Privacy Policy

Lilleoru MTÜ
Effective date: 17 October 2026

1. About This Policy

This Privacy Policy explains how Lilleoru MTÜ (“Lilleoru”, “we”, “us” or “our”) collects and processes personal data in connection with:

The website www.lilleoru.org (“Website”).
Registration for and participation in courses, retreats, lectures, workshops, study events and guided practices, whether onsite or online.
Access to recordings and other digital learning materials.
Newsletter subscriptions and waiting lists.
Inquiries and other communications with us.

This Policy is provided for information. Using the Website or accepting our Terms and Conditions does not constitute consent to all processing described in this Policy. Where consent is required, we request it separately.

Lilleoru MTÜ also operates Shiva Temple Estonia. Personal data collected through www.shivatempleestonia.org, including in connection with temple ceremonies and donations, is covered by the privacy policy published on that website.

2. Data Controller

The controller responsible for the processing described in this Policy is:

Lilleoru MTÜ, an Estonian non-profit association
Registry code: 80143446
Address: Taevasmaa tee 2, Aruvalla küla, Rae vald, Harju maakond 75320, Estonia
Email: info@lilleoru.ee

Please use this email address for questions about personal data or to exercise your data protection rights.

3. Personal Data We Collect

Depending on how you interact with us, we may process the following information.

Contact and Registration Data

Name.
Email address and telephone number.
Country of residence, language preference and time zone where relevant.
The event or Service selected, participation format and booking details.
Information needed to check published participation prerequisites.
Attendance and access information.
Accommodation, meal or other practical preferences provided for your booking.
Details of a parent or legal guardian where necessary for a minor’s participation.

Payment and Accounting Data

Payer’s name and contact details.
Billing address and organisation details where required.
Order, invoice and transaction references.
Amount, currency, payment date, payment status and refund information.

We do not receive or store your full payment-card number, card security code, online banking credentials or bank authentication codes.

Communications and Subscription Data

Messages and inquiries you send us.
Information needed to respond to complaints or requests.
Newsletter and waiting-list subscriptions.
Language and communication preferences.
Records of consent, withdrawal of consent and unsubscribe requests.

Event Images and Recordings

Where an event is photographed, filmed or recorded, personal data may include your image, voice, displayed name and contributions, such as questions or messages.

The arrangements for recording and use of the material are explained in Section 7.

Technical and Website Usage Data

Depending on the features used and your cookie choices, we may process:

IP address.
Browser, device and operating-system information.
Access times, technical logs and error information.
Pages visited, interactions and referral information.
Cookie identifiers and consent preferences.

Sensitive Information

Please do not provide health information or other sensitive personal data unless it is necessary for a specific purpose.

If you request participation arrangements relating to your health, we aim to collect only the information needed to consider those arrangements.

Some information connected with spiritual practices or participation prerequisites may reveal religious or philosophical beliefs. Where data constitutes a special category of personal data, we process it only where both a lawful basis under Article 6 and an applicable condition under Article 9 of the GDPR are available. Where we rely on your explicit consent, we request it separately.

Registration for an event does not by itself constitute explicit consent to process sensitive data or publicly disclose your participation.

4. Where We Obtain Personal Data

We generally receive personal data directly from you when you register, pay, subscribe, participate or contact us.

We may also receive information from:

A person making a booking on your behalf.
A parent or legal guardian.
Booking platforms, including Fienta.
Payment providers.
Platforms used to deliver online events.
Your device when you use the Website.
Social media platforms when you communicate with us through them.

If you provide another person’s information, please ensure that you are entitled to do so and make this Policy available to them.

5. Purposes and Legal Bases

We use personal data for the following purposes.

Registration and Provision of Services

We process registration, contact and participation data to manage bookings, check relevant prerequisites, provide access, communicate practical information and deliver the agreed Service.

Legal basis: taking steps at your request before entering into a contract and performing the contract.

Where someone else purchases a Service for you, we may rely on our legitimate interest in administering that booking and enabling your participation.

Payments, Invoices and Accounting

We process payment and billing information to collect fees, issue invoices, administer refunds and maintain legally required records.

Legal basis: performance of a contract and compliance with legal obligations.

Inquiries and Complaints

We process correspondence to answer questions, resolve problems, handle complaints and respond to data protection requests.

Legal basis: steps before entering into a contract, performance of a contract, compliance with legal obligations or our legitimate interest in responding to communications, depending on the request.

Waiting Lists

We use your details to administer a waiting list and send information about the particular event or opportunity for which you registered.

Legal basis: your consent. Joining a waiting list does not automatically subscribe you to our general newsletter.

Newsletters and Marketing

We use your email address and selected preferences to send newsletters and information about our activities where you have subscribed.

Legal basis: your consent.

Website Operation and Security

We process necessary technical information to operate the Website, maintain its security, prevent misuse and investigate technical problems.

Legal basis: our legitimate interest in providing a secure and functioning Website and, where applicable, compliance with legal obligations.

Analytics and Optional Website Features

Where enabled, we use optional analytics and related technologies to understand Website usage and improve our communications and Services.

Legal basis: your consent where required for cookies or similar technologies and the associated processing.

Legal Claims

We may retain and use relevant records to establish, exercise or defend legal claims.

Legal basis: our legitimate interest in protecting our rights, together with an applicable legal condition where special-category data is involved.

Where we rely on legitimate interests, we consider the necessity of the processing and its impact on your rights and reasonable expectations.

6. Required and Optional Information

Fields marked as required during registration are needed to process the booking, provide the Service or meet a legal obligation. If you do not provide this information, we may be unable to complete your booking or provide the requested Service.

Optional information is voluntary. You do not need to subscribe to marketing to purchase or use our Services.

Where we request sensitive information, we explain why it is needed, the applicable basis and the consequences of not providing it.

7. Photography, Filming and Event Recordings

Some events may be photographed, filmed or recorded for purposes such as providing recordings to registered participants, documenting activities or communicating publicly about Lilleoru.

We provide information about the intended recording, audience and use through the event description, registration process, onsite notices or other appropriate communication.

The legal basis depends on the purpose and circumstances:

Recording and providing the teaching component may be necessary to deliver an expressly included recording.
Limited event documentation may be based on legitimate interests where appropriate, following an assessment of participants’ rights and expectations.
Where consent is required, including where material reveals sensitive information and no other legal condition applies, we request it separately.

Buying a ticket or attending an event does not constitute blanket consent to promotional use of your image, voice or contribution.

Where reasonably practicable, we provide ways to participate without appearing in a recording, such as keeping your camera and microphone off during an online event or using an area outside the camera’s view.

Please contact us before the event if you have concerns about being recorded. Withdrawal of consent applies to future use and does not affect the lawfulness of processing carried out before withdrawal.

8. Service Providers and Other Recipients

We disclose personal data only where necessary for a stated purpose and on an appropriate legal basis.

Recipients may include:

Authorised Lilleoru staff, teachers, facilitators and volunteers who need the information for their tasks.
Website hosting and administration providers, including Wix.
Booking and ticketing platforms, including Fienta, when used for your booking.
Payment providers, including Maksekeskus AS and Stripe, depending on the payment method selected.
Email, newsletter, online meeting, video delivery and IT support providers used for the relevant activity.
Accounting, legal and other professional advisers.
Public authorities where disclosure is legally required.

We provide access only to the extent necessary for the relevant purpose.

Some providers process personal data on our behalf under data processing agreements. Others act as independent controllers for certain activities, such as regulatory compliance, fraud prevention or their own platform services. Their roles depend on the service and applicable arrangements.

Further information is available in the relevant providers’ privacy notices:

Wix: https://www.wix.com/about/privacy
Fienta: https://fienta.com/privacy
Stripe: https://stripe.com/privacy
Maksekeskus: https://makecommerce.net/terms-and-conditions-of-data-protection/

You may contact us for further information about the recipients relevant to your data.

We do not sell personal data.

9. International Data Transfers

Some service providers and their subcontractors may process personal data outside the European Economic Area.

Where such a transfer occurs, we ensure that an appropriate transfer mechanism applies, such as:

A European Commission adequacy decision covering the recipient.
European Commission Standard Contractual Clauses, together with additional safeguards where necessary.
Another mechanism permitted by applicable data protection law.

You may contact us for information about the safeguards applicable to your data and how to obtain a copy, subject to necessary redactions to protect confidential information.

10. Cookies and Similar Technologies

The Website uses cookies and similar technologies. Some are necessary for core functions, such as security, checkout and remembering your privacy choices.

Other technologies, where enabled, may support analytics, embedded media or marketing.

Non-essential cookies and similar technologies requiring consent may be used only after you have made the relevant consent choice. Continuing to browse the Website does not constitute consent.

You can accept, reject or manage optional categories through the Website’s cookie settings and change your choice later through the available cookie preferences control.

Information about the technologies enabled on the Website, their purposes, providers and duration is provided through the cookie settings or accompanying cookie information.

You may also manage cookies through your browser. Blocking necessary cookies may affect some Website functions.

Embedded content, such as videos, may involve third-party technologies. Where consent is required, that content or its optional tracking features must remain inactive until the necessary consent has been given.

11. Newsletters and Communication Preferences

We send subscription-based newsletters with your consent. You can unsubscribe at any time by using the link in the email or contacting info@lilleoru.ee.

We may retain a limited record of your unsubscribe request to ensure that your choice is respected.

Unsubscribing from marketing does not prevent us from sending necessary booking confirmations, access instructions, event changes or other messages relating to an existing Service.

If email engagement tracking is used, information about it and any required consent must be provided when you subscribe or before the tracking begins.

12. How Long We Keep Personal Data

We retain personal data only for as long as needed for the purpose for which it was collected, taking account of legal obligations and any necessary retention for legal claims.

The following principles apply:

Booking and service records: retained to administer the Service and, where necessary, handle related complaints or claims during the applicable limitation period.
Accounting records: retained for the period required by applicable accounting and tax law.
Routine inquiries: retained until the inquiry and necessary follow-up have been completed, unless longer retention is needed for a related booking or dispute.
Newsletter data: retained while the subscription remains active. Limited evidence of consent and unsubscribe information may be retained where necessary to demonstrate compliance and respect your preferences.
Waiting-list data: retained until the relevant opportunity has been communicated and the waiting list has served its purpose, unless you separately agree to further communications.
Recordings and event images: retained for the stated access or use period, with continued retention reviewed against their purpose and applicable permissions.
Sensitive participation information: retained only for as long as necessary for the specific purpose, unless a legal requirement or a properly assessed legal claim justifies longer retention.
Technical logs and cookie data: retained according to their security or operational purpose and the periods identified in the applicable cookie information or provider settings.

Where records serve several purposes, a longer period may apply to the information necessary for the remaining purpose. Access to retained records is restricted as appropriate.

When personal data is no longer needed, we delete or anonymise it. Backup copies are removed through the normal backup replacement cycle and are not used for ordinary operational purposes.

13. Data Security

We apply appropriate technical and organisational measures proportionate to the nature of the data and the risks involved.

These measures include access restrictions, appropriate authentication, confidentiality arrangements, secure data transmission where applicable and the use of suitable service providers.

Access is limited to people who need the information to perform their responsibilities.

No system can guarantee absolute security. Where a personal data breach occurs, we assess it and notify the supervisory authority and affected individuals where legally required.

14. Your Rights

Subject to the conditions and exceptions established by law, you have the right to:

Obtain confirmation of whether we process your personal data and access that data.
Request correction of inaccurate or incomplete data.
Request deletion of your data.
Request restriction of processing.
Receive data you have provided in a structured, commonly used and machine-readable format, and request its transfer where the right to data portability applies.
Object to processing based on legitimate interests on grounds relating to your particular situation.
Object at any time to processing for direct marketing, including related profiling.
Withdraw consent at any time where processing is based on consent.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

These rights are not absolute. For example, we may need to retain accounting records despite a deletion request.

To exercise your rights, contact info@lilleoru.ee. We may request proportionate information to verify your identity.

We respond without undue delay and normally within one month of receiving a request. Where legally permitted because of complexity or the number of requests, this may be extended by up to two further months. We will inform you of an extension and its reasons within the first month.

Requests are generally handled free of charge. Any refusal or fee will be applied only where permitted by law and will be explained.

15. Complaints to a Supervisory Authority

If you have concerns about our processing, please contact us so that we can address them.

You also have the right to lodge a complaint with a data protection supervisory authority, particularly in the country of your habitual residence, place of work or the alleged infringement.

In Estonia, the supervisory authority is:

Andmekaitse Inspektsioon — Estonian Data Protection Inspectorate
Website: https://www.aki.ee

You do not need to contact us first before exercising this right.

16. Changes to This Policy

We may update this Policy to reflect changes in our activities, service providers or legal requirements.

The current version and its effective date are published on the Website. Where a change materially affects how we process your personal data, we will provide additional notice as appropriate and obtain new consent where required.

17. Contact

Lilleoru MTÜ
Registry code: 80143446
Taevasmaa tee 2, Aruvalla küla
Rae vald, Harju maakond 75320
Estonia

Email: info@lilleoru.ee