of objection and removal option

The processing of data can be prevented and already processed data can be deleted earlier, if a specific request is addressed directly to the Kriya Yoga Centre Europe.

III. Mailer Lite

For the purpose of electronically transmitting information about our programs, other offers and activities, our emails are sent via Mailer Lite in order to reach numerous users and customers at the same time. (www.mailerlite.com)

For this purpose, some personal data – first name, last name, email address, address, place of residence, country, telephone, preferred method of contact, IP of registration, time of registration – are stored on a server of the provider Mailer Lite.

For more detailed information, please refer to the general data protection guidelines of the provider Mailer Lite. (Privacy Policy – Mailer Lite)

IV. Organisation for humanitarian aid “Hand in Hand”

1. Description of the extent of data processing

When new initiates tick the appropriate box on the initiation form to explicitly consent to receive updates and information from Hand in Hand, their name, address and email address will be forwarded to the humanitarian aid organization.

2. The legal basis for data processing

The legal basis for this data processing is Art. 6 para 1 lit. f, GDPR.

3. The scope of data processing

Scope of the data processing is to support the humanitarian aid organization so that it can contact the newly initiated for the purpose of acquiring new donors.
There is a close relationship between the Kriya Yoga Centre Europe and the humanitarian aid organization Hand in Hand: The Kriya Yoga Centre Europe has supported Hand in Hand since its founding. Therefore, the success of the Hand in Hand organization is also largely dependent on being able to send mail to initiated Kriya Yoga students.

4. The duration of storage

As a principle, personal data is stored as long as it is required for the specific processing purpose. This means that they are stored for the duration of the required processing and beyond, depending on the remaining reasons. Other acceptable reasons and related deadlines are to do with tax law retention periods, and the registration of records for evidence purposes in the case of legal disputes (up to 30 years according to the periods of limitation in the Austrian General Civil Code).

5. The right of objection and removal option

The processing of data can be prevented and already processed data can be deleted earlier, if a specific request is addressed directly to the Kriya Yoga Centre Europe.

V. Group Leaders

1. Description of the extent of data processing

Name, address and email address of new initiates are forwarded also to the Kriya Yoga Group Leaders.

2. The legal basis for data processing

The legal basis for this data processing is Art. 6 para 1 lit. f, GDPR

3. The scope of data processing

Transmission of data occurs for the purpose of identification. Group Leaders are part of the organisational structure. In order to answer the question whether a certain individual has received initiation into Kriya Yoga, enabling him-her to participate at the relevant Kriya Yoga exercises and sessions, communication within the organisational structure is essential.

4. The duration of storage

As a principle, personal data is stored as long as it is required for the specific processing purpose. This means that they are stored for the duration of the required processing and beyond, depending on the remaining reasons. Other acceptable reasons and related deadlines are to do with tax law retention periods, and the registration of records for evidence purposes in the case of legal disputes (up to 30 years according to the periods of limitation in the Austrian General Civil Code).

5. The right of objection and removal option

The processing of data can be prevented and already processed data can be deleted earlier, if a specific request is addressed directly to the Kriya Yoga Centre Europe.

VI. Partners

1. Description of the extent of data processing

The name, date of birth, address and the email address of new initiates are sent and transmitted to other partners (such as the Kriya Yoga centre in Sterksel, The Netherlands)

2. The legal basis for data processing

The legal basis for data processing is Art. 6 para 1 lit. f, GDPR

3. The scope of data processing

Transmission of data occurs for the purpose of identification. Group Leaders are part of the organisational structure. In order to answer the question whether a certain individual has received initiation into Kriya Yoga, enabling him-her to participate at the relevant Kriya Yoga exercises and sessions, communication within the organisational structure is essential.

4. The duration of storage

As a principle, personal data is stored as long as it is required for the specific processing purpose. This means that they are stored for the duration of the required processing and beyond, depending on the remaining reasons. Other acceptable reasons and related deadlines are to do with tax law retention periods, and the registration of records for evidence purposes in the case of legal disputes (up to 30 years according to the periods of limitation in the Austrian General Civil Code).

5. The right of objection and removal option

The processing of data can be prevented and already processed data can be deleted earlier, if a specific request is addressed directly to the Kriya Yoga Centre Europe.

VII. Third-party services:

We may use third-party services, such as Mailer Lite, PayPal, Google Analytics and Facebook, Instagram, that collect and analyse log data to help us improve our services to you. Our third-party partners may use cookies or other tracking technologies.

F. Your rights

You have the following rights in relation to data processing implemented by us: the right to information/disclosure, the right to rectification, the right to cancellation, the right to restriction of processing, the right to data portability, the right to revocation, the right of objection and the right to complain.

I. Right to information, disclosure (Art. 15 GDPR)

We aim to provide you, within a month of your request, all information pertaining to the processing of your specific personal data and its purpose.

II. Right to rectification (Art. 16 GDPR)

You can request the rectification of data which is incorrect or incomplete.

III. Right to cancellation (Art. 17 GDPR)

You have the right to the cancellation of the specific data when:

– your personal data is not necessary for the processing purpose,
– you withdraw your consent,
– the data has been processed unlawfully.

IV. Right to restriction of processing (Art. 18 GDPR)

You can request the restriction of the processing of your data for specific purposes only.

V. Right to data portability (Art. 20 GDPR)

You can ask us to provide you with the processed data in a structured, common and readable format and you can also request it to be sent to other responsible people.

VI. Right to revocation (Art. 7 Para 3 GDPR)

Your consent can be revoked at any time without reason. You can do this by sending us an email (see above for email address) or by sending us a letter (see above for postal address).

VII. Right of objection (Art. 21 GDPR)

You can object to data processing which is based on public and legitimate interest.

VIII. Right to complain to the data protection authorities (Art. 77 GDPR)

Should you believe that the processing of your personal data violates the GDPR, you have the right to complain to the National Data Protection Authority.

(For your information: in Austria it is the Data Protection Authority)

You can find the related forms at www.dsb.gv.at/dokumente.