Privacy Policy

The legally binding version of this policy is the German version.

1. Controller

The controller responsible for the processing of personal data on this website is:
Devinaya House LLC, 75 E 3rd St, Sheridan, WY 82801, USA
Represented by: Valeria Told and Dominik Told, Managing Members
Email: privacy@devinaya.com
Website: https://valeriatold.com/

2. Representative in the European Union

Where Art. 27 GDPR applies, Devinaya House LLC has appointed a representative in the European Union:
Fortissimo SRLS, Via Giovanni Segantini 4, 39012 Merano (BZ), Italy
Email: privacy@devinaya.com

3. General information on data processing

We process personal data only to the extent necessary to provide a functional website, to handle enquiries, to carry out pre-contractual measures and contracts, to comply with legal obligations, or on the basis of valid consent. Personal data means any information that can be used to identify a person directly or indirectly.

4. Legal bases

Art. 6(1)(a) GDPR: consent, for example for optional cookies, embedded media or newsletters.
Art. 6(1)(b) GDPR: contract and pre-contractual measures, for example for bookings, orders and payment processing.
Art. 6(1)(c) GDPR: compliance with legal obligations, in particular commercial and tax retention requirements.
Art. 6(1)(f) GDPR: legitimate interests, for example the secure and stable operation of the website. The specific interest is stated for each processing activity.

5. Storage period

We store personal data only for as long as is necessary for the respective purpose. Afterwards, the data is deleted or anonymised, unless statutory retention obligations, the establishment, exercise or defence of legal claims, or other permissible grounds prevent deletion.

6. Hosting and server logs

When you visit this website, the hosting provider processes technically necessary connection data. This may include your IP address, date and time of access, the page or file requested, referrer URL, browser type, operating system, amount of data transferred and status messages. The processing serves to provide the website securely, reliably and without errors. The legal basis is Art. 6(1)(f) GDPR.

Hosting provider: Checkdomain GmbH, Große Burgstraße 27/29, 23552 Lübeck, Germany. According to Checkdomain, log files are deleted after 14 days at the latest. IP addresses may be stored for up to 14 days to ensure operation and, where technically possible and appropriate, anonymised after as little as 24 hours.

7. Cookies and consent management

Our website uses cookies and similar technologies. Technically necessary technologies and functionally required services are used so that the website works securely and so that functions you have expressly requested can be provided. Optional technologies for statistics or marketing are activated only after you have given your explicit consent.

To manage your consents, we use the WordPress plugin Real Cookie Banner. Your choice is stored in a technically necessary cookie and additionally documented in the database of our WordPress website. In particular, a randomly generated consent identifier, the time and scope of your choice, the version of the cookie banner used, the page visited, and a shortened and hashed IP address are processed. The legal basis is Art. 6(1)(c) GDPR in conjunction with the legal requirements for obtaining and documenting consent, supplemented by Art. 6(1)(f) GDPR.

Real Cookie Banner is operated entirely on our own web server. The documented consents are not transmitted to the manufacturer of the plugin. The cookie begins with real_cookie_banner and is stored for 365 days by default. You can change or withdraw a consent you have given at any time with effect for the future via the “Cookie settings” link in the footer.

8. Contact

If you contact us by email, contact form or another communication channel we offer, we process your details to handle your enquiry and for possible follow-up questions. The legal basis is Art. 6(1)(b) GDPR if your enquiry relates to a contract or pre-contractual measures; in other cases Art. 6(1)(f) GDPR.

For forms, registrations and bookings we use Somba, provided by Sigrun GmbH, Swiss Post Box 102843, Zürcherstrasse 161, 8010 Zürich, Switzerland. The forms are embedded via the subdomain links.devinaya.com. When you visit a page with such a form, a connection to Somba is established. In particular, your IP address, the date and time of the request, and browser and device information may already be processed before you submit the form. The legal basis is Art. 6(1)(f) GDPR and, where a contract is being initiated, additionally Art. 6(1)(b) GDPR. Further information: https://www.somba.io/privacy-policy

8.1 Communication via WhatsApp

If you contact us via WhatsApp or use a WhatsApp link provided on our website, we process in particular your phone number, your name or profile name, the content of your message, and communication and metadata. The provider for people in the European Region is WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Further information: https://www.whatsapp.com/legal/privacy-policy-eea

8.2 Communication via Telegram

If you contact us via Telegram, join our community or use a Telegram link provided on our website, we process in particular your Telegram username or profile name, your phone number to the extent it is visible according to your settings, the content of your messages, and communication and metadata. The provider is Telegram Messenger Inc. Telegram has appointed the European Data Protection Office (EDPO), Avenue Huart Hamoir 71, 1030 Brussels, Belgium, as its representative in the EU. Further information: https://telegram.org/privacy

9. Newsletter and email communication

If you subscribe to our newsletter, we process in particular your email address as well as evidence of your registration, consent and, where applicable, confirmation. The logging of the registration is based on Art. 6(1)(f) GDPR. You can unsubscribe from the newsletter at any time via the unsubscribe link or by sending us a message. Service provider: Somba, offered by Sigrun GmbH, Swiss Post Box 102843, Zürcherstrasse 161, 8010 Zürich, Switzerland.

Success measurement: Our newsletters contain technologies that allow us to evaluate delivery as well as opens and clicks. For this purpose, in particular the time of opening, links clicked, technical connection data and the assignment to a recipient account may be processed. The legal basis is your consent under Art. 6(1)(a) GDPR, which you can withdraw at any time.

10. Bookings, online programmes, contracts and customer account

When you make an enquiry or a booking, register for an online programme or make a purchase, we process the data required for the offer, contract, service delivery, customer service and billing. This may include master, contact, contract, booking, communication and billing data. The legal basis is Art. 6(1)(b) GDPR. We process records relevant for tax and commercial law on the basis of Art. 6(1)(c) GDPR. System used: Somba for forms, CRM, newsletters, appointment booking, invoicing, payment processing and, depending on the offer, course and member areas.

11. Payment processing

For paid offers we use Somba to create and manage invoices and for the technical processing and allocation of payments. Depending on the payment method selected, the required data is transmitted via Somba to the respective payment service provider. The legal basis is Art. 6(1)(b) GDPR, supplemented by Art. 6(1)(c) GDPR.

Stripe: The contracting party for the US Stripe account is Stripe, Inc., 354 Oyster Point Boulevard, South San Francisco, CA 94080, USA. Further information: https://stripe.com/privacy
PayPal: The contracting party is PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg. Further information: https://www.paypal.com/de/legalhub/paypal/privacy-full
Other payment methods: credit card, Apple Pay and Google Pay, where offered within the Stripe payment process; also bank transfer to a business account at Revolut Technologies Inc., 107 Greenwich Street, 20th Floor, New York, NY 10006, USA.

12. Embedded content and external media

YouTube: Videos of the YouTube service are embedded on individual pages. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you visit a page with embedded YouTube content, a connection to Google may be established even before playback. Further information: https://policies.google.com/privacy

Appointment booking and Zoom: To arrange appointments we use the booking function of Somba. In particular, name, email address, requested appointment and, where applicable, further details are processed. The legal basis is Art. 6(1)(b) GDPR. After booking, a link to join a video conference via Zoom is sent. The provider is Zoom Communications, Inc., 55 Almaden Blvd, Suite 600, San Jose, CA 95113, USA.

Other external content: External links to social networks, Telegram, Amazon or YouTube only lead to the respective platform when you click on them.

13. Web analytics and marketing

Where we use analytics or marketing services, they are generally activated only after your consent. The legal basis is Art. 6(1)(a) GDPR. You can withdraw your consent at any time via the cookie settings.

Google Analytics 4: The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. In particular, pages viewed, interactions, approximate location information, device and browser information and online identifiers may be processed. Further information: https://policies.google.com/privacy

Meta Pixel: We use the Meta Pixel on our website, provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. The Meta Pixel helps us recognise whether people visit our website after coming into contact with an advertisement on Facebook or Instagram and carry out certain actions there, for example viewing a page, submitting a form, or completing a booking or purchase. This allows us to measure the effectiveness of our advertising, build audiences for advertisements and show ads on Facebook and Instagram in a more targeted way. In particular, the following may be processed: pages viewed, page and button interactions, time, referrer URL, browser and device information, IP address, cookie and advertising identifiers, and information about bookings or purchases. If we enable advanced matching, contact details you provide may additionally be transmitted to Meta in hashed form. The Meta Pixel and comparable marketing technologies are activated only after your explicit consent. The legal basis is Art. 6(1)(a) GDPR. You can withdraw your consent at any time with effect for the future via the cookie settings. We and Meta Platforms Ireland Limited may be jointly responsible for the collection and transmission of certain event data and for its subsequent processing for measurement, attribution and reporting. The allocation of data protection obligations is governed by Meta’s Controller Addendum: https://www.facebook.com/legal/controller_addendum. Meta processes the transmitted data in accordance with its own privacy policy and may combine it with further information from Facebook, Instagram and other Meta services. Data may also be processed by Meta Platforms, Inc. and other recipients in the USA or other third countries. Meta bases such transfers, among other things, on the EU-US Data Privacy Framework adequacy decision and, where necessary, Standard Contractual Clauses. We have no full control over how long Meta stores the data. Further information: https://www.facebook.com/privacy/policy/

Meta Conversions API: When you make a purchase from us, we additionally send data about this purchase directly from our server to Meta Platforms Ireland Limited. This includes the purchase amount, the currency, the time and your email address, which is encrypted before transmission. We use this to be able to attribute purchases to ads. The legal basis is your consent under Art. 6(1)(a) GDPR and Section 25(1) TDDDG. You can withdraw it at any time with effect for the future via the cookie settings. Regarding responsibility and transfers to third countries, what is stated for the Meta Pixel applies.

14. Social media presences and links

Our website may link to external profiles and platforms: YouTube, Instagram, Facebook, LinkedIn, Telegram and WhatsApp. Only when you open such a link do the privacy provisions of the respective platform additionally apply.

15. Security measures

We take appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access and unauthorised alteration. This includes in particular encrypted transmission of the website using TLS/SSL.

16. Recipients and processors

We only disclose personal data where this is necessary to fulfil the stated purposes, required by law, agreed by contract or covered by consent. Where service providers process personal data on our behalf, we conclude the necessary data processing agreements.

17. Transfers to third countries

Some of the providers we use are located outside the European Economic Area or process data there. A transfer takes place only if the requirements of Art. 44 et seq. GDPR are met, in particular on the basis of an adequacy decision, appropriate safeguards such as Standard Contractual Clauses, or a statutory exception.

18. Your rights

Subject to the statutory requirements, you have in particular the following rights: access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR), objection (Art. 21 GDPR), withdrawal of consent (Art. 7(3) GDPR) and lodging a complaint with a data protection supervisory authority (Art. 77 GDPR). To exercise your rights, you can contact privacy@devinaya.com or the representative in the European Union named above.

19. Objection to direct marketing

Where personal data is processed for direct marketing, you can object to this processing at any time.

20. Automated decision-making

No exclusively automated decision-making, including profiling, takes place.

21. Minors

Our offers are generally directed at adults.

22. Changes to this privacy policy

We adapt this privacy policy when our website, the services used or legal requirements change. The version currently published on this website applies.

Last updated: 2 September 2026