Data Processing Addendum
This page lists the service providers ("subprocessors") that process personal data on behalf of YOGSPACE LTD (company number 17485142, registered in England and Wales, registered office 128 City Road, London EC1V 2NX, United Kingdom), and explains how Instructors are bound when they handle student data. It supplements our Privacy Policy and does not replace it.
Our subprocessors
| Subprocessor | What it does for us | Data it handles |
|---|---|---|
| Supabase | Database, sign-in and file storage for the whole Platform (AWS eu-west region) | Account and profile data, bookings, intake and health answers, consent records, messages, uploaded documents and images |
| Vercel | Hosting the website and app | Technical data (IP address, request logs) |
| Stripe | Card payments, refunds and Instructor payouts. Stripe acts as our payment processor, not as the seller | Payment and billing details, transaction history, Instructor payout account details |
| Wise | Instructor payouts | Instructor bank details, payout amounts and transfer records |
| Daily | Live video Sessions | Names shown in the call, join and leave times, live audio and video (not recorded) |
| Zoom | Live video Sessions booked before we moved to Daily, or where Zoom is selected | Names shown in the call, join and leave times, live audio and video (not recorded) |
| Resend | Sending transactional emails | Email address, name and email content (never health answers) |
| Sign in with Google, if you choose it | Name, email address and profile picture |
How data is protected
Each subprocessor is bound by a written data processing agreement that limits it to processing data on our instructions and requires appropriate security. Where data is transferred outside the UK or the European Economic Area, we rely on an adequacy decision, the UK-US data bridge for certified providers, or the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.
Hosting region
Our database, including intake and health answers, is hosted by Supabase on Amazon Web Services in the eu-west region (Europe).
Instructors and intake health information
YOGSPACE LTD is the controller of Students' intake answers, including health information: it decides which questions are asked, collects and stores the answers, and decides who sees them. Instructors are independent professionals, not employees; for intake data they act as recipients on YogSpace's behalf and only on its instructions. When a Student books, the Instructor receives the Student's name, booking details and intake answers, and health answers only where the Student chose to share them and gave explicit consent (otherwise only the fact that the Student chose not to share), only for that booking and only until 24 hours after the class. Many Instructors are based outside the UK and the EU, including in India.
Every Instructor must accept our Instructor Agreement, which requires them to:
- use intake data only to prepare and deliver the booked Session;
- not copy or export it (no screenshots, downloads, notes in other apps or messaging);
- not use it for anything else;
- delete anything they hold outside the Platform after the Session, within 24 hours at the latest;
- report any loss or leak to YogSpace within 24 hours;
- keep it confidential and secure, and pass Students' data requests to us;
- comply with the EU Standard Contractual Clauses (Module Two, controller to processor) and the UK International Data Transfer Addendum where the Instructor is outside the UK or EEA.
Health answers are never sent by email and are not shared with our video providers.
Changes to this list
We will update this page before we add or replace a subprocessor. Material changes to how your data is handled will also be reflected in our Privacy Policy.
Questions
Email support@yogspace.com with "Privacy" in the subject line.