Last updated: 26 October 2026
This page explains what personal information Tai Chi With Jay collects, why, what I do with it, and what your rights are. I’ve tried to keep it plain. If anything isn’t clear, email me and I’ll explain.
Tai Chi With Jay is based in Spain, so this policy follows the EU General Data Protection Regulation (GDPR) and Spain’s data protection law (Ley Orgánica 3/2018, LOPDGDD). I have students and customers in many countries. Wherever you live, the rights described here apply to you.
1. Who is responsible for your data
Data controller: Jason Cyr, trading as Tai Chi With Jay
NIF/NIE: Y1247800H
Address: Avenida Marina Española 19, 4º, 03730 Jávea (Alicante), Spain
Email: taichiwithjay@gmail.com
Website: taichiwithjay.com
I’m a small business, not required to appoint a Data Protection Officer. For any privacy question, write to the email above.
2. What I collect and why
When you contact me
If you email me, message me on WhatsApp, or use a contact form, I get your name, contact details and whatever you choose to tell me. I use it to answer you and, if you book, to arrange classes or sessions.
Legal basis: taking steps at your request before a contract, and my legitimate interest in answering enquiries.
When you book classes, private coaching, massage or workshops
I keep your name, contact details, what you booked, and payment records. I use them to deliver the service, communicate about it, and keep the accounts the law requires.
Legal basis: performance of a contract, and legal obligations (tax and accounting).
Health information
For private coaching, Somatics or bodywork, you may tell me about injuries, pain, medical conditions or test results so I can adapt the work safely. This is sensitive data. I only collect what’s needed, only with your explicit consent, and I don’t share it with anyone unless you ask me to (for example, to talk with your doctor or physio). You can withdraw consent at any time; I’ll then delete it, though I may not be able to continue a tailored programme without it.
Legal basis: your explicit consent (GDPR Article 9(2)(a)).
Membership and The Practice Room
If you have an account for the online lessons, I store your name, email, login details (passwords are stored encrypted, I can’t see them), membership level and order history. I use this to give you access and manage your membership.
Legal basis: performance of a contract.
Payments
Online payments are handled by a payment processor (Stripe). Your card details go directly to them; I never see or store your full card number. I receive confirmation of the payment, the amount, and your name and email. Bank transfer and cash payments are recorded for accounting.
Legal basis: performance of a contract and legal obligations.
Email newsletter
If you join the mailing list, I keep your email address (and name, if given) to send news about classes, workshops and practice. Every email has an unsubscribe link, and you can also just reply and ask.
Legal basis: your consent. Existing students may also receive occasional emails about similar classes and workshops, based on legitimate interest; you can opt out at any time.
Workshop registration
Some workshops use a Google Form for registration. Google stores those answers on my behalf. Workshops hosted by other teachers (for example in Paris, Antwerp or Amsterdam) are booked through their own websites, and their privacy policies apply there.
Photos, video and testimonials
I sometimes take photos or video in classes and workshops. I only publish images where you can be identified, or your testimonial, with your permission. You can ask me to remove them at any time.
Legal basis: your consent.
Website visits
When you visit the site, the server logs technical data (IP address, browser, pages visited) for security and to keep the site working. Lesson videos are played through Vimeo, which only loads with your consent through the cookie banner. Fonts are served from my own server, not from Google. Details of cookies are in the Cookie Policy.
Legal basis: legitimate interest (security and running the site), and consent for non-essential cookies.
3. Who else sees your data
I don’t sell your data, and I don’t share it for anyone else’s marketing. I use a few service providers who process data on my behalf, under contracts that require them to protect it:
- Hostinger – website hosting (EU)
- Vimeo – lesson video hosting (USA)
- Stripe – online payments (EU/USA)
- Google – email (Gmail), registration forms, and Search Console (USA)
- MailerLite – email newsletter (EU)
- Brevo – sending website emails such as account and order confirmations (EU)
- WhatsApp (Meta) – only if you choose to message me there (USA)
I also share data where the law requires it, for example with the Spanish tax authority (Agencia Tributaria) or my accountant.
4. Data sent outside the EU
Some providers above are based in, or store data in, the United States. Where that happens, the transfer is protected by the EU–US Data Privacy Framework, or by the European Commission’s Standard Contractual Clauses. You can ask me for more detail.
5. How long I keep it
I keep personal data only as long as I need it, or as long as Spanish law requires. Then I delete it.
- Client and booking records: 5 years after your last session or booking. This matches the general time limit for legal claims in Spain (Article 1964 of the Civil Code), and means your file is still here if you come back.
- Health information: 5 years after your last session, in line with the minimum period Spanish law sets for health records (Ley 41/2002). If you’d like me to keep it longer, for example because you come back every few years, I’ll only do that with your written agreement.
- Invoices and payment records: 6 years, as the Spanish Commercial Code (Article 30) requires.
- Membership accounts: while your membership is active, then 5 years, or deleted sooner on request (except records I’m legally required to keep).
- Enquiries that don’t lead to a booking: up to 12 months.
- Mailing list: until you unsubscribe.
- Photos and testimonials: until you withdraw permission.
6. Your rights
You can ask me to:
- tell you what data I hold about you and give you a copy (access)
- correct anything wrong (rectification)
- delete your data (erasure), unless I’m legally required to keep it
- stop or limit how I use it (objection and restriction)
- send it to you or another provider in a usable format (portability)
- withdraw any consent you’ve given, at any time
Email taichiwithjay@gmail.com. I’ll reply within one month. I may ask you to confirm your identity first. There’s no charge.
If you’re not happy with how I’ve handled your data, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD), or to the data protection authority where you live.
7. Customers outside the EU
If you live in the UK, Canada, the USA, Australia or elsewhere, I handle your data the same way and give you the same rights. California residents: I don’t sell or share personal information for targeted advertising.
8. Children
The website and online membership are for adults. Under Spanish law, children under 14 can’t consent to the use of their data. If a child joins a class, a parent or guardian makes the booking and gives any consent needed.
9. Security
The site uses an encrypted connection (HTTPS), passwords are stored encrypted, and access to records is limited to me. No system is perfectly secure, but if a breach ever puts your data at risk, I’ll tell you and the authorities as the law requires.
10. No automated decisions
I don’t use your data for automated decision-making or profiling.
11. Changes
If I change how I use your data, I’ll update this page and the date at the top. For significant changes, I’ll let students and members know by email.