1. General Information
1.1. This Privacy Policy explains how personal data is collected, used, stored, shared and otherwise processed in connection with the website mantakchia.eu, ticket purchases, participation in the event “Tao Sexual Alchemy with Grandmaster Mantak Chia — Warsaw 2026” (the “Event”), online participation, Event recordings and related services.
1.2. We process personal data in accordance with applicable data protection laws, including Regulation (EU) 2016/679 (the General Data Protection Regulation — “GDPR”) and applicable Polish data protection legislation.
1.3. This Privacy Policy applies in particular to persons who:

• visit or use the Event website;
• submit an enquiry through the website;
• purchase or receive an Event ticket;
• register for or participate in the Event;
• purchase or use Zoom access;
• purchase or receive access to Event recordings;
• purchase additional services, including Polish simultaneous translation;
• contact us by email, telephone, WhatsApp or another communication channel;
• subscribe to our newsletter or other marketing communications;
• otherwise interact with us in connection with the Event or related services.

2. Data Controller
The controller of your personal data is:
HOLISTIC DEVELOPMENT INSTITUTE sp. z o.o.
ul. Żulińskiego 9
20-706 Lublin, Poland
KRS: 0000478125
REGON: 061604940
NIP: 712 328 11 93
Email: info@mantakchia.eu

referred to in this Privacy Policy as the “Organizer”, “we”, “us” or “Controller”.
We have not appointed a separate Data Protection Officer.
For questions concerning this Privacy Policy, the processing of your personal data or the exercise of your data protection rights, please contact: info@mantakchia.eu

3. Personal Data We Collect
Depending on how you interact with us, we may process the following categories of personal data.
3.1. Identification and Contact Information
This may include:

• first name;
• last name;
• email address;
• telephone number;
• country;
• billing or correspondence address.

3.2. Order and Event Participation Information
This may include:

• ticket type;
• workshop or module selected;
• optional services purchased;
• order or transaction identifier;
• payment status;
• purchase date;
• amount paid;
• currency;
• registration information;
• ticket transfer information;
• attendance-related information;
• Zoom or recording access status;
• requests relating to Event participation.

3.3. Company and Invoice Information
Where you purchase on behalf of a company or request an invoice, we may also process:

• company name;
• registered or billing address;
• NIP, VAT ID or other applicable tax identification number;
• invoice information;
• details identifying the person making the purchase on behalf of the company.

Providing company and VAT/tax information is optional unless it is required for the particular transaction or invoice requested.
3.4. Payment Information
Payments are processed through Stripe. We generally do not receive or store your complete payment card details.
We may receive information relating to the transaction, including:

• payment status;
• transaction identifier;
• amount and currency;
• payment method type;
• refund status;
• limited payment information necessary to identify and manage the transaction.

Stripe and the relevant payment networks or payment-method providers process payment information in accordance with their own legal obligations and privacy practices.
3.5. Online Participation Information
Where you participate in the Event online through Zoom, we may process:

• your name;
• email address;
• information necessary to provide Event access;
• participation information;
• information you voluntarily submit through Zoom features such as chat or Q&A;
• information relating to access to Event recordings.

3.6. Enquiries and Communications
Where you contact us through our website, email, telephone or WhatsApp, we may process your name, email address, telephone number, the content of your enquiry, correspondence history and any other information you voluntarily provide that is necessary to respond to your request.
Our website contact form may request your name, email address and telephone number.
3.7. Website and Technical Information
When you visit our website, we or our technology providers may process information such as:

• IP address;
• browser type and version;
• device type;
• operating system;
• language settings;
• approximate location derived from technical data;
• pages visited;
• date and time of visits;
• referring website or campaign;
• website interactions;
• cookie identifiers;
• advertising and analytics identifiers;
• information concerning your cookie preferences.

The extent of this processing depends partly on your cookie and tracking preferences.

4. Purposes and Legal Bases for Processing
We process personal data only where we have an appropriate legal basis under applicable law.
4.1. Processing Orders and Providing Purchased Services
We process personal data in order to process ticket orders, register Participants, confirm purchases, provide access to the Event, provide Zoom and recording access, provide purchased additional services, manage ticket transfers, process cancellations and refunds, and communicate information necessary to provide purchased services.
The primary legal basis is Article 6(1)(b) GDPR — processing necessary for the performance of a contract or to take steps at your request before entering into a contract.
4.2. Event Administration
We process personal data to organize and administer the Event, including communications concerning Event dates and schedule, registration and check-in, venue information, organizational instructions, programme changes, Zoom access, recording availability, ticket transfers, cancellations or postponements, and other information necessary for participation.
The legal basis is Article 6(1)(b) GDPR and, where applicable, our legitimate interest under Article 6(1)(f) GDPR in efficiently organizing and administering the Event. These communications are operational communications and are not marketing communications.
4.3. Payments
We process transaction information in order to process and verify payments, identify completed orders, manage refunds, and prevent and investigate payment-related problems or fraud. Depending on the processing involved, the legal basis may be Article 6(1)(b), Article 6(1)(c), or Article 6(1)(f) GDPR.
4.4. Accounting, Tax and Invoicing
We process information necessary to issue invoices, maintain accounting documentation and legally required transaction records, and comply with tax, financial and reporting obligations. The legal basis is primarily Article 6(1)(c) GDPR.
4.5. Customer Service and Enquiries
Where you contact us with a question or request, we process your information to respond and manage the enquiry. The legal basis may be Article 6(1)(b) GDPR where the enquiry concerns a contract, ticket or potential purchase, or Article 6(1)(f) GDPR based on our legitimate interest in communicating with Participants and persons interested in our services.
4.6. Complaints and Legal Claims
We may process personal data where necessary to handle complaints, establish, exercise or defend legal claims, prevent fraud or misuse, protect our rights, and maintain evidence relating to agreements and transactions. The legal basis is Article 6(1)(f) GDPR and, where applicable, Article 6(1)(c) GDPR.

5. Newsletter and Marketing Communications
5.1. With your consent, we may use your contact information to send newsletters, information about future events and workshops, special offers, educational and promotional content, and other marketing communications relating to our activities.
5.2. Marketing communications may be sent using MailerLite.
5.3. Marketing consent is voluntary and is not required to purchase a ticket or participate in the Event.
5.4. Where processing is based on your consent, the legal basis under GDPR is Article 6(1)(a).
5.5. You may withdraw your marketing consent at any time by using the unsubscribe link included in a marketing email or contacting us at info@mantakchia.eu.
5.6. Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
5.7. Withdrawing marketing consent will not prevent us from sending transactional or organizational messages necessary to provide services you have purchased.

6. MailerLite and Email Communications
6.1. We use MailerLite to send organizational and marketing email communications.
6.2. For this purpose, information such as your name, email address, subscription status and information concerning email delivery and interaction may be processed through MailerLite.
6.3. Organizational messages relating directly to your ticket or participation are sent because they are necessary to provide the service and are separate from optional marketing communications.
6.4. Marketing communications are subject to the rules set out in Section 5.

7. Website Platform — Tilda
7.1. Our website is created and hosted using Tilda.
7.2. As a result, certain technical information relating to website visitors and information submitted through website forms may be processed using Tilda's infrastructure.
7.3. This may include IP addresses, technical request information, information submitted through website forms, and technical and security information necessary to operate the website.
7.4. Where Tilda processes personal data on our behalf, such processing is subject to the applicable contractual and data-protection arrangements.

8. Stripe and Payment Processing
8.1. We use Stripe as our payment processing provider.
8.2. Stripe may receive personal and transaction information necessary to process payments, authenticate transactions, prevent fraud, process refunds, and comply with financial and regulatory requirements.
8.3. Depending on the payment method selected, additional payment providers and payment networks may participate in the transaction, including providers supporting payment cards, Apple Pay, Google Pay or BLIK.
8.4. Stripe may process certain personal data as an independent controller for purposes determined by Stripe, including compliance, security and fraud prevention.
8.5. We use Stripe as a payment processor. Stripe Managed Payments is not used as the merchant-of-record model for the Event.

9. Zoom and Online Participation
9.1. Online participation in the Event is provided through Zoom.
9.2. Participants purchasing Zoom access are required to have an appropriate Zoom account and compatible Zoom application installed on their computer or mobile device.
9.3. We may provide Zoom with information necessary to enable your participation, such as your name, email address and information necessary to authorize access.
9.4. When you use Zoom, Zoom may independently process technical and usage information in accordance with its own privacy practices.
9.5. Participants should avoid sharing unnecessary personal or sensitive information through Zoom chat, Q&A or other functionality visible to other Participants.

10. Event Recordings and Zoom Cloud
10.1. The Event will be recorded and recordings will be stored and made available through Zoom Cloud or related Zoom functionality.
10.2. The purpose of recording the Event is primarily to provide recording access to Participants who purchased or are otherwise entitled to receive this service.
10.3. Event recordings will primarily focus on Grandmaster Mantak Chia, instructors, teaching content and Event activities.
10.4. Participants may nevertheless appear incidentally in recordings, particularly in wide shots, group activities, audience views, questions or interactions forming part of the Event.
10.5. Where appropriate and reasonably possible, we may take organizational measures to minimize unnecessary disclosure of Participants' personal information.
10.6. Access to recordings is governed by the Event Terms & Conditions.

11. WhatsApp
11.1. Our website may contain a button enabling visitors to contact us through WhatsApp.
11.2. If you choose to contact us through WhatsApp, the information you provide through that service may include your telephone number, profile information made available through WhatsApp, the content of your communication, attachments or other information you voluntarily send.
11.3. We process this information only to the extent necessary to communicate with you and handle your enquiry or request.
11.4. WhatsApp/Meta may separately process information relating to your use of its service under its own privacy terms. Use of WhatsApp to contact us is voluntary.

12. Analytics
Subject to your cookie preferences and applicable consent requirements, we use analytics technologies to understand how visitors use our website and to improve its performance.
12.1. Google Analytics 4
We use Google Analytics 4 (GA4) to obtain statistical information concerning website usage. Depending on your consent choices and the applicable configuration, information processed may include website interactions, pages viewed, session information, device and browser information, approximate geographic information, traffic and campaign source information, and technical identifiers.
Where consent is required, GA4 analytics cookies and equivalent tracking technologies will not be activated until appropriate consent has been obtained.
12.2. Google Tag Manager
We use Google Tag Manager (GTM) to manage website tags and technologies. Technologies managed through GTM remain subject to the applicable consent choices and legal requirements.
12.3. Microsoft Clarity
We use Microsoft Clarity to understand how visitors interact with our website and to improve usability. Depending on the applicable configuration and consent, Clarity may provide aggregated and session-based information concerning navigation patterns, clicks, scrolling, interaction with website elements, and device and browser information.
Where required, Clarity will be operated in accordance with the visitor's applicable cookie and tracking consent choices.

13. Meta Pixel and Conversions API
13.1. Subject to your consent where required, we use advertising technologies provided by Meta, including Meta Pixel and Meta Conversions API.
13.2. These technologies help us measure the effectiveness of advertising, understand whether advertisements result in visits or purchases, measure conversions, create advertising audiences, improve advertising campaigns, and display advertising that may be more relevant to users.
13.3. Depending on configuration and your choices, information processed may include website interactions, Event or product pages viewed, purchase or conversion events, technical identifiers, browser and device information, and information associated with advertising campaigns.
13.4. Where required by applicable law, Meta advertising technologies will be used only after appropriate consent has been obtained.
13.5. Withdrawal or refusal of marketing-cookie consent does not affect your ability to purchase a ticket or use the essential functionality of the website.

14. Cookies and Similar Technologies
14.1. Our website uses cookies and similar technologies.
14.2. These technologies may be categorized as Necessary, Analytics and Marketing.
Necessary technologies are required for the website, security, payment process or other essential functionality. Analytics technologies are used to understand website usage and performance, including technologies associated with Google Analytics and Microsoft Clarity. Marketing technologies are used for advertising measurement, attribution, audience creation and related marketing purposes, including Meta Pixel and related technologies.
14.3. Where legally required, Analytics and Marketing technologies will not be activated until the visitor has provided the relevant consent.
14.4. We intend to use a consent-management platform, such as CookieYes, to enable visitors to accept optional technologies, reject optional technologies, select individual categories and change their preferences later.
14.5. More detailed information about individual cookies, providers, purposes and retention periods will be provided in our separate Cookie Policy and/or cookie preference centre.

15. Photography and Video During the Event
15.1. Photography and video recording may take place during the Event for documentation and promotional purposes.
15.2. This may include general Event footage, photographs of the workshop environment, wide shots, group photographs, and documentation of Event activities and atmosphere.
15.3. Where legally permitted, such materials may be used or shared for purposes connected with documenting and promoting the Event and related activities, including through the Event website, Instagram, Facebook, YouTube, email communications and materials promoting future events.
15.4. Event photographs and video materials may be accessible to or shared with HOLISTIC DEVELOPMENT INSTITUTE sp. z o.o.; Grandmaster Mantak Chia / the Universal Healing Tao team where relevant to the Event; and Event Participants where materials are made available to them.
15.5. The Organizer does not intend to use individual portrait photographs of Participants for promotional purposes without an appropriate legal basis or permission where required.
15.6. Participants who do not wish to appear in identifiable general or group photographs or video footage should inform us before the Event at info@mantakchia.eu or during Event registration/check-in.
15.7. We will take reasonable organizational steps to respect such requests.
15.8. The above does not limit any rights available to individuals under applicable data-protection, privacy or image-rights legislation.

16. Polish Simultaneous Translation
16.1. Where a Participant purchases Polish simultaneous translation, we process information indicating that the relevant translation service has been purchased.
16.2. We do not require additional categories of personal data solely for the purpose of providing the translation service.

17. Lunch Reservations
17.1. Lunch is provided independently by Anin Park Hotel.
17.2. Where you ask us to assist with a lunch reservation, we may provide the hotel with the minimum information necessary to organize the reservation. This may include the Participant's name, number of persons and applicable dates.
17.3. We do not provide the hotel with additional Participant information for this purpose unless reasonably necessary or requested by the Participant.
17.4. Payment for lunch is made directly to the hotel. Where the hotel receives personal information as an independent service provider, its own privacy practices may also apply.

18. Health Information
18.1. We do not require Participants to provide medical or health information through the standard ticket-purchase or registration process.
18.2. If a Participant has a limitation or condition relevant to safe participation, the Participant may personally inform an Organizer representative or instructor.
18.3. Such information should be limited to what is reasonably necessary for safe participation.
18.4. Health information may constitute a special category of personal data under Article 9 GDPR and will be handled only where an appropriate legal basis exists.
18.5. Participants should not send us detailed medical documentation unless specifically necessary and appropriately requested.

19. Recipients of Personal Data
We disclose personal data only where necessary and where there is an appropriate legal basis. Depending on the service concerned, recipients or categories of recipients may include:

• Tilda as our website technology provider;
• Stripe and payment providers;
• MailerLite;
• Zoom;
• Google in connection with GA4 and Google Tag Manager;
• Microsoft in connection with Clarity;
• Meta in connection with Meta Pixel, Conversions API, Facebook, Instagram and WhatsApp functionality;
• IT, hosting and technical service providers;
• accounting, bookkeeping, tax and invoicing service providers;
• professional advisers, where necessary;
• Event venues and service providers where information is necessary to provide a service requested by a Participant;
• authorized Event personnel;
• competent authorities, courts or public institutions where disclosure is required by law.

We do not sell personal data. We do not provide Event Participant lists to unrelated third parties for their independent marketing purposes.

20. Processors and Independent Controllers
20.1. Some providers process personal data on our behalf as data processors.
20.2. Other providers may act as independent controllers for some processing activities because they independently determine the purposes and means of particular processing.
20.3. The precise role may depend on the service and processing activity concerned.
20.4. Where required, we enter into appropriate data-processing arrangements with processors acting on our behalf.

21. International Transfers
21.1. Some technology providers we use operate internationally. Consequently, personal data may in certain circumstances be processed outside Poland or outside the European Economic Area (“EEA”).
21.2. Where personal data is transferred outside the EEA, we take steps to ensure that the transfer is made using a mechanism permitted under Chapter V GDPR. Depending on the provider and destination, this may include a European Commission adequacy decision, the EU-U.S. Data Privacy Framework where applicable to an eligible and certified recipient, European Commission Standard Contractual Clauses, or another lawful transfer mechanism provided under GDPR.
21.3. Where necessary, additional safeguards may be implemented taking into account the circumstances of the transfer.
21.4. You may contact us at info@mantakchia.eu for further information about safeguards applicable to relevant international transfers.

22. How Long We Keep Personal Data
We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, taking into account contractual obligations, legal requirements and applicable limitation periods.
22.1. Contract and Event Information
Information relating to purchases and Event participation may be retained for the period necessary to perform the contract and thereafter for the period necessary to establish, exercise or defend potential legal claims.
22.2. Accounting, Tax and Invoice Information
Information required for accounting, tax, invoicing and financial documentation is retained for the period required under applicable Polish law.
22.3. Complaints and Correspondence
Information relating to complaints, disputes and significant correspondence may be retained until the matter has been resolved and thereafter until the applicable limitation periods have expired where necessary.
22.4. Marketing Information
Where marketing processing is based on consent, we may process the relevant information until consent is withdrawn, the individual unsubscribes, or we determine that the information is no longer necessary for the relevant marketing purpose. We may retain limited information concerning consent, withdrawal or objection where necessary to demonstrate compliance with applicable law.
22.5. Website Analytics and Advertising Data
Retention periods applicable to cookies, analytics identifiers and marketing technologies are described in the Cookie Policy and/or cookie preference centre and may depend on the relevant provider and configuration.
22.6. Event Photography and Video
Photography and video materials may be retained for documentation and promotional purposes for as long as they remain relevant to those purposes, subject to applicable law and the rights described in this Privacy Policy.
After the relevant retention period expires, personal data will be deleted, anonymized or otherwise handled in accordance with applicable law.

23. Your Rights
Subject to the conditions and limitations established by GDPR and other applicable law, you may have the right to:

• access your personal data and obtain a copy;
• request rectification of inaccurate or incomplete personal data;
• request erasure of personal data;
• request restriction of processing;
• object to processing based on legitimate interests;
• object at any time to processing for direct marketing purposes;
• exercise the right to data portability where applicable;
• withdraw consent at any time where processing is based on consent;
• obtain information concerning applicable safeguards for international transfers;
• lodge a complaint with a supervisory authority.

These rights are not absolute and their applicability depends on the circumstances and legal basis for the relevant processing.
To exercise your rights, please contact info@mantakchia.eu. We may need to verify your identity before acting on a request where reasonably necessary to protect personal data.

24. Right to Object
24.1. Where we process personal data on the basis of our legitimate interests under Article 6(1)(f) GDPR, you have the right to object to such processing on grounds relating to your particular situation.
24.2. We will then cease processing unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or where processing is necessary for the establishment, exercise or defence of legal claims.
24.3. Where personal data is processed for direct marketing, you have the right to object at any time. If you object to direct marketing, we will stop processing your personal data for that purpose.

25. Withdrawal of Consent
25.1. Where processing is based on your consent, you may withdraw that consent at any time.
25.2. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
25.3. Consent may be withdrawn through the mechanism provided for the relevant service, for example the unsubscribe link in a marketing email, cookie settings on the website, or contacting info@mantakchia.eu.
25.4. Withdrawal of consent does not affect processing based on another valid legal basis.

26. Right to Lodge a Complaint
26.1. If you believe that your personal data has been processed in violation of applicable data protection law, you have the right to lodge a complaint with the competent supervisory authority.
In Poland, the supervisory authority is:
President of the Personal Data Protection Office
Prezes Urzędu Ochrony Danych Osobowych (UODO)
ul. Stanisława Moniuszki 1A
00-014 Warsaw
Poland
26.2. We encourage you to contact us first at info@mantakchia.eu if you have a privacy concern so that we have an opportunity to address it.

27. Providing Personal Data
27.1. Providing personal data is generally voluntary.
27.2. However, certain information is necessary to enter into and perform the contract with you. For example, we need sufficient identification, contact and transaction information to process your order, identify your ticket, provide Event or online access, and send necessary organizational information.
27.3. If you do not provide information necessary to perform the contract, we may be unable to complete the purchase or provide the relevant service.
27.4. Providing information for marketing purposes is voluntary and is not a condition of purchasing a ticket.
27.5. Company and VAT/tax information is generally optional and is required only where relevant to the requested invoice or transaction.

28. Automated Decision-Making and Profiling
28.1. We do not intend to make decisions producing legal effects or similarly significantly affecting you based solely on automated processing within the meaning of Article 22 GDPR in connection with ordinary Event participation.
28.2. Analytics and advertising technologies may perform automated analysis, attribution, audience segmentation or profiling for marketing and advertising purposes.
28.3. Where such technologies require consent, they will be subject to your applicable cookie and marketing preferences.
28.4. Payment providers may independently use automated fraud-prevention and security systems in accordance with their own legal obligations and privacy practices.

29. Data Security
29.1. We take appropriate technical and organizational measures designed to protect personal data against unauthorized access, accidental or unlawful destruction, loss, alteration, unauthorized disclosure, and other unlawful processing.
29.2. Access to personal data is limited to persons and providers who reasonably require it for the relevant purpose.
29.3. However, no method of electronic transmission or storage can guarantee absolute security.

30. Links and Third-Party Services
30.1. Our website may contain links to third-party websites or services, including social media, hotels, payment services or other external platforms.
30.2. When you leave our website and interact directly with a third party, that third party may process your personal data independently.
30.3. We encourage you to review the relevant third party's privacy information before providing personal data directly to it.

31. Changes to this Privacy Policy
31.1. We may update this Privacy Policy where necessary, for example due to changes in applicable law, changes in our services, changes in technologies or providers, or changes in the ways we process personal data.
31.2. The current version will be published on the Event website together with its effective date.
31.3. Where a change materially affects the way we process personal data and applicable law requires additional notification or consent, we will take the appropriate steps.

32. Website and Language
32.1. This English-language Privacy Policy applies to the European Event website: https://mantakchia.eu/
32.2. A Polish-language version of the Privacy Policy will be made available for the Polish Event website: https://mantakchia.pl/
32.3. Both versions are intended to describe substantially the same data-processing activities, adapted where necessary to the relevant website and language.

33. Contact
If you have questions concerning this Privacy Policy, how we process your personal data, your GDPR rights, withdrawal of consent, marketing preferences, Event photography or video, or another privacy-related matter, please contact:
HOLISTIC DEVELOPMENT INSTITUTE sp. z o.o.
ul. Żulińskiego 9
20-706 Lublin, Poland
KRS: 0000478125
REGON: 061604940
NIP: 712 328 11 93
Email: info@mantakchia.eu

Effective date: 12 August 2026