Privacy Notice

Purpose of this notice

This is a summary of the privacy policies of Vipassana Trust and Vipassana Trust (Dhamma Sukhakari):

Vipassana Trust

Dhamma Dīpa, Pencoyd, St Owens Cross, Hereford HR2 8NG
uk.dhamma.org/contact/

Vipassana Trust (Dhamma Sukhakari)

Walnut Tree Manor, Haughley Green, Stowmarket, Suffolk IP14 3RQ
uk.dhamma.org/contact/

Where the notice refers to  “The Trust” it can mean either Vipassana Trust or Vipassana Trust (Dhamma Sukhakari).

In this summary we explain who we are, why we need your data, what we do with it and how we help you to exercise your rights with respect to your data.

The Trust aims to take great care when dealing with your data and your rights, in compliance with national and international rules and regulations, especially the General Data Protection Regulation (GDPR).

Who collects your data?

If you apply for a ten-day Vipassana course, or to give service, your data goes through an online application process using a system called CALM (Course Application and Letters Management). Affiliated Vipassana organisations use this registration system to organise meditation courses and voluntary service.

The CALM Foundation (located in Rotterdam, the Netherlands) manages this system and has its own CALM Privacy Policy: myvipassana.calm.dhamma.org/en/privacy_policy_gdpr.

The Trust is responsible for the further processing of this data. After receiving your application, the Trust will use your data to process your request, allocate your place on the course, a room and place for you to meditate and, if necessary, make special provisions for you.

When you arrive for a course, the Trust will collect further information about you on a paper form.

What information we collect

We collect your name, date of birth, gender, profession, medical history including mental health information (as provided by you), any special needs you may have, name of spouse, name of friends who are participating in the course, emergency contact, general contact information, course history, donation details, native language and other languages spoken.

For the duration of the course we may also store the registration number of your vehicle in case it needs to be moved in an emergency.

In addition, if there are reasons why your application may not be accepted, or that your admission to a course should be subject to certain restrictions, prerequisites or qualifications, we may collect this information and the reason why. Such decisions are based on data provided by you, but also on events or the observations made by teachers. Only teachers involved with the assessment have access to such information about you.

Why we need your information

A Vipassana course can be very demanding. With the information you give us, we assess if you are mentally and physically capable of participating in a course.

We then use your information to:

  • plan accommodation, food and transport
  • give you adequate guidance and assistance during the course
  • provide further useful information to you after your course
  • keep financial information for tax reasons or other personal information required by law.

You can also opt in to receive newsletters and announcements about opportunities to serve and other relevant information.

In certain cases, we need to keep personal details when course applicants are considered at risk of harming themselves or others, or the organisation.

How long your data is stored

In CALM, all sensitive information and communication is removed three months after your course is completed. Only some basic information is stored, such as your name and whether you completed a previous course.

If you have been assessed as ineligible for participation in a course in the future, or eligible only under certain restrictions, prerequisites or qualifications, this information is kept for a maximum of 10 years. This period can be extended with each later assessment.

A copy of your application and the physical form that you complete on arrival at the Vipassana centre will be destroyed after seven years by a contracted data-destruction company.

If you participate in a course, the Trust is responsible for storing your data in compliance with national rules and regulations.

In the case of information relating to children’s courses, we are obliged to keep this data for 50 years.

However, we delete all information that we no longer need or are not required to keep.

For further information, please contact the relevant Data Protection Officer (DPO) or Privacy Contact Person (PCP) as below.

How we process your personal information

When we process your personal information, we follow a set of principles:

  1. We use and store your information only in accordance with what we really need and for as long as needed;
  2. We have an overview of all the type of information that is stored;
  3. We will delete your information when it is no longer needed;
  4. We give you access to your information;
  5. We keep your information properly secured;
  6. We only share your personal information within our organisation (this means with Vipassana organisations in the same tradition and with the same goals, provided there are safeguards in place – see below).

The Data Protection Officer (DPO) and Privacy Contact Person (PCP)

The CALM foundation, responsible for the international online registration system, has a Data Protection Officer. Meditation centres that use the system, like the Trust, are responsible for the further processing. Therefore, each meditation centre has a Privacy Contact Person. The Privacy Contact Person co-operates with the Data Protection Officer to protect your data. See the “Contact information” section below.

Special rules for children

Children have a special privacy policy because they are more vulnerable: www.privacy-eu.dhamma.org/children.

Legal grounds

We store personal information only if we have a legitimate reason to hold it and if the law allows us to do so. For example: by consent; under a contract; because of any other legitimate interest such as the vital interests of a student; or because a special law requires us to. We can always inform you of the legal reason for holding your information.

Security

Fellow workers/volunteers who process data for the Trust sign a confidentiality agreement. Only the teachers involved with an assessment have access to very sensitive information (they will also have signed a confidentiality agreement). Your personal information is kept securely and is not in any circumstances disclosed to a third party unless the third party is specifically authorised to receive that information.

Personal data is:

  • stored in a locked room with controlled access; and/or
  • stored in a locked drawer or filing cabinet; and/or
  • if computerised, password-protected in line with corporate requirements in the Access Control Policy; and/or
  • if stored on removable computer media, encrypted; and/or
  • anonymised or pseudonymised, wherever possible.

PC screens and terminals used for processing data are not visible, except to authorised fellow workers/volunteers. Physical records may not be left where they can be accessed by unauthorised personnel and may not be removed from the workplace without explicit authorisation. As soon as manual records are no longer required, they are removed for secure archiving.

Your rights

We respect your rights. More specifically, we ensure that:

  1. We can provide an overview of all the information we keep about you.
  2. Your information is correct.
  3. Information is corrected and/or removed at your request, unless we have a legal ground to process the information without your consent. You have a right to object to our decision.
  4. You have the option to object to the processing of your data to the appeals committee – our so-called “Special Cases Committee.”
  5. Your right to file a complaint at the Data Protection Authority is upheld.

To exercise your rights, please see the “Contact information” section below for details of the Data Protection Officer and Privacy Contact Person.

Access to information and objections to processing

If you:

  1. Want to find out what information we keep about you;
  2. Disagree with the data we keep;
  3. Object to our processing of your data;

you can fill in the form on this page: www.privacy-eu.dhamma.org/what-are-your-rights/ or view the contact details at the end of this notice.

Data breaches

If there is a breach that may have repercussions for you, we will inform you and, if necessary, the Data Protection Authority. If you would like to report a breach, please see: www.privacy-eu.dhamma.org/report-a-data-breach/.

International safeguards

Whenever we share your personal information with a Vipassana organisation outside the European Union, we apply additional safeguards.

To learn more about the safeguards applied in your specific case, please contact us.

In case you ask us to provide data to an organisation without adequate safeguards, we will inform you about the risks. You can then decide whether to provide the information.

Cookies and other technologies we use

Cookies

A “cookie” is a text file containing a small amount of information which our server downloads to your personal computer when you visit our website. The file contains a unique number so that our server knows which computer it is talking to.

Some cookies are allocated to your computer only for the duration of your visit to a website, and these are called session-based cookies. These are automatically deleted when you close your browser.

We create a session-based cookie when you use our online Application Form to register for a course. We also use a session-based cookie to know whether you have logged in as an Old Student or not. You may refuse the use of cookies by selecting the appropriate settings on your browser, however, please note that if you do this you may not be able to take advantage of the full functionality of our websites.

Google Analytics

We use Google Analytics to measure traffic on our websites. This is a web analytics service provided by Google, Inc. (“Google”). Google Analytics uses “cookies”, which are text files placed on your computer, to help us analyse how our sites are used. The information generated by the cookie about your use of the website (including your IP address) will be transmitted to and stored by Google on servers in the United States.

Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage.

Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. Google will not associate your IP address with any other data held by Google. If you’d like to opt out of tracking by Google Analytics, visit the Google Analytics opt-out page: tools.google.com/dlpage/gaoptout. Google has their own Privacy Policy which you can review here: support.google.com/analytics/answer/6004245.

By using this website, you consent to the processing of data about you by Google in the manner and for the purposes set out above.

Contact information

If you have any questions or would like to contact the Privacy Contact Person or the Data Protection Officer, you can contact any of them at: [email protected] or via www.privacy-eu.dhamma.org.

If you remain dissatisfied about the way we process your personal information, you can also contact the Data Protection Authority: ico.org.uk/global/contact-us/