Privacy policy

Scroll Down

1. Data controller

The data controller is DAVID ELIOT S.R.L., with its registered office in Maramureș County, Baia Mare, Strada Victoriei no. 11, apt. 26, Romania, registered with the Trade Register Office under no. J2024038670006, EUID ROONRC.J2024038670006, tax identification number (CUI) 50841050.

For questions and to exercise your rights regarding personal data, you can contact us at hello@davideliot.me.

2. Who and what this policy applies to

This policy applies to visitors of the website, people who submit forms, subscribe to the newsletter, request information, make a booking, buy or use services or courses, and users of the Elemente app. It also applies to another person’s data provided for a relationship analysis, within the limits described below.

3. Our principles

We process data lawfully, fairly and transparently, for specified purposes, using only the information that is necessary. We limit retention, access and disclosure, apply reasonable security measures and do not sell personal data. We do not use data for behavioral advertising and do not track users across services belonging to different companies.

4. Data we may process

Identification and contact data: first and last name, email, phone, address and billing information, when necessary.
Order and contract data: the service chosen, price, currency, payment status, invoices, bookings, correspondence and the history of the contractual relationship.
Astrological data: date, time and place of birth, the location relevant for the solar return, the type of analysis and the questions or context provided voluntarily.
Data for relationship services: birth details and initials of the other person, provided by the customer. We do not ask for that person’s contact details.
Data on yoga and safe participation: physical limitations, contraindications or other health information, shared only when necessary to adapt the practice.
Course and account data: login details, progress, access, answers, submitted materials and interactions with the course platform.
Communication data: messages from forms, emails, requests, feedback and communication preferences.
Newsletter and CRM data: name, email address, language, lists and tags, source and date of subscription, proof of consent, confirmation status, communications sent and unsubscribe history, managed through FluentCRM.
Email data: recipient, subject, date, delivery status and, if logging is enabled in FluentSMTP, the metadata or content of messages stored temporarily in WordPress.
Booking data: the service booked, date, time, time zone, booking status and the information needed to manage the booking through Fluent Booking Pro.
Technical and security data: IP address, device and browser type, operating system, timestamps, pages visited, login attempts, suspicious activity, technical identifiers, security logs and cookies, according to your settings.
App data: permissions granted, app version, device type, diagnostic data and, depending on the features used, the location needed to calculate sunrise, the date of birth for biorhythms and the preferences you set.
App journal data: intentions, actions, notes, energy levels and breath observations, kept on your device and, optionally, in your iCloud; they are not sent to us (section 9).
Limited payment data: transaction identifier, status, amount and limited information made available by the processor. We do not directly store the full card number or security code.

5. Sources of data

We collect data directly from you, through your forms and actions; from payment processors and distribution platforms regarding the status of a transaction; from the technical systems of the website and the app; and, for a relationship analysis, from the customer who requests the service.

6. Purposes and legal bases

When we rely on legitimate interest, we assess the necessity of the processing and its impact on the rights of the person concerned. You can request information about this assessment and object to the processing, under the conditions of the GDPR.

7. Sensitive data and health information

We do not ask for health data through the general contact form. For a yoga session or a practice that needs adapting, we may ask strictly for the information relevant to safety. This data is processed on the basis of explicit consent, separate from acceptance of the Terms.

You can refuse or withdraw consent; however, if the information is necessary to carry out a practice safely, we may not be able to provide or adapt the service. We do not make diagnoses and do not create medical records.

Please do not send, through free-text fields, information about health, sex life, religious or philosophical beliefs or other special categories of data that are not necessary for the requested service. If such information is sent to us incidentally, we will limit its use to what is strictly necessary and delete it without undue delay, unless there is a valid legal basis under Article 6 GDPR and an applicable condition under Article 9(2) GDPR.

8. The other person’s data in the relationship analysis

For synastry and the composite chart, the customer may provide the date, time and place of birth of another person. The source of this data is the customer. We ask for initials to be used and we do not ask for the other person’s address, email or phone.

The customer must have a legitimate basis for sharing the data and must give this person a link to this Policy before sending it. We process the data only to carry out the requested analysis, on the basis of performing the contract with the customer and our legitimate interest in providing the service with data minimization and confidentiality. The person concerned can contact us directly to exercise their rights.

When data is not obtained directly from the data subject, we provide the information required by Article 14 GDPR, within the time and in the manner it prescribes, except where one of the legal exemptions demonstrably applies. The customer may be asked to pass on to the data subject the information notice provided by DAVID ELIOT S.R.L.

9. The Elemente app

The app may use the device’s location to determine position and local sunrise, the date of birth to calculate biorhythms, and preferences for displaying cycles and practices. In the configuration envisaged at the date of this policy, the main calculations are performed locally on the device, and the exact location and date of birth are not sent to DAVID ELIOT S.R.L. and are not used for advertising or tracking.

Location permission can be refused or withdrawn in the device settings. In that case, the app may ask you to choose a location manually, or certain features may become unavailable. Data kept only on the device can be deleted in the app settings or by uninstalling the app.

The elemental journal. The app includes a personal journal in which you can write down the intention of a lunation, the actions planned in the element intervals, what took shape on a given day, your physical, emotional and mental energy levels, the breath observed at sunrise and sunset, the house of your natal chart in which the New Moon falls and the harvest at the close of the lunation. Entries are saved on your device and, if iCloud is enabled for the app, synced between your devices (for example iPhone and Mac) through the private iCloud database of your Apple account. DAVID ELIOT S.R.L. has no access to the content of the journal, does not receive it on its own servers and does not use it for analytics, advertising or profiling.

Storage and syncing through iCloud are provided by Apple, according to your account settings and Apple’s privacy policy. You can turn off syncing in your device’s iCloud settings; entries then remain only on the device. You can delete a journal entry at any time. Uninstalling the app deletes the data on the device, while the synced copy remains in iCloud until you delete it from your Apple account’s iCloud settings.

Reminders for journal actions are local notifications, scheduled on the device only with your permission, and do not pass through the servers of DAVID ELIOT S.R.L. Notification permission can be withdrawn at any time in the device settings.

Write in the journal only what you choose to. If you decide to note health information or other sensitive data, it stays on your device and in your iCloud, without being sent to us.

If a future version introduces an account, syncing through our own servers, personalized notifications, usage analytics or error reporting that collects data, the policy and the App Store information will be updated before the feature is enabled. The app will request permissions only for the features that need them.

10. Providers, applications used and recipients

Access to data is limited to the people and providers who need it for the purposes described. The website uses WordPress and the following technical components:

Fluent Forms Pro, for contact and service forms, collecting the information needed for orders and initiating payments through Stripe;
FluentCRM, for managing, locally within the WordPress infrastructure, contacts, subscriber lists, consents, unsubscribes and newsletters;
FluentSMTP, for sending the emails generated by the website and, if logging is enabled, for temporarily keeping information about messages and their status in WordPress;
Fluent Community Pro, for managing courses, student accounts, access to materials and progress;
Fluent Booking Pro, for scheduling and managing sessions;
ACF Pro and Elementor, for organizing, managing and displaying the website’s content and fields;
Patchstack, for protecting the website, filtering malicious access, security scanning, identifying vulnerabilities and, when necessary, cleaning or restoring the website.

These components operate mainly within the WordPress infrastructure. Data may become accessible to their providers only if external features, telemetry or third-party integrations are enabled, or if we request technical support that requires access to the website.

Depending on the service used, data may be shared with the following recipients:

the WordPress hosting and maintenance provider, for storage, operation, backup and security of the website;
Stripe Payments Europe, Limited and its affiliates, for processing payments initiated through Fluent Forms Pro, Fluent Community Pro and Fluent Booking Pro, authenticating transactions and preventing fraud;
Amazon Web Services EMEA SARL and Amazon Simple Email Service, for sending operational emails, confirmations, notifications and newsletters;
Patchstack and the service’s technical provider, for firewall, monitoring of suspicious activity and security scanning, including off-server scanning of WordPress files and tables, to the extent necessary for the service;
Cloudflare, Inc., through Cloudflare Turnstile, for protecting forms against spam and automated access. The data processed for this purpose is described in the Turnstile Privacy Addendum;
Apple Distribution International Limited, Apple Inc. and the App Store operators, for app distribution, payments, subscriptions, reporting and platform services;
video conferencing or calendar providers used for sessions, as communicated at booking;
technical providers for security, backup, optimization and support, to the extent that they may have incidental access to data;
the accountant, legal advisers and other professionals bound by confidentiality obligations;
public authorities, courts or other entities, when disclosure is required by law or necessary to defend rights.

Data entered in Fluent Forms Pro, FluentCRM, Fluent Community Pro and Fluent Booking Pro is kept in the WordPress database or in the infrastructure associated with the website, according to the configuration applied by DAVID ELIOT S.R.L.

Telegram may be used for administrative alerts. Notifications are limited to minimal operational information and do not include date or place of birth, health information, the content of free-text messages, documents or payment data. The full content of forms is not sent through Telegram.

We do not sell or rent personal data and do not share it with third parties for their own advertising.

11. Transfers outside the European Economic Area

Using some international providers, including Amazon Web Services, Stripe, Apple, Patchstack, Cloudflare and Telegram, may involve data being accessed or processed outside the European Economic Area. When such a transfer takes place, it is based on a mechanism recognized by the GDPR, such as an adequacy decision, the EU-US Data Privacy Framework for certified recipients, standard contractual clauses approved by the European Commission, additional technical and organizational measures or another applicable legal safeguard.

You can request further information about the mechanism used for a particular provider at hello@davideliot.me.

12. Retention period

When the retention periods expire, data is deleted, anonymized or archived with restricted access, as appropriate. A dispute, an inspection or a legal obligation may justify retention until final resolution.

13. Cookies and similar technologies

Strictly necessary cookies may be used without consent when they are essential for the functionality requested. Analytics, marketing, personalization or non-essential external content cookies are activated only after the user’s choice, through the consent mechanism.

Refusing non-essential cookies must be as easy as accepting them. Users can change their choices at any time. The specific list of cookies, providers, purposes and durations is available in the Cookie Policy and in the preferences panel.

Videos, maps, reCAPTCHA, analytics tools or other third-party elements that set non-essential cookies will not be loaded before consent, unless there is another clear legal basis and the user is informed.

14. Newsletter and commercial communications

The newsletter is sent only after consent has been given and the subscription confirmed through the double opt-in mechanism. Consent can be withdrawn at any time through the unsubscribe link in each message or by email to hello@davideliot.me. Withdrawal does not affect the lawfulness of prior processing.

Messages strictly necessary to perform a contract, secure an account, change a service or resolve a request are not commercial communications and may be sent on the basis of the contract, a legal obligation or legitimate interest.

15. Rights of the data subject

Under the GDPR, you can request:

access to your data and a copy of it;
rectification of inaccurate data or completion of incomplete data;
erasure of data, when there is no longer a basis for keeping it;
restriction of processing;
portability of the data you provided, when processing is based on consent or contract and is carried out by automated means;
objection to processing based on legitimate interest;
withdrawal of consent at any time;
not to be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you;
to lodge a complaint with a supervisory authority.

To exercise your rights, write to hello@davideliot.me. We may ask for additional information strictly necessary to verify your identity. We respond without undue delay and, as a rule, within one month at most. This period may be extended by two further months for complex or numerous requests, in which case you will be informed within the first month.

These rights are not absolute. For example, certain data cannot be erased while there is a legal obligation to keep it or while it is necessary for the establishment, exercise or defense of legal claims.

16. Automated decisions and profiling

We do not use data for decisions based solely on automated processing that produce legal effects or significantly affect the person. The automatic calculations and displays in Elemente are informative and do not make decisions on the user’s behalf.

17. Children’s data

The website, the contractual services and the newsletter are not directly intended for people under 16 without the involvement of their legal representative. We do not knowingly collect children’s data for marketing. If we learn that such data has been provided without an appropriate basis, we will delete it.

A minor’s participation in yoga, courses or other activities requires the consent of their legal representative and compliance with the specific conditions communicated before registration.

The age threshold of 16 concerns only situations in which an information society service is offered directly to a child and the processing of data is based on consent, under Article 8 GDPR. This threshold is distinct from the age of 18 regarding full legal capacity and entering into contracts. People under 18 may purchase or use paid services only through their legal representative or with their consent, in accordance with the law.

18. Data security

We apply technical and organizational measures proportionate to the risk, including access control, adequate passwords and authentication, encrypted connections, updates, backups, limiting data in notifications and incident response procedures. No method of transmission or storage can guarantee absolute security.

In the event of a security breach, we assess the risk and notify the supervisory authority and the people affected when the GDPR requires it.

19. Complaints

We encourage you to contact us first at hello@davideliot.me to try to resolve your request. You have the right to lodge a complaint with the Romanian National Supervisory Authority for Personal Data Processing (ANSPDCP), Bd. G-ral Gheorghe Magheru nr. 28-30, sector 1, Bucharest, 010336, Romania, email anspdcp@dataprotection.ro, website dataprotection.ro, or with the competent authority in the country where you live or work.

20. Changes to this Policy

We may update this policy to reflect legislative, technical or processing changes. The date of the last update is shown at the beginning. For significant changes we will use an appropriate notice, and if a new purpose requires consent, it will be requested before the processing.

21. Contact

DAVID ELIOT S.R.L.

Registered office: Maramureș County, Baia Mare, Strada Victoriei no. 11, apt. 26, Romania

Tax ID (CUI): 50841050 | Trade Register no.: J2024038670006

Privacy email: hello@davideliot.me

Yoga studio

Contact

Connections