We collect personal data only to the extent necessary to provide our services, ensure your safety during retreats, and improve your experience with us. We collect data in the following categories:

Health and wellbeing data is a special category of personal data under Indonesian Law UU PDP and the EU GDPR. We process this data only with your explicit, informed consent and strictly for the purpose of ensuring your safety during our programs.

We use your personal data for the following lawful purposes:

We may share your data only in the following limited circumstances, and only with parties who are contractually bound to protect your information:

• Service Providers: Payment processors (e.g., Stripe, bank transfer platforms), email service providers (Mailchimp or equivalent), website hosting and analytics providers. All are bound by data processing agreements.
• Yoga Alliance & Affiliates: For Yoga Teacher Training graduates, your name and certification details are submitted to Yoga Alliance International or equivalent certifying bodies upon successful completion, with your consent.
• Indonesian Authorities: Government bodies including immigration (Imigrasi), local tourism boards, or health authorities when required by Indonesian law, court order, or legal obligation.
• Emergency Services: Police, medical services, or your designated emergency contact in the event of a medical or safety emergency during your stay at our sanctuary.
• Business Successors: In the event of a merger, acquisition, or sale of our business assets, personal data may be transferred to the successor entity, with notice provided to you.

Our website uses cookies and similar tracking technologies to enhance your browsing experience and understand how visitors interact with our content. Here is a breakdown of the cookies we use:

You may manage your cookie preferences at any time through your browser settings, or via our cookie consent tool. Please note that disabling essential cookies may impair website functionality.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by Indonesian law. Our general retention schedule is as follows:

• Booking & financial records

  7 years Indonesian tax law (UU Pajak) and financial reporting requirements.
• Health & medical disclosures

  5 years Safety records and potential insurance or liability purposes.
• YTT certification records

  Indefinitely Alumni records and certificate verification on request.
• Marketing communications

  Until opt-out Removed within 10 business days of an unsubscribe request.
• Website analytics data

  26 months Standard Google Analytics retention window.
• General inquiries & email

  3 years Customer service history and potential dispute resolution.

After the applicable retention period, data is securely deleted or anonymised.

Under Indonesian UU PDP and, where applicable, the EU GDPR, you have the following rights regarding your personal data. To exercise any right, contact us at info@balielingspirit.com. We will respond within 30 days.

We implement industry-standard technical and organisational security measures to protect your personal data against unauthorised access, loss, destruction, or alteration. These include:

• SSL/TLS encryption for all data transmitted via our website (HTTPS)
• Password-protected and access-controlled internal systems
• Restricted staff access to personal data on a need-to-know basis
• Regular security audits and vulnerability assessments of our website
• Secure deletion protocols for data that reaches end-of-retention
• Third-party service providers vetted for their own security certifications (e.g., PCI-DSS for payment processors)

Despite our best efforts, no method of internet transmission or electronic storage is 100% secure. In the event of a data breach that poses a risk to your rights and freedoms, we will notify you and the relevant Indonesian authority (BSSN) within 72 hours as required by UU PDP.

Our retreat programs and yoga teacher trainings are designed for adults aged 18 and over. We do not knowingly collect personal data from individuals under the age of 18 without verified parental or guardian consent.

If you are a parent or guardian and believe your child under 18 has submitted personal data to us, please contact us immediately at info@balielingspirit.com and we will promptly delete such information.

As a globally-attended sanctuary, your personal data may be processed by service providers located outside Indonesia (e.g., cloud hosting servers in Singapore or the EU, Yoga Alliance in the United States).

Where we transfer personal data internationally, we ensure appropriate safeguards are in place, including:

• Standard contractual clauses approved by relevant data protection authorities (for EU data subjects)
• Transfers only to countries or organisations with adequate data protection standards as assessed by Indonesia's BSSN or EU Commission
• Your explicit consent where required

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Material changes will be communicated via a notice on our website homepage and, where applicable, via email to registered guests and students.

We encourage you to review this page periodically. The "Last Updated" date at the top of this policy indicates when the most recent revision was made. Continued use of our website or services after any update constitutes your acknowledgement of the revised policy.

For any questions, requests, or concerns regarding this Privacy Policy or our data practices, please reach out to our Data Controller:

We aim to respond to all privacy-related requests within 30 days of receipt. For urgent data breach notifications, please mark your email subject: URGENT – Data Privacy.