Privacy policy

This Privacy Policy explains how Orraya Global (“Orraya Global”, “Orraya”, “we”, “us”) collects, uses and shares personal information when you visit our Sanctuary by Orraya · Sicily retreat website (retreat.orrayaglobal.com), subscribe to our emails, book a call with Michaela, reserve and pay for your place on the retreat, or otherwise get in touch with us. We are the controller of the personal information described here.

We keep this simple: we collect what we need to run the retreat and look after our guests, we do not sell your personal information, and you can ask us about your data at any time at [email protected].

Depending on how you interact with us, we may collect:

• Details you give us. Your name, email address, phone number and any message or answers you submit when you fill in our subscribe or Ask a question form, book a call with Michaela or otherwise get in touch with us.
• Booking and payment information. When you reserve your place, we receive your name, email, phone number, billing details, your room choice (shared twin room or a room of your own), your payment option (deposit, pay in full, or 2 or 4 monthly payments) and your payment status. If you are coming with a friend, we also receive their name so we can pair your rooms. Your card details are entered with our payment provider; we do not see or store your full card number.
• Health and wellbeing information. So we can adapt yoga, breathwork, movement and meals for you, you may tell us about dietary needs, allergies, injuries, medical conditions, medication or pregnancy. Some of this is health information, which is treated as special category data. We only collect it with your explicit consent, and you choose what to share, although the less we know, the less we can adapt the retreat for you.
• Travel and arrival details. Your flight times and anything you tell us about getting to and from Catania airport, so we can arrange the group transfer, and the details of any extra nights before or after the retreat that you ask Michaela to plan.
• Your postal address. If you write a letter to your future self on the last morning, we keep your postal address so Michaela can post it to you three months later.
• Photos, video and testimonials. Photographs and video taken during the retreat, as described in the photo and video release in our Terms and Conditions, and any testimonial or review you agree to give us.
• Technical and usage information. Standard information your browser sends when you visit, such as your IP address, device and browser type, the pages you view and the page that referred you, including any campaign details in the link you clicked (for example UTM tags).
• Email activity. If you receive our emails, our email platform may record whether messages are delivered, opened or clicked, so we can see what is useful and stop sending what is not.

We use personal information to:

• respond to your enquiries and book and run calls with Michaela;
• reserve your place, take payment, run your payment plan, send confirmations and receipts, and keep the financial records we are required to keep;
• run the retreat, including arranging your room at Mangiabove, your meals, your airport transfers, the welcome call and the group chat, and sending you practical information before you travel;
• adapt practices, meals and activities to your health and dietary needs;
• plan any extra nights or travel you ask Michaela to arrange;
• post your letter to your future self;
• send you emails you have asked for and, where the law allows, information about future retreats and journeys;
• understand how our website is used and improve it;
• keep our website and systems secure; and
• comply with legal obligations and protect our legal rights.

Where the law of your country requires a legal basis for using your information (for example under the UK or EU GDPR), we rely on: performing our contract with you or taking steps you request before a contract; our legitimate interests in running, securing and improving our business and in telling people about our retreats; your consent (for example when you opt in to marketing emails, which you can withdraw at any time); your explicit consent for any health information you share with us; and compliance with legal obligations. We do not make decisions about you based solely on automated processing that has legal or similarly significant effects.

We do not sell your personal information. We share it only with the people and service providers needed to run what you have asked us for:

• HighLevel (LeadConnector), which provides the forms, calendar, payment links and customer records we use to manage enquiries, bookings and email communications. Most information you submit through our forms and booking pages is stored there.
• Our payment provider, which processes your deposit and payments through the secure payment links on the retreat page, under its own privacy policy.
• Mangiabove, our venue in Marina di Ragusa, which receives the details needed to arrange your stay, such as your name, room type and arrival information.
• Our local cook and activity partners. We share only what is needed, for example your dietary requirements and allergies with the cook, and relevant information with any guide or practitioner leading an activity or treatment you take part in.
• Our transfer company, which receives your name and arrival and departure details to run the group transfers to and from Catania airport.
• InteleTravel and travel suppliers, only if you ask Michaela to book flights, hotels or other travel for you, so the booking can be made.
• Other guests, only through the welcome call and private group chat that you choose to join, where your name and the contact details you use there will be visible to the group.
• Google Fonts. Your browser connects to Google to load our fonts, and Google receives your IP address and browser details, which it handles under its own policy.
• Professional advisers and authorities, such as accountants and lawyers, and public authorities where we are legally required to disclose information.
• A buyer or successor, if our business is ever sold or reorganised, subject to this policy.

With your permission, we may publish your name, photo, story or review as a testimonial. We will not do that without asking first, and you can ask us to remove it later.

• Essential. Our forms, calendar and cookie preferences may store small items in your browser so they work properly, for example remembering your choices during your visit.
• Analytics. We may use privacy-focused analytics to count visits and see which pages are used.
• Embedded and third-party services. Embedded forms, calendar widgets, payment pages and fonts loaded from other providers may set their own cookies or collect technical information under their own policies.
• Advertising. If we run paid advertising, the ad platforms (such as Meta or Google) may place their own cookies or pixels on pages where we install their tags, to measure results and show relevant ads. You can control these through your browser settings and the ad platform’s own settings.

You can block or delete cookies in your browser settings. If you block essential cookies, some features, such as our forms and calendar, may not work.

If you subscribe to our emails or book a place on a retreat, we may send you emails about future Sanctuary retreats, journeys from Orraya Global and our offers. You can unsubscribe at any time using the link at the bottom of every email, or by emailing us. Unsubscribing from marketing does not stop service emails that relate to something you have booked, such as confirmations, payment reminders, receipts and practical information about your retreat.

Our retreat takes place in Italy, and some of our service providers operate internationally, including in the United States. Your information may therefore be processed in countries other than your own. Where required, we rely on appropriate safeguards for these transfers, such as the UK’s adequacy arrangements with the EU, standard contractual clauses or the provider’s certification under a recognised data-transfer framework.

We keep personal information only as long as we need it for the purposes above. In practice: enquiry and email-list records are kept until you unsubscribe or ask us to delete them, or until they become inactive; booking and payment records are kept for as long as our legal, tax and accounting obligations require; health information is kept only as long as needed to deliver the retreat and is then deleted or anonymised, or sooner if you ask us to; your postal address is kept until your letter has been sent, unless you are on our mailing list for another reason; and testimonials and photographs are kept until you ask us to remove them. When information is no longer needed, we delete or anonymise it.

We use reasonable technical and organisational measures to protect personal information, including encrypted connections (HTTPS) and access controls on our systems. We take particular care with any health information you share with us. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Depending on where you live, you may have the right to ask us to: give you a copy of the personal information we hold about you; correct anything that is wrong; delete your information; restrict or object to how we use it; and provide it in a portable format. Where we rely on your consent, including for health information, you can withdraw it at any time. To make a request, email [email protected]. We may need to confirm your identity first, and we will respond within the time required by law (usually within one month).

If you live somewhere with similar privacy laws (for example the UK, the EU or California), we will honour your requests as those laws require. You also have the right to complain to your local data protection authority, which in the UK is the Information Commissioner’s Office (ico.org.uk), though we would appreciate the chance to put things right first.

Our website and retreats are intended for adults. They are not directed at anyone under 18, and we do not knowingly collect personal information from children. If you believe a child has given us information, please contact us and we will delete it.

Our website links to other sites and services, including our calendar and secure payment pages. We do not control these sites and are not responsible for their privacy practices, so please read their policies.

We may update this policy from time to time. When we do, we will change the “Last updated” date at the top of this page. If a change is significant, we will take reasonable steps to let you know.

Questions about this policy or your personal information? Contact Orraya Global at [email protected].