1. Who we are

This policy explains how the Sowa Rigpa Forum collects and uses your personal data when you visit sowarigpaforum.org, buy a ticket, attend the Forum or sign up for our newsletter.

The data controller is MTÜ Eesti Tiibeti Traditsioonilise Meditsiini Akadeemia, Väluste school, Väluste village, Tarvastu, Viljandi county, Estonia, 69704, registration code: 80351469.

You can contact us about your data at sowarigpaf@gmail.com.

2. What we collect and why

We only collect what we need to run the Forum. We never sell your data.

When you buy a ticket. We collect your name, email, billing address and order details to process your order, send confirmations and give you access to the Forum. Card details go directly to our payment provider; we never see them. Legal basis: contract (Art. 6(1)(b)).

When you attend online. The video platform uses your name and email, and anything you say, show on camera or write in the chat. We use this to run live sessions and manage attendance. Legal basis: contract (Art. 6(1)(b)).

When sessions are recorded. If you turn on your camera, speak or write in the chat, your image, voice or messages may appear in recordings shared with ticket holders. You can keep your camera and microphone off. Legal basis: legitimate interests (Art. 6(1)(f)).

When you create an account. We keep your name, email, password and order history so you can log in and manage your bookings. Legal basis: contract (Art. 6(1)(b)).

When you sign up for our newsletter. We use your email address, and your name if you give it, to send news about the Forum. You can unsubscribe at any time. Legal basis: consent (Art. 6(1)(a)).

When you contact us or apply to speak. We use your name, email, message and any CV or proposal you send to reply and to review speaker applications. Legal basis: legitimate interests (Art. 6(1)(f)).

When you visit the website. Cookies record your IP address, browser, device and the pages you visit. Essential cookies keep the site secure and working (legitimate interests). Analytics cookies measure visits, but only with your consent.

For accounting. We keep order and payment records to meet tax and accounting law. Legal basis: legal obligation (Art. 6(1)(c)).

3. Who we share it with

We share data only with services that help us run the Forum. They act on our instructions and must protect your data.

• Squarespace: website hosting, online shop, customer accounts and newsletters

• Stripe or PayPal: card payments

• Zoom: live online sessions

• Our accountant and authorities: where the law requires it

Speakers do not receive the attendee list.

Transfers outside the EU. Some of these providers are based in the United States or store data there. Where this happens, transfers are protected by the EU–US Data Privacy Framework or by the European Commission's Standard Contractual Clauses.

4. How long we keep it

• Orders and payment records: 7 years, as required by accounting law

• Account details: until you delete your account

• Session recordings: 6 months after the Forum

• Newsletter subscription: until you unsubscribe

• Emails and speaker applications: 2 years after our last contact

• Analytics data: 14 months

5. Your rights

Under the GDPR you have the right to:

• see the personal data we hold about you

• correct data that is wrong

• have your data deleted

• restrict or object to how we use it

• receive your data in a portable format

• withdraw consent at any time, for example by unsubscribing from the newsletter

To use any of these rights, email sowarigpaf@gmail.com. We will reply within one month.

Cookies. Our website uses essential cookies to work properly. We use analytics or marketing cookies only if you accept them in the cookie banner. You can change your choice at any time in the banner or in your browser settings.

Changes. We may update this policy. The latest version is always on this page, with the date it was last updated.

Complaints. If you are unhappy with how we handle your data, please contact us first. You also have the right to complain to a data protection authority, such as the Estonian Data Protection Inspectorate, or the authority in the country where you live.