Retreat Privacy Policy

Last updated 1 October 2026

1. Who we are

OREN Retreats Limited ("we", "us", "our"), company number 17250201, registered at 23 Heol Y Deri, Rhiwbina, Cardiff, CF14 6YF, is the data controller for the personal information you give us when booking and attending a retreat. If you have any questions about this policy or how we handle your information, contact us at retreats@orenwellness.co.uk.

2. The information we collect

We collect and use the following information:

Booking and contact details, including your name, email address, phone number, postal address and date of birth.

Payment information. Payments are collected by Direct Debit through GoCardless. We do not store your full bank details ourselves; these are handled securely by GoCardless.

Health and dietary information that you provide on our health and consent form, including medical conditions, injuries, allergies and dietary requirements.

Emergency contact details.

Passport and identity details, where required by the venue for their pre-arrival guest list.

Your correspondence with us and your marketing preferences.

3. Special category data

Health information is "special category" data under UK data protection law. We collect it only to keep you safe and to deliver the retreat appropriately, and we rely on your explicit consent, and where necessary the protection of your vital interests, to do so. You can withdraw your consent at any time, although we may be unable to let you take part in some activities without the relevant information.

4. How we use your information and why

We use your information to:

Take and manage your booking and payments (to perform our contract with you).

Plan and deliver the retreat safely, including sharing relevant details with the venue and our team (to perform our contract, and to protect your vital interests).

Meet our legal and regulatory obligations, including financial protection and insurance requirements (to comply with a legal obligation).

Send you information about your booking (to perform our contract), and, where you have agreed, send you marketing (with your consent).

5. Who we share it with

We share your information only where necessary, with:

The retreat venue in Spain, for accommodation, catering, dietary needs and their required pre-arrival guest list, which may include passport details.

Our instructors and team delivering the retreat.

Our insurers and ABTOT, where needed for financial protection, insurance or a claim.

GoCardless and our bank, to collect and manage payments.

Professional advisers and relevant authorities, where we are required to do so by law.

We never sell your information.

6. International transfers

Because the retreat takes place in Spain, some of your information, such as your name, dietary needs and, where required, passport details, is shared with the venue there. Where information is transferred outside the UK, we take steps to ensure it is protected to standards equivalent to those required under UK data protection law.

7. How long we keep it

We keep booking and financial records for as long as needed to run the retreat and to meet our legal and tax obligations, which is typically up to six years. Health information is kept only for as long as needed to deliver the retreat safely, and is then securely deleted.

8. Your rights

You have the right to access the personal information we hold about you, to have it corrected or deleted, to restrict or object to how we use it, to data portability, and to withdraw consent where we rely on it. To exercise any of these rights, email us at retreats@orenwellness.co.uk.

9. Marketing

We will only send you marketing where you have agreed to receive it. You can opt out at any time using the unsubscribe link in our emails or by contacting us.

10. Cookies

Our website may use cookies to help it function and to understand how it is used. You can control cookies through your browser settings.

11. Complaints

If you have a concern about how we handle your personal information, please contact us first so we can put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk.

12. Changes to this policy

We may update this policy from time to time. The current version is always available on our website.