Privacy Policy and Cookies

If you are our customer, newsletter subscriber or website visitor, you entrust us with your personal data. We are responsible for their protection and security. Please familiarise yourself with the protection of personal data, the principles and the rights you have in connection with the GDPR (General Data Protection Regulation). The processing of personal data is further governed by Act No. 110/2019 Coll., on the Processing of Personal Data, as amended. The sending of commercial communications is governed by Act No. 480/2004 Coll., on Certain Information Society Services, as amended. Terms used in this Policy and not defined herein shall have the meanings set forth in the General Terms and Conditions of the Provider (hereinafter the "Terms and Conditions"), which are available on the Website. This Policy and the Terms and Conditions are mutually complementary.

Who is the Controller?

We are the company Sanctum Lux Divine SRL, with its registered office at Strada Sănătății 9, Clădirea C2, Sat Păuleștii Noi, Comuna Păulești, 107403 Păulești, Romania, registration number (CUI): 47877852, registered in the Commercial Register (Registrul Comerțului) under file no. J29/710/2023, operating services under the trade name "The Path of Initiation Prague" through the website at www.thepathofinitiationprague.com (hereinafter the "Website").

We process your personal data as a controller, i.e. we determine how personal data will be processed and for what purpose, for how long, and we select any additional processors who will assist us with the processing.

Contact Details

If you wish to contact us during the processing, you may reach us by e-mail at: radu@thepathofinitiationprague.com or by phone at: +420 792 908 296.

A Data Protection Officer has not been appointed, as our organisation is not legally required to designate one.

Declaration

We declare that, as the controller of your personal data, we comply with all statutory obligations required by applicable legislation, in particular the Personal Data Protection Act and the GDPR, and therefore that:

• we shall process your personal data only on the basis of a valid legal ground, in particular legitimate interest, performance of a contract, legal obligation or consent granted;
• we fulfil our information obligation pursuant to Article 13 of the GDPR prior to the commencement of the processing of personal data;
• we shall enable you and support you in exercising and fulfilling your rights under the Personal Data Protection Act and the GDPR.

Scope of Personal Data and Purposes of Processing

We process personal data that you provide to us yourself, as well as personal data that we obtain automatically in connection with your visit to our website (in particular through cookies and similar technologies), for the following reasons (to fulfil the following purposes):

Sources of Personal Data

We obtain the majority of data directly from you, in particular when ordering Services, when communicating with us, when subscribing to the newsletter or when otherwise contacting us. Certain data are obtained automatically when you visit the Website through cookies and similar technologies (see the "Cookies“ section below). Depending on the nature of the matter, we may also obtain data from public registers or other publicly available sources.

Third-Party Data

When communicating with us or when using the Services, you may also provide us with data concerning other persons, for example a legal guardian of a minor or a person to whom your matter relates. We use such data only to the extent necessary to handle your matter, perform the contract, comply with legal obligations or protect rights. Where appropriate and feasible given the nature of the matter, please inform such persons that you are providing their data to us.

Provision of Services and Performance of the Contract

We necessarily require your personal data in the following scope: name and surname, e-mail address, telephone number, address (city), information about ordered Services and their progress, for the performance of the contract (e.g. reservation and provision of an Individual Session or Course, communication regarding the date and venue). In the course of providing the Services, we also maintain records of your participation in individual Services, records of your study progress (so-called progression tracking) and written records of communication with you, for the purpose of ensuring continuity and quality of the Services provided. We therefore process such data for the duration of the contract and subsequently for the period necessary to protect our legitimate interests.

Processing of Health Data

In the course of providing the Services, we may process data concerning your health status that you disclose to us (in particular information about ongoing treatment, medications used, addictions, pregnancy, epilepsy, anxiety disorders or other physical or mental indispositions). Such data constitute a special category of personal data within the meaning of Article 9 of the GDPR. The legal basis for their processing is your explicit consent (Article 9(2)(a) of the GDPR), which you grant as part of the ordering process. The purpose of processing is exclusively the assessment of suitability and the safe provision of the Services. We process such data only to the extent necessary for the stated purpose and retain them for the duration of the contractual relationship and subsequently for the duration of the limitation periods (generally 3 years from the provision of the Service, unless otherwise stipulated by law). You may withdraw your consent to the processing of health data at any time; withdrawal of consent shall not affect the lawfulness of processing carried out prior to its withdrawal. However, withdrawal of consent may result in the inability to provide the Service or part thereof, if the processing of such data is necessary for the safe provision of the Service.

Compliance with legal obligations, in particular in connection with tax and accounting legislation.

If you are a customer, we necessarily require your personal data (billing data) in order to comply with various statutory obligations, in particular those relating to the issuance and record-keeping of tax documents. We process personal data for this purpose for the period stipulated by applicable legislation.

Marketing – Sending Newsletters

We use your personal data (e-mail address and name) for the purpose of direct marketing – sending commercial communications. If you are our customer, we do so on the basis of our legitimate interest, as we reasonably assume that our news is of interest to you, for a period of 5 years from the last order. If you are not our customer, we send you newsletters only on the basis of your consent, for a period of 5 years from the granting thereof or until its withdrawal.

Proper Operation of the Website

For this purpose, we process data relating to the use of our website, such as your IP address and browsing data, as well as personal data obtained from so-called necessary cookies (see below in the "Cookies" section). The purpose of processing is to identify you as a visitor when browsing the website or when logging in repeatedly, inter alia to ensure the functioning of our e-shop. The reason for processing is our legitimate interest in ensuring a functional web presentation, and we generally process the data for the duration of your browsing session; however, if we store them for a longer period, it shall be for no more than 2 years.

Customisation of the Website (Preferences)

For this purpose, we process data relating to the use of our website, such as your IP address and browsing data. The purpose of processing is to customise the website to your preferences, such as location, language settings and your device. The reason for processing is our legitimate interest in personalising the website to the specific preferences of customers, and we generally process the data for the duration of your browsing session; however, if we store them for a longer period, it shall be for no more than 2 years. With your consent, we also process personal data obtained from so-called preference cookies for this purpose, which may also involve the transfer of data to third parties (see below in the "Cookies" section), for the period during which we have your consent, but for no more than 2 years from the granting thereof.

Website Traffic Analysis (Statistics)

For this purpose, we process data relating to the use of our website, such as your IP address and browsing data. The purpose of processing is to understand how visitors use our website. The reason for processing is our legitimate interest in obtaining information about the use of our website for the purpose of its further development, and we generally process the data for the duration of your browsing session; however, if we store them for a longer period, it shall be for no more than 2 years. With your consent, we also process personal data obtained from so-called statistical cookies for this purpose, which may also involve the transfer of data to third parties (see below in the "Cookies" section), for the period during which we have your consent, but for no more than 2 years from the granting thereof.

Promotion and Advertising of Products and Services (Marketing)

For this purpose, we process data relating to the use of our website, such as your IP address and browsing data. The purpose of processing is to obtain information for displaying advertising corresponding to the personal preferences of a specific user and to carry out such advertising. The reason for processing is our legitimate interest in promoting the sale of our products and services, and we generally process the data for the duration of your browsing session; however, if we store them for a longer period, it shall be for no more than 2 years. With your consent, we also process personal data obtained from so-called marketing cookies for this purpose, which may also involve the transfer of data to third parties (see below in the "Cookies" section), for the period during which we have your consent, but for no more than 2 years from the granting thereof.

Internal Records and Protection of Our Rights and Interests

For this purpose, we process in particular your identification data, data on the use of products and services or billing data, in order to safeguard our legitimate interests, specifically the maintenance of our internal records and the monitoring of the proper provision of our services, as well as the protection of our rights and legal claims. For this purpose, we process your personal data for the duration of the limitation period, including any period covering its suspension or interruption, but typically for no longer than 15 years after the delivery of goods or the provision of a service or digital content. If judicial, administrative or other proceedings are commenced, we shall process your personal data to the necessary extent also for the entire duration of such proceedings for the purpose of exercising or defending our legal claims.

Photographs and Video Recordings from Seminars

At some of our courses and other services, we produce photographic documentation or video recordings. We use photographs and recordings in promotional materials, primarily on the Website and social media. The legal basis for producing and using such recordings is our legitimate interest in promoting our Services. You will be informed about the production of recordings prior to the commencement of the relevant Service. We never disclose the names of participants in connection with such materials, unless it constitutes a testimonial, and then exclusively on the basis of your consent. You have the right to object to the processing of your personal data for these purposes; if you do not wish to be captured in the recordings, please contact us at our contact details prior to the relevant event.

Is the Provision of Data Mandatory?

Visiting the Website is voluntary. If you wish to order Services, we require at least such data as are necessary for us to process your order. Without them, we may not be able to conclude a contract or provide the Service. We are required by law to process certain data, for example for accounting or tax purposes. Consent to the sending of commercial communications, analytical or marketing cookies or to the processing of health data is voluntary. If you do not grant such consent, this shall not affect your ability to order Services or the basic functionality of the Website.

We retain your personal data for the duration of the limitation periods (generally 3 years; in the case of rights to compensation for damage to health or rights arising from unjust enrichment, up to 15 years), unless the law stipulates a longer retention period or unless we have stated otherwise in specific cases.

Automated Decision-Making and Profiling

While processing your personal data, no automated decision-making or profiling within the meaning of Article 22 of the GDPR takes place that would produce legal effects concerning you or similarly significantly affect you.

Cookies

We use cookies and similar technologies (pixels, tags, local storage and other online identifiers) on the Website. These technologies are stored on your device or work with information stored therein and help ensure the functioning of the Website, its security, analytics and marketing. We use both cookies that are deleted after you leave the Website and cookies that remain on your device for a set period, but for no longer than 2 years.

Types of cookies, what they are used for, and do we need your consent to use them?

• Necessary cookies ensuring the basic functioning, security and correct display of the Website. Without them, the Website may not function properly. We do not need your consent to use them. We use them because they are essential for the operation of the Website.
• Analytical cookies that help us determine how visitors use the Website, which pages are visited and what we should improve. Their use is subject to consent and we use them only with your consent.
• Marketing cookies that help us evaluate advertising and marketing campaigns, measure conversions and display more relevant content or advertising. Their use is subject to consent and we use them only with your consent.

Some of the cookies used are necessary for the proper functioning of our web portal, for example for the purpose of identifying a visitor when browsing the website and when logging in repeatedly, securing their access to the web portal or customising its content and marking content that has already been viewed. If a visitor blocks these cookies in their browser, the website may not function properly and it may not be technically possible to provide them with some of our services. These cookies therefore operate on the basis of our legitimate interest for the purpose of the proper functioning of the web portal, as described above.

Cookies that are not necessary for the proper functioning of the Website may only be used on the basis of your prior consent. In our case, these may include analytical or marketing cookies, the related processing purposes of which are described above. You may consent to them through the so-called cookie bar on the Website. Analytical and marketing cookies are not active until you grant your consent. You may change or withdraw your consent at any time in the cookie settings on the Website. Refusal or withdrawal of consent must be as easy as granting it. If you refuse analytical or marketing cookies, the Website will continue to function for you; however, we will not have as much information about how the Website is used and we will not be able to customise marketing content for you.

You may disable the use of cookies on your computer in your internet browser.

Security and Protection of Personal Data

We protect personal data to the maximum extent possible using modern technologies corresponding to the current state of technical development. We have adopted and maintain technical and organisational measures to secure your personal data within the meaning of Article 32 of the GDPR, which prevent unauthorised access, misuse, damage or destruction of your personal data. These measures include, in particular, encryption of devices and storage, two-factor authentication, a strong password policy, regular data backups and restriction of access to personal data to authorised persons only. We regularly review and update the measures adopted with regard to the current state of technology and the level of risk.

Transfer of Personal Data to Third Parties

Our employees and collaborators, who are bound by confidentiality obligations and have been trained in the area of personal data processing security, may have access to your personal data.

In order to ensure certain specific processing operations that we are unable to carry out on our own, we use the services and applications of processors who specialise in the relevant processing and comply with the GDPR. We also share your personal data with third parties where this is necessary for the performance of the contract or on the basis of our legitimate interest. These include the providers of the following platforms and services:

• Stripe – payment gateway for processing card payments (Stripe does not process personal data on our instructions but as an independent controller; further information can be found in Stripe's privacy policy at stripe.com/privacy)
• Modern Mystery School International Inc. (registered in Canada) – we share your name, contact details and history of completed Services for the purpose of study records and intellectual property rights management; MMS International Inc. processes such data as an independent controller. The transfer of data to Canada is carried out on the basis of a European Commission adequacy decision or standard contractual clauses issued by the European Commission (Article 46(2)(c) of the GDPR)
• Microsoft (OneDrive) – cloud storage for internal records and data retention
• Vercel.com and Google (Gemini) – operation of the AI chat assistant on the Website. Please note that through the chat window on the Website you are communicating with an automated system using artificial intelligence (AI), not with a natural person. Data that you enter into the chat window (in particular the text of your queries) are transferred to Vercel Inc. (USA) and Google LLC (USA) for the purpose of generating responses. The legal basis for this processing is our legitimate interest in providing an information service to Website visitors. Data entered into the chat window are processed for the period necessary to generate a response and may be retained by the service providers in accordance with their own privacy policies. We recommend that you do not enter sensitive personal data into the chat window (in particular health data, financial data, etc.). The transfer of data to the USA is ensured on the basis of the EU-US Data Privacy Framework, provided that the relevant recipient is certified, or alternatively on the basis of standard contractual clauses
• WhatsApp (Meta Platforms, Inc.) – communication platform used for communication with customers; Meta processes personal data as an independent controller; further information can be found in Meta's privacy policy at https://www.whatsapp.com/legal/privacy-policy

It is possible that in the future we may decide to use additional applications or processors to facilitate and improve the quality of processing. However, we undertake that in such case, when selecting processors, we shall impose at least the same requirements for security and quality of processing as we impose on ourselves.

Transfer of Data Outside the European Union

We process data primarily within the European Union or in countries that ensure an adequate level of protection on the basis of a European Commission decision. However, your data may also be transferred to third countries outside the European Union, typically to the companies Modern Mystery School International Inc., Vercel.com, Google or Microsoft, which may have their registered offices or servers outside the EU. In the case of data transfers to the USA, an adequate level of protection may be ensured on the basis of the European Commission's adequacy decision under the EU-US Data Privacy Framework, provided that the relevant recipient is certified. All other transfers of data outside the EU shall be carried out only where an appropriate legal basis exists, in particular a European Commission adequacy decision, standard contractual clauses issued by the European Commission or another appropriate safeguard mechanism within the meaning of Article 46 of the GDPR.

Your Rights in Connection with the Protection of Personal Data

In connection with the protection of personal data, you have a number of rights. If you wish to exercise any of these rights, please contact us by e-mail at: radu@thepathofinitiationprague.com. We shall respond to your request without undue delay, generally no later than within one (1) month. In justified cases, we may extend this period by a further two (2) months in accordance with the GDPR, of which we shall inform you. In order to protect your data, we may verify your identity in a reasonable manner. You have the right to information, which is fulfilled by this information page on the principles of personal data processing.

Right of Access (Article 15 of the GDPR): By virtue of the right of access, you may request at any time that we demonstrate, within a period of one (1) month, what personal data of yours we process and why, as well as information about our processing of such data. In exceptional cases, in particular due to the complexity or number of requests, we are entitled to extend this period by a further two (2) months, of which we shall inform you. If you so request, you may also receive a copy of your personal data: the first copy is free of charge; each additional copy may, however, be subject to a reasonable administrative fee.

Right to Rectification (Article 16 of the GDPR): If your circumstances change or you find your personal data to be inaccurate or incomplete, you have the right to have your personal data supplemented and amended.

Right to Restriction of Processing (Article 18 of the GDPR): You may exercise the right to restriction of processing if you believe that we are processing inaccurate data about you, if you believe that we are carrying out processing unlawfully but you do not wish to have all data erased, or if you have raised an objection to the processing.

You may restrict the scope of personal data or the purposes of processing. (For example, by unsubscribing from the newsletter, you restrict the purpose of processing for the sending of commercial communications.)

Right to Data Portability (Article 20 of the GDPR): You have the right to data portability, i.e. you may obtain from us all your personal data that you yourself have provided to us and that we process on the basis of your consent or on the basis of the performance of a contract, provided that the processing is carried out by automated means. We shall provide such data to you in a structured, commonly used and machine-readable format. You also have the right to request that we transfer such data directly to another controller, where technically feasible.

Right to Object (Article 21 of the GDPR): You may raise objections to the processing of personal data that takes place on the basis of our legitimate interest. Where marketing activities are concerned, we shall cease processing your personal data without further ado; in other cases, we shall do so unless we have compelling legitimate grounds to continue such processing.

Right to Withdraw Consent: Where the processing of your personal data is based on your consent, you have the right to withdraw such consent at any time, without stating a reason. Withdrawal of consent shall not affect the lawfulness of processing based on consent granted prior to its withdrawal. You may withdraw your consent by e-mail at: radu@thepathofinitiationprague.com or through the unsubscribe link in the e-mails sent.

Right to Erasure (Article 17 of the GDPR)

You have the right to request the erasure of your personal data, provided that the statutory conditions set out in Article 17 of the GDPR are met. In such case, we shall erase all your personal data from our system and from the systems of all sub-processors and backups. To ensure the right to erasure, we require a period of one (1) month; in exceptional cases, we are entitled to extend this period by a further two (2) months, of which we shall inform you.

In certain cases, we are bound by a statutory obligation and, for example, must retain issued tax documents for the period stipulated by law. In such case, we shall therefore erase all such personal data that are not subject to another statutory obligation or for which we do not have another purpose for which we may continue to legitimately process them, typically for the establishment, exercise or defence of our legal claims. We shall inform you of the completion of the erasure by e-mail.

Protection of Children's Personal Data

Our Services are primarily intended for adults. As part of our offering, we also provide a baby blessing ceremony for children aged 0–5 years and their mothers; in such case, we process the child's personal data on the basis of the legal guardian's consent. Persons over the age of 15 may participate in our Services and their personal data may be processed on the basis of their own consent. In the case of a person under the age of 15, the processing of personal data on the basis of consent is permissible only if the consent is given or approved by the legal guardian of such person. The participation of a minor (a person under the age of 18) in our Services is conditional upon the consent of their legal guardian and the minor's own will. If we discover that we are processing personal data of a person under the age of 15 without the consent of their legal guardian, we shall take immediate measures to erase such data. In such case, please contact us at the e-mail address: radu@thepathofinitiationprague.com.

Complaint to a Supervisory Authority

If you believe that we are not handling your data in accordance with the law, you have the right, in accordance with Article 77 of the GDPR, to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The lead supervisory authority for our company is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), with its registered office at B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, 010336 București, Romania (www.dataprotection.ro). If you are resident in the Czech Republic, you may also contact the Office for Personal Data Protection (Úřad pro ochranu osobních údajů), with its registered office at Pplk. Sochora 27, 170 00 Prague 7 (www.uoou.cz). A list of supervisory authorities of the Member States is available on the website of the European Data Protection Board (https://edpb.europa.eu/about-edpb/about-edpb/members_en). We would appreciate it if you would first inform us of such suspicion so that we may investigate and remedy any potential shortcomings.

Unsubscribing from Newsletters and Commercial Communications

We send you e-mails with inspiration, articles or products and services, if you are our customer, on the basis of our legitimate interest in accordance with Section 7(3) of Act No. 480/2004 Coll., on Certain Information Society Services. If you are not yet a customer, we send them to you only on the basis of your consent. In both cases, you may unsubscribe from our e-mails by clicking the unsubscribe link in each e-mail sent.

Confidentiality

We wish to assure you that our employees and collaborators who will process your personal data are obliged to maintain confidentiality regarding personal data and regarding security measures the disclosure of which would jeopardise the security of your personal data. This confidentiality obligation shall continue even after the termination of their contractual relationships with us. Without your consent, your personal data shall not be disclosed to any third party beyond the processors specified in this Policy and cases where disclosure is required by applicable legislation.

This Privacy Policy is effective as of 3 August 2026