Last updated: 18 Aug 2026
1. Introduction
Welcome to Marma Ayurveda. We are committed to protecting your privacy and ensuring that your personal data is handled securely, transparently, and lawfully. This Privacy Policy has been designed in strict compliance with the EU General Data Protection Regulation (GDPR / RODO) and the Polish Personal Data Protection Act of 10 May 2018.
This policy explains how we collect, use, process, and store your personal data when you interact with our website, book Ayurvedic consultations or Kalaripayattu training, undergo Marma therapy, or purchase physical and digital products from our shop.
2. Identity of the Data Controller
For the purposes of data protection legislation, the data controller responsible for processing your data is:
Piotr Czopek, trading as Marma Ayurveda Piotr Czopek entered into the Central Registration and Information on Business (CEIDG) kept by the minister competent for economy in Poland. Registered Address: ul. Leżakowa 9, 93-430 Łódź, Poland NIP: 9442127860 Contact Email: info@marmaayurveda.org
3. Legal Basis for Processing Your Data
Under the GDPR (RODO), we process personal data only when we have a lawful basis for doing so:
- 3.1 Contractual Obligation (Art. 6(1)(b) GDPR): To process shop orders (e.g., copperware, cosmetics), provide access to online courses, or fulfil bookings for consultations, therapies, and training sessions.
- 3.2 Legitimate Interests (Art. 6(1)(f) GDPR): For essential business operations, including confirming appointments, managing website security, and tracking non-intrusive analytics to improve our services.
- 3.3 Legal Obligation (Art. 6(1)(c) GDPR): To comply with Polish tax and accounting regulations, as well as statutory health record-keeping requirements.
- 3.4 Vital Interests (Art. 6(1)(d) GDPR): If we believe there is a serious, immediate risk to your health or safety, we may share information with emergency services.
- 3.5 Consent (Art. 6(1)(a) GDPR): To send you newsletters, promotional offers, or to utilise non-essential tracking cookies. You can withdraw this consent at any time.
4. Special Category Data (Health Data)
Because we offer Ayurvedic consultations and Marma therapy, we collect information concerning your health (e.g., dosha assessments, physical conditions, and medical history). Under GDPR Article 9, this is classified as "Special Category Data." We strictly process this highly sensitive data under the following conditions:
- With your explicit written consent (gathered via our intake forms prior to your consultation or treatment).
- For the purposes of providing preventative or occupational medicine, medical diagnosis, or the provision of health care therapies.
5. Information We Collect
We collect personal data when you:
- Book an Ayurvedic consultation, Marma treatment, or Kalaripayattu class.
- Purchase a product, gift voucher, or online course from our shop.
- Sign up for our mailing list.
- Fill out an intake, contact, or health history form.
5.1 Types of Data Collected
- Identification & Contact Info: Name, email address, phone number, billing, and shipping address.
- Health & Medical Data: Dosha constitution, relevant medical history, lifestyle details, and clinical notes (collected strictly for consultations and therapy).
- Payment Data: Payment method details (processed securely via our payment gateways; we do not hold full credit card details on our servers).
- Technical/Browsing Info: IP address, browser type, device type, and basic interactions with our website.
- Minor Data: We do not knowingly collect data from minors unless it is essential for a consultation or training session, and strictly under explicit parental/guardian consent.
6. Cookies & Tracking Technologies
Our website uses cookies to function correctly, process shopping carts, and analyse site traffic. In line with EU ePrivacy directives and GDPR, we will always ask for your explicit consent before placing any marketing or non-essential third-party tracking cookies on your device. Please see our separate Cookie Policy for full details and to manage your preferences.
7. Third-Party Services & Data Sharing
We do not sell your data. We only share it with trusted third parties necessary to run our business. Where these providers are located outside the European Economic Area (EEA), we ensure appropriate data transfer safeguards are in place:
- Payment Gateways: (e.g., Przelewy24, Stripe, PayPal) for secure transaction processing.
- Shipping & Fulfilment: (e.g., InPost, Polish Post, Couriers) to deliver your physical shop orders.
- Marketing Platforms: To deliver newsletters, provided you have opted in.
- Healthcare Providers/Authorities: Only with your explicit request, or if legally mandated by Polish authorities.
7.1 Sharing within our Partner Network
To provide a seamless experience, fulfill your orders, and manage our administrative operations, we may share your personal data (such as name, contact details, and transaction history) between our two primary operating entities:
- Karuna Yoga & Ayurveda (Registered in the UK: Office 345, Unit 5, 399–405 Oxford Street, London, W1C 2BU)
- Marma Ayurveda Piotr Czopek (Registered in Poland: ul. Leżakowa 9, 93-430 Łódź, NIP: 9442127860)
Both entities operate under strict data protection standards and act as Joint Data Controllers for the purposes of managing website operations, customer service, and business administration.
Note regarding health data: Highly sensitive health information, such as consultation notes from private Ayurvedic or Marma therapy sessions, will only be accessed by the specific practitioner you are working with, unless you give explicit, separate consent for us to share your case file between practitioners.
7.2 International Data Transfers (Transfers to the UK)
Because our partner entity, Karuna Yoga & Ayurveda, is located in the United Kingdom, certain administrative and transactional personal data will be transferred outside the European Economic Area (EEA).
We conduct these transfers lawfully under Article 45 of the GDPR, relying on the European Commission’s Adequacy Decision for the United Kingdom. This decision officially recognises that the UK legal framework provides an essentially equivalent level of data protection to that of the European Union. Your data remains fully protected under these equivalent standards when shared between our EU and UK entities.
8. Data Retention
We retain your data only for as long as necessary:
- Health/Consultation Records: Retained for the duration necessary to provide therapies and defend against potential civil claims (typically 6 years under Polish law), or as strictly required by Polish health record regulations.
- Transactional & Tax Data: Kept for 5 years from the end of the calendar year in which the tax payment deadline expired, to comply with Polish accounting and tax laws (Ustawa o rachunkowości).
- Marketing Data: Retained until you unsubscribe or withdraw your consent.
9. Your Rights Under GDPR (RODO)
You have the right to:
- Access: Request a copy of the personal data we hold about you.
- Rectification: Request corrections to inaccurate or incomplete data.
- Erasure: Request the deletion of your data (the "right to be forgotten"), subject to our legal obligations to retain tax or health records.
- Restriction/Objection: Limit or object to how we process your data.
- Portability: Request your data be transferred to another provider.
To exercise any of these rights, please contact us at info@marmaayurveda.org.
10. Complaints & Dispute Resolution
We take your privacy seriously. If you have any concerns about how we have handled your personal data, please contact us first at info@marmaayurveda.org so we can investigate and resolve the issue.
If you remain unhappy with our response, you have the statutory right to lodge a complaint with the Polish supervisory authority for data protection:
President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych - PUODO) Website: www.uodo.gov.pl Address: ul. Stawki 2, 00-193 Warszawa, Poland
11. Policy Updates
We may update this policy occasionally to reflect changes in our services or updates to EU/Polish data protection legislation. Updates will be posted on this page.