1. Who is responsible

The controller responsible for processing personal data through www.plutoretreats.com is:

Sara Barto

Hagenstraße 55

14193 Berlin

GERMANY

Email: howdy@plutoretreats.com

This policy explains how we handle personal data when you visit our website, contact us, purchase from our shop or register for an event. “Personal data” means information relating to an identified or identifiable person.

2. Visiting our website and Squarespace hosting

Our website and online shop are hosted by Squarespace. When you visit, technical information such as your IP address, browser and device information, pages viewed, referring page and time of access may be processed to deliver the website, maintain its security and troubleshoot errors. Squarespace may process this information on our behalf and, for some platform purposes, under its own privacy policy. The legal basis for our processing is our legitimate interest in operating a secure, functional website (Article 6(1)(f) GDPR).

Squarespace's privacy policy is available at https://www.squarespace.com/privacy. Technical logs are retained only for as long as necessary for the relevant security and operational purposes, subject to our provider's settings and applicable retention requirements.

3. Cookies and website analytics

Our website uses necessary cookies and similar technologies for functions such as security, navigation, cart and checkout. These technologies are used where necessary to provide the service you request (Section 25(2) TDDDG, where German law applies); associated personal data is processed under Article 6(1)(b) or (f) GDPR, as applicable.

We use Google Analytics to understand how visitors use the website and improve its content. Depending on its configuration, Google may receive information about the pages and interactions on our site, device and browser details, online identifiers and an IP address. Our legal basis for nonessential analytics cookies and the associated processing is your consent (Section 25(1) TDDDG and Article 6(1)(a) GDPR). We may also use Squarespace's own analytics and performance cookies on the same basis. Google Analytics is provided by Google Ireland Limited; Google's privacy policy is https://policies.google.com/privacy.

You can accept, reject or withdraw consent at any time through the cookie settings on our site. Withdrawal does not affect earlier processing. The cookie settings should show the actual cookies, providers, purposes and storage periods.

4. Embedded content, fonts and social features

We use Google Maps to show locations and video/audio providers, for example YouTube or Vimeo to display media. When such content loads, its provider may receive your IP address, browser and device information, and information about the page you visited; it may also use cookies or similar technology. For nonessential embeds or tracking, we request your consent before loading them (Section 25(1) TDDDG and Article 6(1)(a) GDPR). Where an embed can operate without nonessential storage, our legitimate interest in presenting location and media content may apply to the remaining data processing (Article 6(1)(f) GDPR). Google's privacy policy is https://policies.google.com/privacy.

Our site displays an Instagram feed and has social media links or sharing features. Depending on how the feed or share buttons are implemented, Meta Platforms Ireland Limited or another integration provider may receive information when content loads or when you interact with it. We request consent before loading any social embed that uses nonessential cookies or tracking; simple links take you to the social platform only when you click them. Meta's privacy policy is https://www.facebook.com/privacy/policy/.

We use Google Fonts and locally hosted fonts to display text. If fonts are fetched directly from a third party, that provider may receive your IP address and browser information. Our legitimate interest in presenting a functional, consistent website is the legal basis for essential font delivery (Article 6(1)(f) GDPR).

5. Contacting us

If you email us, we process the contact details and message you provide to answer your enquiry and manage our relationship with you. Our email provider Google Workspace may process emails. The legal basis is Article 6(1)(b) GDPR for enquiries about a booking or purchase and otherwise Article 6(1)(f) GDPR, our legitimate interest in responding to messages. We retain enquiries for as long as needed to resolve them and, where relevant, meet legal record keeping duties.

6. Event registrations and bookings

When you register for a Pluto Retreats event, we process the information needed to administer the event. Depending on the booking form, this may include your name, email address, phone number, event and ticket details, payment status, messages and any information you voluntarily provide about access needs or food requirements. We use it to manage your place, send event details or changes, check you in and address booking questions. The legal basis is Article 6(1)(b) GDPR (performance of a contract or steps before entering one).

Event registration is provided through Luma (Luma Labs, Inc.). When you open or use a Luma event page, Luma also processes information under its own privacy policy at https://luma.com/privacy-policy. We receive the registration information necessary to run our event. If attendee profiles or guest lists are visible to other participants, that depends on the event's Luma settings and your choices. We will tell you when such visibility applies.

Please provide health information only if a form specifically asks for it and it is necessary for us to accommodate you. If we request health or other sensitive information, we will explain the purpose and request your explicit consent where required (Article 9(2)(a) GDPR). You may contact us separately about accessibility needs at howdy@plutoretreats.com.

We keep booking information for as long as necessary to run the event and handle any related requests or claims. Financial records are kept for the statutory periods applicable to the legal operator.

7. Photos and video at events

Photos and video may be taken at our events to document what happens and share Pluto Retreats activities on our website and Pluto Retreats social media channels. This can include your image and, if recorded, your voice. We will tell guests in advance and on site when filming is planned. Where guests are recognisable and images are used publicly to promote Pluto Retreats, we will ask for a separate, informed and voluntary choice covering both recording and the intended publication. The legal basis for that use is your consent (Article 6(1)(a) GDPR). Declining is possible without losing your event booking. Tell the event team if you prefer not to be photographed or filmed, and we will organise filming accordingly.

We may share selected images with our photographer or videographer and, if you consent to publication, the platforms where we post them. Content published online may be viewed, shared or copied by others, including outside the EEA. We keep unpublished footage only for as long as needed to select and edit event content; we retain published content until we remove it or you withdraw consent, subject to any legal need to retain a copy. You may withdraw consent for future use by emailing howdy@plutoretreats.com. We will remove material from channels we control where feasible, although we cannot recall copies others have already made.

8. Shop orders, delivery and payments

If you buy something from our shop, we process your name, contact details, billing and shipping addresses, order contents, payment status and relevant correspondence to process the purchase, deliver the goods, handle returns and provide customer support. Squarespace processes order information as our shop platform. We share the details needed for delivery with the relevant fulfilment provider and carrier. Our legal basis is Article 6(1)(b) GDPR; invoicing and accounting obligations are based on Article 6(1)(c) GDPR.

Payments are processed through our payment provider Stripe. The payment provider receives the details needed to process and secure your payment. We receive a transaction confirmation and relevant payment information, but generally do not receive your full card number. The provider may process data for its own compliance and fraud prevention purposes; its privacy policy is https://stripe.com/privacy.

We retain order and payment records for the relevant statutory accounting and tax retention periods and keep other order information only as long as needed to fulfil the purchase and handle related requests or claims.

9. Emails about orders and events

We send necessary emails about purchases and bookings, such as confirmations, receipts, delivery information and event updates. We process your contact details for these messages to perform our contract with you (Article 6(1)(b) GDPR).

10. Recipients and international transfers

We share personal data only as needed with service providers that support our website, bookings, payments, email, fulfilment and delivery, or where legally required. These may include Squarespace, Luma, Stripe, Google, Meta, and delivery carriers, and photographers or videographers at events. Where a provider acts as our processor, we put the required data processing arrangement in place. Some providers also act as independent controllers for their own purposes; see their linked privacy policies.

Some providers may process data outside the European Economic Area, including in the United States. Where the GDPR requires safeguards, we rely on an applicable adequacy decision (where the recipient and transfer qualify), approved standard contractual clauses or another lawful transfer mechanism. You may ask us for information about the applicable safeguards using the contact details above.

11. Retention and your choices

We retain personal data only for the purposes stated above and then delete or anonymise it unless a legal duty, claim or dispute requires longer retention. We limit access to the people and providers who need it for those purposes.

Providing the information needed for a purchase or event registration is necessary to complete that transaction; without it, we may be unable to take the order or reserve your place. Other information is generally optional. We do not use your data for solely automated decisions that have legal or similarly significant effects on you.

Where the GDPR applies, you may request access to, correction or deletion of your data; restriction of processing; data portability where applicable; and withdrawal of consent at any time. You may also object to processing based on our legitimate interests for reasons related to your situation. To exercise these rights, contact howdy@plutoretreats.com. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EEA country where you live, work or believe an infringement occurred.

12. Changes to this policy

We may update this policy when our website, providers or legal obligations change. The latest version will be available on this page. Last updated: 23 September 2026.