This policy explains how personal data is handled when you visit the Embodied Living website, join our community, purchase a membership, subscribe to emails or contact us.

1. Who is responsible for your information?

Embodied Living is operated by Balance Room AB, which is the data controller for the processing described in this policy.

Balance Room AB
Organisation number: 559366-3684

Postal address:
Kongsgade 22A
211 49 Malmö, Sweden

Email: info@balanceroom.se
Telephone: +46 40 400 144

Please contact us with questions about your personal data or to exercise your privacy rights.

2. Information we process

Depending on how you use Embodied Living, we may process:

• Your name, email address and other contact details you provide.

• Your profile picture, biography and optional profile information.

• Membership details, purchases, payment status and transaction records.

• Posts, comments, messages and other contributions you make within the community.

• Event registrations, attendance and practice or course activity made available through the platform.

• Messages you send us by email, forms or community messaging.

• Technical information, such as IP address, browser, device and website or platform activity.

• Your communication preferences and consent choices.

• Your voice, image or contributions where you agree to participate in a recording.

Information comes directly from you and from the platforms used to provide the website, community and payments.

3. Why we use your information

We use personal data to:

• Create and manage your account and membership.

• Provide access to practices, live sessions and community features.

• Process payments and maintain accounting records.

• Send membership information, programme updates and service messages.

• Answer questions and provide support.

• Facilitate community participation and address inappropriate behaviour.

• Maintain security and resolve technical problems.

• Send newsletters and promotional emails where you have subscribed.

• Provide session recordings under the arrangements explained to participants.

4. Our legal bases

We rely on the following legal bases, depending on the purpose:

Contract: To provide your membership, administer payments and deliver the services you have requested.

Legal obligation: To meet accounting requirements and other applicable legal duties.

Legitimate interests: To answer enquiries, protect accounts, moderate the community and maintain a functioning service. We consider these interests alongside your rights and reasonable expectations.

Consent: For optional newsletters, non-essential cookies and recordings or other uses that require your permission. You may withdraw consent at any time, without affecting the lawfulness of processing already carried out.

Information required to create an account, provide membership access or process payment is necessary for those services. Other profile information and personal contributions are optional.

Accepting membership terms or entering payment details does not, by itself, constitute consent to optional processing such as including your personal contributions in a replay.

5. Your profile and community contributions

Your profile and contributions may be visible to other members according to the space, feature and audience settings in Mighty Networks. Please consider the audience before posting or completing optional profile fields.

The hosts, Kirstine Ilum and Jenny Viktorsson, and authorised administrators may access information necessary to run the community, provide support and moderate activity.

Members must keep other members’ posts, comments, images, personal experiences and identifying information within the community. Copying, forwarding, publishing or sharing these outside Embodied Living is prohibited.

Members must not record sessions, photograph their screens or take screenshots or screen recordings of teaching materials, community content or other participants.

These rules help protect privacy, although an online community cannot guarantee that every participant will comply. Please contact the hosts if you have concerns about a privacy breach or something you have shared.

6. Personal and sensitive information

Personal reflections may sometimes include information about physical or mental health or other sensitive matters.

You can participate without disclosing diagnoses, trauma histories or other sensitive details. Please avoid posting identifying information about other people.

Where we invite or otherwise process sensitive personal data, we must have a valid legal basis and an additional condition under data protection law. Where this is explicit consent, we will explain the purpose, audience and use and ask for that consent separately.

Accepting this Privacy Policy does not, by itself, constitute explicit consent to process sensitive personal data.

7. Live sessions and recordings

Classes and guided practices

Recording begins after the welcome and any initial conversation with participants. Only the host is included in the published replay; participants’ images, voices and initial contributions are excluded.

Circles and participant contributions

For circles and other sessions involving participant contributions, we explain any recording arrangements beforehand, including what will be captured, who can access the recording and its intended use.

Where consent is required to include your image, voice or personal contribution, we ask for it separately and retain a record of your response. Consent may be given through a clear written statement or a recorded verbal agreement.

We explain the available ways to participate without appearing in a recording. Choosing to speak during a session does not, by itself, give permission for your contribution to be included in a replay.

Taking part in Embodied Living does not give us general permission to use your contributions in promotional material. Any such use requires a separate agreement.

You may contact us to withdraw consent relating to a recording. We will explain and take the steps applicable to your request. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

8. Platforms and service providers

We use external providers to deliver Embodied Living. These may include:

• Squarespace: Website hosting and website forms.

• Mighty Networks: Accounts, membership access and community features.

• Stripe and any payment provider identified at checkout: Payment processing.

• Kit, formerly ConvertKit: Email subscriptions and newsletters.

• Zoom: Live online sessions.

• Vimeo: Hosting practice videos.

Providers receive or process information relevant to the services they supply. Some act as our data processors; others also have independent responsibilities for certain processing, such as payment compliance or platform security.

Payment card details are entered through the payment provider. We receive the transaction and membership information needed to administer your purchase.

We do not sell your personal information. Information may also be disclosed where required by law or necessary to establish, exercise or defend legal claims.

9. Processing outside the EU/EEA

Some providers and their subcontractors process personal data outside the EU/EEA, including in the United States.

Where such transfers occur, they must be supported by an applicable legal transfer mechanism, such as an adequacy decision or the European Commission’s Standard Contractual Clauses, together with additional safeguards where necessary.

You can contact us for information about the safeguards relevant to your data and how to obtain a copy.

10. Emails and newsletters

Membership and service emails provide information needed to use your membership, such as account updates, payment information and changes to the service.

If you subscribe to a newsletter, we use your contact details to send the communication you requested. You can unsubscribe using the link in those emails.

Community notifications can be adjusted through your Mighty Networks account. Unsubscribing from promotional emails does not cancel your membership.

11. Cookies and embedded content

The website and community use cookies or similar technologies for functions such as signing in, security and remembering preferences.

Optional analytics or marketing technologies require consent where applicable. Your choices can be managed through the relevant cookie settings.

Embedded videos and other external content may involve processing by their providers. Where consent is required, that content should only load after the relevant choice has been made.

12. How long we keep information

Retention depends on the purpose and any legal requirements:

• Account and membership information: Kept while needed to provide and administer your access. Cancelling paid membership does not necessarily delete your community account or contributions. You can contact us about account deletion.

• Posts and comments: May remain available while relevant to the community, subject to deletion requests and applicable law.

• Enquiries: Kept while needed to resolve the matter and handle any related complaint.

• Newsletter information: Kept until you unsubscribe using the link in our emails. A minimal record may then be retained to ensure you remain unsubscribed.

• Accounting records: Retained for the period required by Swedish law.

• Recordings containing personal data: Kept for the purpose and period explained when they are made.

• Consent records: Kept as necessary to document your choices and meet our accountability obligations.

Information is deleted or anonymised when it is no longer needed. Limited records may be retained where necessary to meet legal duties or handle legal claims. Backup deletion follows the relevant provider’s retention procedures.

13. Your rights

Depending on the circumstances, you may have the right to:

• Access your personal data.

• Correct inaccurate information.

• Request deletion.

• Request restriction of processing.

• Object to processing based on legitimate interests.

• Receive certain information in a portable format.

• Withdraw consent.

You can object to direct marketing at any time.

To exercise your rights, email info@balanceroom.se. We may need to verify your identity before responding. We normally respond within one month; if a lawful extension is necessary, we will explain why.

You also have the right to complain to Integritetsskyddsmyndigheten, the Swedish Authority for Privacy Protection, at www.imy.se, or to your local supervisory authority.

14. Security

We use appropriate technical and organisational measures to protect personal data and limit administrative access to people who need it for their work.

Please keep your login details private and contact us if you suspect unauthorised access to your account.

15. Changes to this policy

We may update this policy when our services, providers or legal obligations change. The current version will be available on this page. We will communicate significant changes where appropriate.