Last updated: 16 May 2026

​

• Introduction​

This Privacy Policy explains how Ashraf Mystic (“we”, “us”, “our”) collects, uses, and protects your personal data when you visit this website, contact us, or use our services (including retreats, online sessions, and courses).

We are committed to respecting your privacy and complying with applicable data protection laws, including the EU General Data Protection Regulation (GDPR) and Spanish data protection law.
By using this website or providing your personal data, you acknowledge that you have read and understood this Privacy Policy.

​

• Data Controller

The data controller responsible for your personal data is:

Name / Trade Name: Ashraf Mystic (Asharaph Ali)

Address: Calle Pintor Máximo Ramos, 15403 Ferrol, Spain
Email: ashraf.ali12@gmail.com

​

• Personal Data We Collect

We may collect and process the following categories of personal data:
a) Identification and contact details

• Name and surname

• Email address

• Phone number

• Country or city of residence

b) Booking and service information

• Retreats, sessions, or courses you are interested in or have booked

• Dates, locations, and preferences related to your participation

• Payment‑related information (processed securely by our payment providers; we do not store full card details)

c) Communication data

• Messages you send via contact forms, email, or messaging apps

• Feedback, testimonials, or reviews you choose to share

d) Technical and usage data

• IP address, browser type, and device information

• Pages visited, time and date of visits, and other analytical data collected through cookies or similar technologies

We do not intentionally collect special categories of personal data (such as health data) through the website. If you voluntarily share sensitive information (for example, about your emotional or health situation), it will be treated with strict confidentiality and only for the purpose of providing guidance.

​

• How We Collect Your Data

We collect personal data in the following ways:

• When you fill in forms on the website (contact forms, booking forms, subscription forms)

• When you book a retreat, session, or course

• When you contact us by email, phone, or messaging apps

• When you browse the website (through cookies and similar technologies)

​

• Purposes and Legal Bases for Processing

We process your personal data for the following purposes and legal bases:

a) To respond to your inquiries and requests
Purpose: To answer questions, provide information about retreats, sessions, and courses, and respond to your messages.
Legal basis: Legitimate interest (to respond to your request) and/or pre‑contractual measures (when you ask about our services before booking).
b) To manage bookings and provide services
Purpose: To process your bookings, manage participation in retreats and sessions, and communicate practical details.
Legal basis: Performance of a contract (when you book or purchase a service).
c) To send you updates and communications
Purpose: To send you newsletters, updates about retreats, events, or teachings, and other information that may be of interest.
Legal basis: Consent (when you subscribe or explicitly agree to receive communications). You can withdraw your consent at any time.
d) To improve our website and services
Purpose: To analyze how visitors use the website, improve content, and enhance user experience.
Legal basis: Legitimate interest (to improve our services and website).
e) To comply with legal obligations
Purpose: To comply with accounting, tax, and other legal requirements.
Legal basis: Legal obligation.

​

• How Long We Keep Your Data

We keep your personal data only for as long as necessary for the purposes described above, or as required by law. In general:

• Contact and inquiry data: kept for the time needed to respond and for a reasonable period afterwards.

• Booking and service data: kept for the duration of the contractual relationship and for the legally required retention period (for example, for tax and accounting purposes).

• Newsletter and communication data: kept until you unsubscribe or withdraw your consent.

​

• Sharing Your Data

We do not sell your personal data. We may share your data only with:

• Service providers who help us operate the website, process payments, manage bookings, or send communications (for example, hosting providers, email services, booking platforms). These providers act as data processors and are bound by confidentiality and data protection obligations.

• Public authorities or courts, when required by law or to protect our legal rights.

If we work with providers located outside the European Economic Area (EEA), we will ensure that appropriate safeguards are in place (for example, standard contractual clauses) to protect your data.

​

• International Transfers

Some of our activities and retreats take place in India and other countries. However, your personal data is generally stored and processed within the EEA or in countries with adequate data protection safeguards.
If your data needs to be transferred outside the EEA, we will take appropriate measures to ensure a level of protection consistent with GDPR requirements.

​

• Your Rights

Under GDPR and applicable data protection laws, you have the following rights:

• Right of access: to know whether we process your data and to obtain a copy.

• Right to rectification: to correct inaccurate or incomplete data.

• Right to erasure: to request deletion of your data when it is no longer needed or when processing is unlawful.

• Right to restriction: to request that we limit the processing of your data in certain cases.

• Right to data portability: to receive your data in a structured, commonly used, machine‑readable format and transmit it to another controller, where applicable.

• Right to object: to object to processing based on legitimate interest or direct marketing.

• Right to withdraw consent: when processing is based on your consent, you may withdraw it at any time, without affecting the lawfulness of processing before withdrawal.

To exercise your rights, you can contact us at:
Email: ashraf.ali12@gmail.com
Postal Address: Calle Pintor Máximo Ramos, 15403 Ferrol, Spain
You also have the right to lodge a complaint with a data protection authority, in particular in Spain (Agencia Española de Protección de Datos – AEPD) or in your country of residence.

​

• Cookies and Similar Technologies

This website may use cookies and similar technologies to:

• Enable basic site functions

• Remember your preferences

• Analyze traffic and usage patterns

Where required by law, we will ask for your consent before using non‑essential cookies. For more details, please refer to our Cookie Policy (if available) or the cookie banner settings on the website.

​

• Security Measures

We take appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, misuse, or alteration.
However, no method of transmission over the internet or electronic storage is completely secure. While we strive to protect your data, we cannot guarantee absolute security.

​

• Links to Other Websites

Our website may contain links to third‑party websites (for example, media articles or partner organizations). This Privacy Policy applies only to our website.
We are not responsible for the privacy practices or content of third‑party sites. We recommend that you read their privacy policies before providing any personal data.

​

• Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or services.
The updated version will be published on this page with a new “Last updated” date. We encourage you to review this Policy periodically.

​

• Contact

If you have any questions about this Privacy Policy or how we process your personal data, you can contact us at:
Email: ashraf.ali12@gmail.com
Postal Address: Calle Pintor Máximo Ramos, 15403 Ferrol, Spain