Privacy Policy

01 — Introduction

Alalaho is committed to protecting your personal data and handling it with the care and discretion it deserves. This Privacy Policy explains what personal information we collect, why we collect it, how we use and protect it, and what rights you have in relation to it.

We process personal data in connection with three distinct contexts: visits to our website, applications to and participation in our retreat programmes, and subscription to our newsletter and other communications. This policy covers all three.

If you have any questions about how we handle your data, please contact us at hello@alalaho.org.

Who We Are

The data controller responsible for your personal data is Jennifer Tessler SARL, trading as Alalaho, 85 Boulevard du Général Koenig, 92200 Neuilly-sur-Seine, France. You can reach us at hello@alalaho.org.

As a French-registered entity delivering services across the EU, Alalaho processes personal data in accordance with the General Data Protection Regulation (GDPR) and applicable national data protection law.

For all data protection enquiries, including requests to exercise your rights, please contact us at hello@alalaho.org. We will respond within 30 days.

Who This Policy Applies To

‍This policy applies to visitors to the Alalaho website at alalaho.org, people who apply to attend or attend an Alalaho retreat programme, people who subscribe to Alalaho's newsletter or other communications, and anyone who contacts Alalaho by email, phone, or any other channel.

02 — What Personal Data We collect and How

‍Alalaho collects personal data in the following ways and for the following purposes.

Webiste Visitors

‍When you visit our website, basic technical data is collected automatically by our website infrastructure. This includes anonymised IP address information, pages visited, time and date of access, and browser and device type. This data is used solely to maintain and improve the website and is not used to identify individual visitors.

Our website uses functional cookies necessary for the site to operate correctly. Where we use any additional cookies for analytics or other purposes, we will ask for your consent before placing them. You can manage your cookie preferences at any time through the cookie settings on our website.

Applicants and Participants

‍This is the most significant category of data we collect, and we handle it with particular care.

When you apply to attend a retreat, we collect identity and contact information — including your full name, email address, country of residence, and gender (used solely for room assignment purposes). We also collect emergency contact details — the name and contact information of a person to be reached if needed during the retreat.

We collect health and psychiatric history via our Health Form. This includes information about your physical and mental health, any relevant diagnoses or history, current medications, and prior experience with psychoactive substances. We also hold application and onboarding call notes — records of your responses and any notes taken during your onboarding call — for continuity of care across our team.

Health, psychiatric, and medication information is special category data under GDPR. We collect and process it solely to assess your suitability to participate safely in our programmes and to ensure appropriate care and support throughout your retreat. We do not use it for any other purpose.

The legal basis for processing your identity, contact, and booking information is contract — this information is necessary to manage your booking and deliver the service you have requested. The legal basis for processing your health and special category data is explicit consent, which you provide when you submit your Health Form. You have the right to withdraw this consent at any time, though doing so will affect our ability to assess your suitability and may mean we are unable to confirm your place.

Newsletter and Marketing Communications

‍If you subscribe to our newsletter or request information about upcoming retreats, we collect your name and email address for this purpose. The legal basis for this processing is consent. You can unsubscribe at any time by clicking the unsubscribe link in any email or by contacting us at hello@alalaho.org.

General Enquiries

‍If you contact us by email or through our website, we collect the information you provide in order to respond to your enquiry. This is processed on the basis of legitimate interest — specifically, our interest in responding to communications addressed to us.

03 — How We Use Your Personal Data

‍We use the personal data we collect only for the purposes described in this policy. We do not use your data for automated decision-making or profiling, and we do not sell your data to any third party under any circumstances.

Your identity and contact information is used to manage your booking, communicate with you about your programme, and send pre- and post-retreat materials. Emergency contact details are held solely to contact a designated person in the event of a medical or personal emergency during a retreat. Your health and psychiatric history is used to assess your suitability to participate and to ensure appropriate facilitation and care. Onboarding call notes support continuity of care across the facilitation team and inform preparation and support. Website technical data is used to maintain and improve the website. Newsletter and communications data is used to send you information about retreats, programme updates, and relevant content. General enquiry data is used solely to respond to your communication.

04 — Who We Share Your Data With

‍Your personal data is treated as confidential. We do not sell, rent, or share it with third parties for commercial purposes.

Within Alalaho

‍Your data is accessible only to team members with a direct need to access it for the purposes described in this policy. Health and screening data is shared only with the facilitation team responsible for your retreat and, where clinically relevant, with our supervising practitioners. It is not shared more broadly within the organisation than is necessary for your care.

Third Party Service Providers

‍We use a small number of trusted third-party platforms to operate our services — including for video calls, payment processing, email communications, and booking management. These providers act as data processors on our behalf and are contractually required to process your data only in accordance with our instructions and in compliance with GDPR. We do not authorise them to use your data for their own purposes.

Where any service provider is located outside the European Economic Area, we ensure appropriate safeguards are in place — such as standard contractual clauses — to protect your data in transit and storage.

Law Enforcement and Legal Requests

‍We do not proactively share your personal data with law enforcement or any other external authority. In the event that we receive a legally binding request for data from a competent authority, we are required by law to comply. We will seek legal advice before responding to any such request and will notify you where we are legally permitted to do so.

Business Transfers

‍In the unlikely event of a merger, acquisition, or sale of all or part of Alalaho's business, personal data held by us may be among the assets involved. We would notify affected individuals in advance of any such transfer and ensure appropriate protections remain in place.

05 — How Long We Keep Your Data

‍We keep your personal data only for as long as is necessary for the purposes for which it was collected, and in accordance with our legal obligations.

Health Form and screening records for participants who attended a retreat are retained for 7 years from the date of the retreat. Health Form and screening records for applications that were declined or withdrawn before attendance are retained for 7 years from the date of the decision or withdrawal. Booking and contact information is retained for 7 years from the date of the retreat or last contact. Emergency contact details are deleted within 7 years of the retreat end date. Newsletter subscriber data is retained until you unsubscribe or request deletion. General enquiry correspondence is retained for 1 year from the date of the enquiry.

Health and screening records are retained for 7 years in line with professional standards for care-adjacent records and to maintain appropriate documentation in the event of any future query or claim. After the applicable retention period, data is securely deleted or irreversibly anonymised.

If you would like your data deleted before the end of the applicable retention period, please contact us at hello@alalaho.org. We will action your request unless we have a legal obligation to retain the data, in which case we will explain why.

06 — Cookies and Website Tracking

‍Our website uses cookies — small text files stored on your device — to enable core website functionality and, where you have given consent, to support analytics and communication tools.

Functional cookies are necessary for the website to operate and do not require your consent. They enable things like the booking widget, session management, and site navigation.

Analytics and tracking cookies, if used, will only be placed with your explicit consent. These help us understand how visitors use our website so we can improve it. You can accept, decline, or manage your cookie preferences at any time through the cookie settings on our website.

If Alalaho runs paid advertising campaigns through external platforms, those platforms may place tracking technologies on our website to measure the effectiveness of those campaigns. Where this is the case, it will be disclosed in our cookie settings and your consent will be sought before any such tracking takes place.

You can also manage cookies at any time through your browser settings. Please note that disabling certain cookies may affect the functionality of parts of the website.

07 — Your Rights Under GDPR

‍If you are a resident or citizen of the European Union, you have the following rights in relation to the personal data we hold about you.

You have the right of access — you can request a copy of the personal data we hold about you. You have the right to rectification — you can ask us to correct inaccurate or incomplete data. You have the right to erasure — you can ask us to delete your data, subject to any legal obligation we have to retain it. You have the right to restriction — you can ask us to limit how we process your data in certain circumstances. You have the right to data portability — you can ask us to provide your data in a structured, machine-readable format. You have the right to object — you can object to processing based on legitimate interest. You have the right to withdraw consent — where processing is based on your consent, you can withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us at hello@alalaho.org. We will respond within 30 days. We may ask you to verify your identity before acting on a request.

If you believe we have handled your data unlawfully, you have the right to lodge a complaint with your national data protection authority. In France, this is the Commission Nationale de l'Informatique et des Libertés (CNIL), reachable at cnil.fr. You may also raise a complaint with the data protection authority in your country of residence.

For information about EU online dispute resolution, visit ec.europa.eu/consumers/odr.

08 — Changes to This Policy

‍We may update this Privacy Policy from time to time. When we do, we will update the date at the top of this page. For existing retreat participants, the version of this policy in force at the time of your booking governs how we handle your data, unless we notify you of a material change and you agree to updated terms.

09 — Contact

‍For any questions about this policy or how we handle your personal data, please contact us at hello@alalaho.org or write to Jennifer Tessler SARL, trading as Alalaho, 85 Boulevard du Général Koenig, 92200 Neuilly-sur-Seine, France.

‍

Last updated: March 2026

‍