Privacy Policy
The Joy Bringers
Last updated: 19 October 2026
Your privacy matters to us.
We believe personal information should be treated with care, respect and a healthy dose of common sense.
We collect only the information we need to operate The Joy Bringers, provide our services, personalise our Experiences where requested, keep guests safe and meet our legal obligations.
We do not sell your personal data.
This policy explains what we collect, why we use it, who we may share it with, how long we keep it and your rights.
For this policy, an “Experience” means either a Retreat (Reset, Restore or Rediscover) or an Adventure (Relive).
1. Who We Are
Trading Name: The Joy Bringers
Registered Legal Name: [Insert registered business name]
Registered Address: [Insert registered business address]
Email: Compliance@thejoybringers.life
The registered business operating The Joy Bringers is the Data Controller, responsible for deciding how and why your personal data is processed.
This policy covers our website, Experiences, booking requests, communications, optional questionnaires, digital products, physical products, marketing and other services.
2. What Information We Collect
The information we collect depends on how you interact with us.
Contact Information
Name.
Email address.
Telephone number and international calling code.
Country of residence.
Postal or delivery address where required.
Other contact details you voluntarily provide.
Booking & Purchase Information
Experience selected, dates and accommodation preferences.
Guest numbers and reservation details.
Prices, discounts, deposits and payment plans.
Payment status, transaction references and refunds.
Booking confirmations, changes and cancellations.
Orders, invoices, receipts and delivery information.
Relevant booking and customer-service communications.
Experience payments are generally made by bank transfer. We retain transaction information necessary to reconcile payments, issue refunds and maintain financial records.
We do not request your online banking passwords or security credentials.
Mandatory Guest Safety Information
Following booking confirmation, guests are required to complete a safety questionnaire.
Depending on the Experience, this may include:
Food allergies and dietary restrictions.
Mobility and accessibility requirements.
Relevant physical health or safety considerations.
Limitations affecting participation in activities or excursions.
Relevant emotional or psychological considerations guests choose to disclose.
Emergency contact details.
Other information reasonably necessary to assess and arrange safe participation.
Some information may constitute special-category health data under GDPR and receives additional protection.
We do not request complete medical histories or unrelated personal details.
Optional Experience Personalisation
We may invite guests to complete a separate, entirely optional personalisation questionnaire.
This helps us add thoughtful touches and tailor each Experience to the people attending.
Guests may choose to share:
Favourite foods, cuisines and foods they dislike.
Favourite desserts, cocktails and other drinks.
Pillow, bedding and room-comfort preferences.
Sleep schedules, preferred wake-up times and bedtime routines.
Favourite activities, hobbies and interests.
Music tastes and entertainment preferences.
Preferences for relaxation, social activities and personal time.
Special occasions or celebrations.
Anything else they would like us to know to make their Experience more enjoyable.
Completing this questionnaire is entirely voluntary.
Guests may skip individual questions or leave the entire questionnaire unanswered. This will not affect their booking or eligibility to participate.
We collect and use these responses solely to personalise the guest's Experience.
We will not sell them, use them for advertising or voluntarily disclose them to external Experience suppliers or other third parties.
The information may be processed by technology providers supporting our secure business systems, and disclosed where legally required.
We will delete or anonymise these preferences when they are no longer needed for personalisation.
Website, Quiz & Communication Information
Contact-form enquiries and waitlist registrations.
Newsletter subscriptions.
Quiz answers, results and preferences where submitted or stored.
Emails, telephone communications and messages.
Website technical information, such as IP addresses, browser details and security logs.
Cookie choices and preferences.
Where a quiz operates without identifying the participant, we do not need to associate the answers with an identifiable person.
Marketing, Photography & Testimonials
Marketing subscriptions and preferences.
Records of consent and withdrawal.
Photographs, videos, recordings and testimonials where permission has been given.
Relevant promotional communications.
We ask permission before using identifiable guest photographs, videos or testimonials for marketing.
Participation is voluntary.
3. Why We Use Your Information
We use personal data to:
Respond to enquiries and booking requests.
Review, accept and manage reservations.
Process payments, refunds, orders and deliveries.
Arrange accommodation, meals, transfers, excursions and activities.
Plan and deliver workshops and other Experience services.
Assess relevant accessibility, dietary and safety requirements.
Personalise your Experience using optional preferences you choose to share with us.
Send booking confirmations, questionnaires, reminders and essential updates.
Manage guest substitutions, changes and cancellations.
Respond to questions, complaints and requests for assistance.
Protect guests, staff, property and the wider community.
Maintain financial, tax and business records.
Operate, maintain and secure our website and systems.
Improve our services and customer experience.
Send marketing communications where permitted.
Comply with legal and regulatory obligations.
Optional personalisation responses are used only to customise the relevant Experience.
We do not use guest health information or optional personalisation responses for advertising.
4. Our Legal Bases for Processing
GDPR requires us to have a lawful reason for processing personal information.
| Legal Basis | How We Use It |
|---|---|
| Contract | Processing booking requests, reservations, payments, orders, deliveries and contracted services. |
| Legal obligation | Maintaining tax records, issuing invoices and meeting regulatory requirements. |
| Legitimate interests | Protecting our business and property, preventing fraud, maintaining security, handling complaints and improving operations where your rights do not outweigh our interests. |
| Consent — Optional Personalisation | Using preferences voluntarily provided through the personalisation questionnaire solely to customise your Experience. |
| Consent — Marketing & Media | Sending marketing where consent is required and using identifiable photographs, videos or testimonials for promotional purposes. |
| Consent — Cookies | Using non-essential website technologies where consent is legally required. |
| Vital interests | Processing or sharing necessary information in a genuine emergency to protect someone's life or physical safety. |
Withdrawing Consent
Where we rely on consent, you may withdraw it at any time.
Withdrawal does not affect processing that was lawful before consent was withdrawn.
For optional personalisation, withdrawal means we will stop using the relevant preferences. Changes to arrangements already completed may not always be possible.
Where information must be retained for a separate legal reason, withdrawal does not automatically require its immediate deletion.
Special-Category Information
Health information and certain other sensitive information require additional protection under GDPR Article 9.
For routine processing of health information collected through our mandatory safety questionnaire, we intend to rely on separate, explicit consent.
Other permitted conditions may apply in limited circumstances, such as genuine emergencies or the establishment, exercise or defence of legal claims.
5. Health, Safety & Sensitive Personal Information
Our Experiences may involve accommodation, shared meals, outdoor activities, excursions and workshops.
We request relevant safety information to help us plan appropriately, identify risks and understand whether we can safely accommodate guests.
Mandatory Safety Questionnaire
After booking confirmation, we ask guests to complete a mandatory safety questionnaire.
We may send reminders where essential information remains outstanding.
Submission deadlines and consequences of failing to provide essential information are explained in our Terms & Conditions.
How We Protect This Information
We will:
Request only information reasonably necessary for safety and participation.
Restrict access to people who genuinely need it.
Avoid requesting unnecessary diagnoses or medical histories.
Avoid disclosing medical details to other guests.
Share only the minimum necessary information with relevant suppliers or emergency services where there is an appropriate legal basis.
Delete or anonymise routine safety information when it is no longer needed, unless a legitimate legal or safety reason requires retention.
Consent & Safe Participation
Where we rely on explicit consent, guests may withdraw it.
However, if we cannot process information genuinely necessary to assess safe participation, we may be unable to provide the Experience safely.
We will explain any practical consequences and apply the relevant booking terms and legal protections.
6. Optional Personalisation & Your Choices
Our optional personalisation questionnaire is designed to help us make each Experience feel more personal, comfortable and enjoyable.
Your answers are entirely your choice.
You can answer as much or as little as you like, and you can ask us to update or stop using your preferences.
We will use the responses only to plan and personalise your Experience.
We will not:
Sell your responses.
Use them to target advertising.
Add them to marketing profiles.
Voluntarily disclose them to external Experience suppliers.
Use them to make decisions about your eligibility to attend.
We may use secure technology services to store and process the information on our behalf.
Information may also be disclosed where legally required.
We will delete or anonymise personalisation responses after the Experience once any necessary personalisation follow-up is complete.
7. Booking Communications & Messaging
We communicate with guests throughout the booking process.
Communications may include:
Booking acceptance and confirmation.
Payment instructions and reminders.
Safety and personalisation questionnaire invitations.
Arrival and collection arrangements.
Experience information and updates.
Changes, cancellations and refunds.
Important safety or operational information.
These are service communications, not marketing.
We may communicate through email, telephone, SMS, WhatsApp, Viber or other appropriate channels.
Third-party messaging services may process information under their own privacy policies.
We avoid including unnecessary sensitive information in messages.
Guests may tell us their preferred communication method, although some essential notices may need to be sent by email.
8. Marketing & Promotional Communications
We may send information about:
New Experiences and availability.
The Joy Philosophy and our blog, The Playground.
Digital products, courses, books and merchandise.
Special offers and promotions.
News from The Joy Bringers.
Where consent is required, we ask for it before sending marketing.
Where the law permits marketing to existing customers without fresh consent, we provide an opportunity to object when collecting contact details and in every marketing message.
You can unsubscribe at any time.
Unsubscribing from marketing will not stop essential booking or purchase communications.
We do not use safety questionnaires or optional personalisation responses for marketing.
9. Photography, Videos & Testimonials
We may take photographs or videos during Experiences.
We will seek appropriate permission before using identifiable guest images, recordings or testimonials for marketing.
You are free to decline. This will not affect your treatment or participation.
You may withdraw consent for future marketing use at any time.
We will stop new uses based on that consent and take reasonable steps to remove material from channels under our control.
Withdrawal does not automatically undo lawful uses that occurred before withdrawal or guarantee removal of copies independently retained by others.
We also ask guests to respect one another's privacy when taking and sharing photographs.
10. Who We Share Information With
We share personal information only where reasonably necessary.
Recipients may include:
Website, hosting and business software providers, including Odoo.
Telecommunications and messaging providers.
Banking and payment providers.
Cloud storage and IT service providers.
Accountants, insurers and professional advisers.
Transport providers, facilitators and other Experience suppliers where relevant.
Delivery companies for physical purchases.
Emergency services or healthcare providers where necessary.
Public authorities where legally required.
We share only information appropriate to each recipient's role.
For example, a transport provider may need collection details but does not ordinarily need a guest's health questionnaire.
Optional Personalisation Information
We do not voluntarily disclose guests' optional personalisation responses to external Experience suppliers.
These responses are used internally to customise Experiences.
Technology providers may process the information as part of hosting, storage or business operations, subject to appropriate data-protection arrangements.
Disclosure may also occur where legally required.
Our Service Providers
Where a provider processes personal data on our behalf, we require appropriate contractual and security arrangements.
Some organisations, such as banks, public authorities and professional advisers, may act as independent data controllers.
We do not sell personal data.
11. International Data Transfers
The Joy Bringers operates from Greece.
We aim to use privacy-conscious providers and appropriate safeguards.
Some technology or communications providers may process personal information outside the European Economic Area.
Where GDPR requires safeguards for international transfers, we use an appropriate mechanism, such as:
An EU adequacy decision.
Approved Standard Contractual Clauses and any necessary supplementary measures.
Another permitted GDPR transfer mechanism.
You may contact us for information about safeguards relevant to your personal data.
12. How Long We Keep Information
We retain information only as long as necessary for its purpose, subject to legal requirements.
| Information | Retention Approach |
|---|---|
| Payments, invoices and accounting records | For the periods required by Greek tax and accounting law. |
| Confirmed bookings and contracts | As needed for administration, legal obligations and legitimate claims. |
| Unsuccessful enquiries and unconfirmed requests | Until follow-up is complete and continued retention is no longer justified. |
| Mandatory health and safety questionnaires | For the Experience and necessary follow-up, unless an incident, complaint or legal matter requires longer retention. |
| Optional personalisation questionnaires | Deleted or anonymised after the Experience once personalisation and any necessary follow-up are complete. |
| Marketing subscriptions | Until you unsubscribe or the information is no longer needed. Limited opt-out records may be retained to respect your preferences. |
| Photographs and testimonials | While the permitted use continues, subject to withdrawal of consent and other legal requirements. |
| Website and security logs | For a limited period appropriate to security, troubleshooting and legal obligations. |
We periodically review and securely delete or anonymise information we no longer need.
13. Your Privacy Rights
Under GDPR, you may have the right to:
Access your personal data.
Correct inaccurate or incomplete information.
Request deletion where we no longer have a valid reason to retain it.
Restrict processing in certain circumstances.
Object to processing based on legitimate interests.
Object to direct marketing at any time.
Request data portability where the relevant conditions apply.
Withdraw consent where processing relies on consent.
Challenge certain solely automated decisions that produce legal or similarly significant effects.
Some rights are subject to legal exceptions.
To exercise your rights, contact:
Compliance@thejoybringers.life
We will respond without undue delay, normally within one month.
Where GDPR permits an extension for a complex request, we will explain this within the initial month.
We may request reasonable information to verify your identity before disclosing personal data.
14. Automated Decisions & Profiling
Our systems may automatically calculate prices, discounts, availability, payment deadlines or administrative reminders.
Our website quizzes may calculate results based on answers provided.
These functions are not intended to make solely automated decisions producing legal or similarly significant effects.
Decisions concerning guest eligibility, safety-related cancellation or serious misconduct are reviewed by people.
We do not use guest safety information or optional personalisation responses to build advertising profiles.
15. Protecting Your Information
We use appropriate technical and organisational measures to protect personal information.
These may include:
Access restricted to authorised people.
Secure accounts and appropriate authentication.
System permissions and access controls.
Secure handling of sensitive information.
Backups and system maintenance.
Appropriate arrangements with service providers.
Procedures for responding to security incidents.
No system is completely risk-free, but we take reasonable measures appropriate to the information and risks involved.
Where a personal-data breach requires notification, we will notify the relevant authority and affected individuals in accordance with GDPR.
16. Cookies & Website Technologies
Our website may use cookies and similar technologies for security, sessions, preferences and other website functions.
Necessary Cookies
These support essential website operations and may operate without consent where permitted by law.
Analytics Cookies
If used, these help us understand website usage and improve performance.
Where consent is required, they will remain disabled until you accept them.
Marketing Cookies
If used, these may support campaign measurement or advertising.
Where consent is required, they will remain disabled until you accept them.
Our cookie information and settings will identify the technologies actually used, their purposes, providers and retention periods where applicable.
17. Managing Cookie Choices
Where our website uses non-essential cookies requiring consent, we will provide a way to:
Accept non-essential cookies.
Reject non-essential cookies.
Manage Preferences by category.
Non-essential cookies requiring consent will not be activated before that consent is given.
Rejecting non-essential cookies will not prevent access to essential website functions.
Where consent is collected, you will be able to change or withdraw your choices.
If our website uses only strictly necessary cookies, a consent banner may not be required.
18. Information About Other People
A guest may sometimes make a reservation for more than one person or provide emergency contact information.
If you provide another person's details, please ensure they know why the information is being shared and that you have an appropriate reason to provide it.
We may contact additional guests directly to provide privacy information or collect their individual requirements.
Each guest should provide their own sensitive safety information wherever practical.
Emergency contact details will be used only where reasonably necessary.
19. Community Safety & Complaints
We may process relevant information when responding to:
Safety incidents.
Complaints or disputes.
Suspected serious breaches of our Community Agreement.
Threats to guests, staff or property.
This may include relevant communications, incident reports, witness accounts or other evidence.
We use this information to protect people, investigate concerns, resolve disputes and establish or defend legal claims.
Access is restricted to those who need to handle the matter.
We do not routinely collect or assess guests' political, religious or philosophical beliefs as part of booking screening.
Our Community Agreement concerns behaviour, safety and respectful participation.
20. Children & Young People
Our Experiences are intended for adults unless an individual Experience expressly states otherwise.
We do not knowingly collect children's personal information through our adult Experience booking process.
If we introduce products or activities intended for children, we will apply the additional privacy protections relevant to those services.
21. Questions & Complaints
If you have a question or concern about your personal information, please contact:
The Joy Bringers
Compliance@thejoybringers.life
You also have the right to complain directly to:
Hellenic Data Protection Authority
You do not need to contact us before exercising your right to complain to the authority.
22. Changes to This Policy
We may update this policy when our services, systems, suppliers or legal requirements change.
The latest version and its effective date will be available on our website.
Where a change materially affects how we use personal information, we will provide additional notice or seek new consent where required.
The Joy Bringers — Your information. Your choices. Our responsibility.