Legal
This Privacy Policy is effective as of 9 September 2026.
If you are our customer, newsletter subscriber or website visitor, you entrust us with your personal data. We are responsible for their protection and security. Please familiarise yourself with the protection of personal data, the principles and the rights you have in connection with the GDPR (General Data Protection Regulation). The processing of personal data is further governed by Act No. 110/2019 Coll., on the Processing of Personal Data, as amended. The sending of commercial communications is governed by Act No. 480/2004 Coll., on Certain Information Society Services, as amended. Terms used in this Policy and not defined herein shall have the meanings set forth in the General Terms and Conditions of the Provider (hereinafter the “Terms and Conditions”), which are available on the Website. This Policy and the Terms and Conditions are mutually complementary.
We are the company Sanctum Lux Divine SRL, with its registered office at Strada Sănătății 9, Clădirea C2, Sat Păuleștii Noi, Comuna Păulești, 107403 Păulești, Romania, registration number (CUI): 47877852, registered in the Commercial Register (Registrul Comerțului) under file no. J29/710/2023, operating services under the trade name “Hestia Healing Arts” through the website at www.hestiahealingartsprague.com (hereinafter the “Website”).
We process your personal data as a controller, i.e. we determine how personal data will be processed and for what purpose, for how long, and we select any additional processors who will assist us with the processing.
If you wish to contact us during the processing, you may reach us by e-mail at: diana.cinpoeru@gmail.com or by phone at: +420 792 908 296.
A Data Protection Officer has not been appointed, as our organisation is not legally required to designate one.
We declare that, as the controller of your personal data, we comply with all statutory obligations required by applicable legislation, in particular the Personal Data Protection Act and the GDPR, and therefore that:
We process personal data that you provide to us yourself, as well as personal data that we obtain automatically in connection with your visit to our website (in particular through cookies and similar technologies), for the following reasons (to fulfil the following purposes):
We obtain the majority of data directly from you, in particular when ordering Services, when communicating with us, when subscribing to the newsletter or when otherwise contacting us. Certain data are obtained automatically when you visit the Website through cookies and similar technologies (see the “Cookies” section below). Depending on the nature of the matter, we may also obtain data from public registers or other publicly available sources.
When communicating with us or when using the Services, you may also provide us with data concerning other persons, for example a legal guardian of a minor or a person to whom your matter relates. We use such data only to the extent necessary to handle your matter, perform the contract, comply with legal obligations or protect rights. Where appropriate and feasible given the nature of the matter, please inform such persons that you are providing their data to us.
We necessarily require your personal data in the following scope: name and surname, e-mail address, telephone number, address (city), information about ordered Services and their progress, for the performance of the contract (e.g. reservation and provision of an Individual Session or Course, communication regarding the date and venue). In the course of providing the Services, we also maintain records of your participation in individual Services, records of your study progress (so-called progression tracking) and written records of communication with you, for the purpose of ensuring continuity and quality of the Services provided. We therefore process such data for the duration of the contract and subsequently for the period necessary to protect our legitimate interests.
In the course of providing the Services, we may process data concerning your health status that you disclose to us (in particular information about ongoing treatment, medications used, addictions, pregnancy, epilepsy, anxiety disorders or other physical or mental indispositions). Such data constitute a special category of personal data within the meaning of Article 9 of the GDPR. The legal basis for their processing is your explicit consent (Article 9(2)(a) of the GDPR), which you grant as part of the ordering process. The purpose of processing is exclusively the assessment of suitability and the safe provision of the Services. We process such data only to the extent necessary for the stated purpose and retain them for the duration of the contractual relationship and subsequently for the duration of the limitation periods (generally 3 years from the provision of the Service, unless otherwise stipulated by law). You may withdraw your consent to the processing of health data at any time; withdrawal of consent shall not affect the lawfulness of processing carried out prior to its withdrawal. However, withdrawal of consent may result in the inability to provide the Service or part thereof, if the processing of such data is necessary for the safe provision of the Service.
If you are a customer, we necessarily require your personal data (billing data) in order to comply with various statutory obligations, in particular those relating to the issuance and record-keeping of tax documents. We process personal data for this purpose for the period stipulated by applicable legislation.
We use your personal data (e-mail address and name) for the purpose of direct marketing – sending commercial communications. If you are our customer, we do so on the basis of our legitimate interest, as we reasonably assume that our news is of interest to you, for a period of 5 years from the last order. If you are not our customer, we send you newsletters only on the basis of your consent, for a period of 5 years from the granting thereof or until its withdrawal.
For this purpose, we process data relating to the use of our website, such as your IP address and browsing data, as well as personal data obtained from so-called necessary cookies (see below in the “Cookies” section). The purpose of processing is to identify you as a visitor when browsing the website or when logging in repeatedly. The reason for processing is our legitimate interest in ensuring a functional web presentation, and we generally process the data for the duration of your browsing session; however, if we store them for a longer period, it shall be for no more than 2 years.
For this purpose, we process data relating to the use of our website, such as your IP address, browsing data and your saved theme preference (light or dark mode). The purpose of processing is to customise the website to your preferences, such as location, language settings and your device. The reason for processing is our legitimate interest in personalising the website to the specific preferences of visitors, and we generally process the data for the duration of your browsing session; however, if we store them for a longer period, it shall be for no more than 2 years.
At present, the Website does not use analytical or marketing cookies, and we do not run advertising or audience-tracking on the Website. Should we introduce such tools in the future, we shall only do so on the basis of your prior consent, requested through a cookie banner on the Website, and we shall update this Policy accordingly beforehand.
For this purpose, we process in particular your identification data, data on the use of products and services or billing data, in order to safeguard our legitimate interests, specifically the maintenance of our internal records and the monitoring of the proper provision of our services, as well as the protection of our rights and legal claims. For this purpose, we process your personal data for the duration of the limitation period, including any period covering its suspension or interruption, but typically for no longer than 15 years after the delivery of goods or the provision of a service or digital content. If judicial, administrative or other proceedings are commenced, we shall process your personal data to the necessary extent also for the entire duration of such proceedings for the purpose of exercising or defending our legal claims.
At some of our courses and other services, we produce photographic documentation or video recordings. We use photographs and recordings in promotional materials, primarily on the Website and social media. The legal basis for producing and using such recordings is our legitimate interest in promoting our Services. You will be informed about the production of recordings prior to the commencement of the relevant Service. We never disclose the names of participants in connection with such materials, unless it constitutes a testimonial, and then exclusively on the basis of your consent. You have the right to object to the processing of your personal data for these purposes; if you do not wish to be captured in the recordings, please contact us at our contact details prior to the relevant event.
Visiting the Website is voluntary. If you wish to order Services, we require at least such data as are necessary for us to process your order. Without them, we may not be able to conclude a contract or provide the Service. We are required by law to process certain data, for example for accounting or tax purposes. Consent to the sending of commercial communications or to the processing of health data is voluntary. If you do not grant such consent, this shall not affect your ability to order Services or the basic functionality of the Website.
We retain your personal data for the duration of the limitation periods (generally 3 years; in the case of rights to compensation for damage to health or rights arising from unjust enrichment, up to 15 years), unless the law stipulates a longer retention period or unless we have stated otherwise in specific cases.
While processing your personal data, no automated decision-making or profiling within the meaning of Article 22 of the GDPR takes place that would produce legal effects concerning you or similarly significantly affect you.
We use cookies and similar technologies (such as browser local storage) on the Website. These help ensure the Website functions correctly, is secure, and remembers your preferences — for example, your saved light or dark theme choice. We use both technologies that are cleared when you leave the Website and those that remain on your device for a set period, but never longer than 2 years.
You may disable or clear cookies and local storage at any time in your internet browser’s settings; doing so may affect some preference-related features, such as your saved theme choice.
We protect personal data to the maximum extent possible using modern technologies corresponding to the current state of technical development. We have adopted and maintain technical and organisational measures to secure your personal data within the meaning of Article 32 of the GDPR, which prevent unauthorised access, misuse, damage or destruction of your personal data. These measures include, in particular, encryption of devices and storage, two-factor authentication, a strong password policy, regular data backups and restriction of access to personal data to authorised persons only. We regularly review and update the measures adopted with regard to the current state of technology and the level of risk.
Our employees and collaborators, who are bound by confidentiality obligations and have been trained in the area of personal data processing security, may have access to your personal data.
In order to ensure certain specific processing operations that we are unable to carry out on our own, we use the services and applications of processors who specialise in the relevant processing and comply with the GDPR. We also share your personal data with third parties where this is necessary for the performance of the contract or on the basis of our legitimate interest. These include the providers of the following platforms and services:
It is possible that in the future we may decide to use additional applications or processors to facilitate and improve the quality of processing. However, we undertake that in such case, when selecting processors, we shall impose at least the same requirements for security and quality of processing as we impose on ourselves.
We process data primarily within the European Union or in countries that ensure an adequate level of protection on the basis of a European Commission decision. However, your data may also be transferred to third countries outside the European Union, typically to the companies Modern Mystery School International Inc. or Microsoft, which may have their registered offices or servers outside the EU. In the case of data transfers to the USA, an adequate level of protection may be ensured on the basis of the European Commission’s adequacy decision under the EU-US Data Privacy Framework, provided that the relevant recipient is certified. All other transfers of data outside the EU shall be carried out only where an appropriate legal basis exists, in particular a European Commission adequacy decision, standard contractual clauses issued by the European Commission or another appropriate safeguard mechanism within the meaning of Article 46 of the GDPR.
In connection with the protection of personal data, you have a number of rights. If you wish to exercise any of these rights, please contact us by e-mail at: diana.cinpoeru@gmail.com. We shall respond to your request without undue delay, generally no later than within one (1) month. In justified cases, we may extend this period by a further two (2) months in accordance with the GDPR, of which we shall inform you. In order to protect your data, we may verify your identity in a reasonable manner. You have the right to information, which is fulfilled by this information page on the principles of personal data processing.
Right of Access (Article 15 of the GDPR): By virtue of the right of access, you may request at any time that we demonstrate, within a period of one (1) month, what personal data of yours we process and why, as well as information about our processing of such data. In exceptional cases, in particular due to the complexity or number of requests, we are entitled to extend this period by a further two (2) months, of which we shall inform you. If you so request, you may also receive a copy of your personal data: the first copy is free of charge; each additional copy may, however, be subject to a reasonable administrative fee.
Right to Rectification (Article 16 of the GDPR): If your circumstances change or you find your personal data to be inaccurate or incomplete, you have the right to have your personal data supplemented and amended.
Right to Restriction of Processing (Article 18 of the GDPR): You may exercise the right to restriction of processing if you believe that we are processing inaccurate data about you, if you believe that we are carrying out processing unlawfully but you do not wish to have all data erased, or if you have raised an objection to the processing.
You may restrict the scope of personal data or the purposes of processing. (For example, by unsubscribing from the newsletter, you restrict the purpose of processing for the sending of commercial communications.)
Right to Data Portability (Article 20 of the GDPR): You have the right to data portability, i.e. you may obtain from us all your personal data that you yourself have provided to us and that we process on the basis of your consent or on the basis of the performance of a contract, provided that the processing is carried out by automated means. We shall provide such data to you in a structured, commonly used and machine-readable format. You also have the right to request that we transfer such data directly to another controller, where technically feasible.
Right to Object (Article 21 of the GDPR): You may raise objections to the processing of personal data that takes place on the basis of our legitimate interest. Where marketing activities are concerned, we shall cease processing your personal data without further ado; in other cases, we shall do so unless we have compelling legitimate grounds to continue such processing.
Right to Withdraw Consent: Where the processing of your personal data is based on your consent, you have the right to withdraw such consent at any time, without stating a reason. Withdrawal of consent shall not affect the lawfulness of processing based on consent granted prior to its withdrawal. You may withdraw your consent by e-mail at: diana.cinpoeru@gmail.com or through the unsubscribe link in the e-mails sent.
You have the right to request the erasure of your personal data, provided that the statutory conditions set out in Article 17 of the GDPR are met. In such case, we shall erase all your personal data from our system and from the systems of all sub-processors and backups. To ensure the right to erasure, we require a period of one (1) month; in exceptional cases, we are entitled to extend this period by a further two (2) months, of which we shall inform you.
In certain cases, we are bound by a statutory obligation and, for example, must retain issued tax documents for the period stipulated by law. In such case, we shall therefore erase all such personal data that are not subject to another statutory obligation or for which we do not have another purpose for which we may continue to legitimately process them, typically for the establishment, exercise or defence of our legal claims. We shall inform you of the completion of the erasure by e-mail.
Our Services are primarily intended for adults. Persons over the age of 15 may participate in our Services and their personal data may be processed on the basis of their own consent. In the case of a person under the age of 15, the processing of personal data on the basis of consent is permissible only if the consent is given or approved by the legal guardian of such person. The participation of a minor (a person under the age of 18) in our Services is conditional upon the consent of their legal guardian and the minor’s own will. If we discover that we are processing personal data of a person under the age of 15 without the consent of their legal guardian, we shall take immediate measures to erase such data. In such case, please contact us at the e-mail address: diana.cinpoeru@gmail.com.
If you believe that we are not handling your data in accordance with the law, you have the right, in accordance with Article 77 of the GDPR, to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The lead supervisory authority for our company is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), with its registered office at B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 București, Romania (www.dataprotection.ro). If you are resident in the Czech Republic, you may also contact the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), with its registered office at Pplk. Sochora 27, 170 00 Prague 7 (www.uoou.cz). A list of supervisory authorities of the Member States is available on the website of the European Data Protection Board (https://edpb.europa.eu/about-edpb/about-edpb/members_en). We would appreciate it if you would first inform us of such suspicion so that we may investigate and remedy any potential shortcomings.
We send you e-mails with inspiration, articles or products and services, if you are our customer, on the basis of our legitimate interest in accordance with Section 7(3) of Act No. 480/2004 Coll., on Certain Information Society Services. If you are not yet a customer, we send them to you only on the basis of your consent. In both cases, you may unsubscribe from our e-mails by clicking the unsubscribe link in each e-mail sent.
We wish to assure you that our employees and collaborators who will process your personal data are obliged to maintain confidentiality regarding personal data and regarding security measures the disclosure of which would jeopardise the security of your personal data. This confidentiality obligation shall continue even after the termination of their contractual relationships with us. Without your consent, your personal data shall not be disclosed to any third party beyond the processors specified in this Policy and cases where disclosure is required by applicable legislation.
This Privacy Policy is effective as of 9 September 2026.