Privacy notice

Boutique Retreat Experiences (“BRE”, “we”, “us”) is a UAE-based entity that designs and operates retreat editions. We are the controller of personal data you submit via this website. Where editions are delivered, certain partners (venues, instructors, operators) act as separate controllers for their own purposes.

The data we collect through this website is limited to what you provide:

• Contact form: name, email, phone (optional), city/region (optional), enquiry type, your message, and (for partner enquiries) studio/company, role, and website.
• Waitlist: name, email, city/region (optional), and a short interest note (optional).
• Consent records: the version of the privacy notice and terms you accepted, the page you accepted them from, and the timestamp.
• Server logs: standard request metadata (IP address, user-agent, referer) used for security, abuse prevention, and rate limiting.

• To respond to your enquiry or partner submission.
• To operate the waitlist and contact you when a relevant edition opens.
• To assess partner fit against current edition scope.
• To prevent abuse, fraud, and spam, and to keep the site secure.
• To meet legal, tax, and regulatory obligations.

We do not use your data to build profiles for advertising, and we do not sell your personal data.

Where applicable, we rely on the following lawful bases: consent (for waitlist registration and direct follow-up to your enquiry); legitimate interests (operating and securing the website, evaluating partner fit); legal obligation (tax, accounting, regulatory).

We share submitted data only with vetted operational providers where needed to run the website, respond to enquiries, manage waitlist records, and deliver confirmed editions.

• Website hosting and delivery: providers that host and deliver the website securely.
• Operational records: systems used to manage enquiries, waitlist records, and internal workflow.
• Internal communications: tools used to route enquiry notifications and essential confirmations.
• Edition delivery partners: only when you confirm a booking, and only the information needed to deliver that edition.

Each provider is expected to apply appropriate data-protection safeguards. We do not authorise operational providers to use submitted data for their own marketing.

BRE operates internationally. Data may be processed in the UAE, the European Economic Area, the United Kingdom, the United States, and other jurisdictions where our providers operate. Where required, we rely on appropriate transfer mechanisms (such as Standard Contractual Clauses) to protect your data.

We keep enquiry and waitlist records for as long as needed to respond to you and to operate the waitlist for upcoming editions, and for a reasonable period afterwards for security and accounting purposes. You can ask us to delete your data at any time (see Your rights).

Depending on where you live, you may have the right to access, correct, delete, restrict, port, or object to our processing of your personal data, and to withdraw consent at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, email hello@boutiqueretreatexperiences.com. We will respond within a reasonable period and in line with applicable law.

We use industry-standard technical and organisational measures to protect your data — encryption in transit, access controls on our CRM and email, rate limiting, and secret management. No system is perfectly secure; we encourage you to send only the information relevant to your enquiry.

BRE editions and this website are intended for adults. We do not knowingly collect personal data from children. If you believe a child has submitted data through this site, contact us and we will delete it.

We may update this notice. The version label and effective date at the top of this page identify the current publication. Material changes will be reflected in an updated version label.

For privacy questions, requests, or complaints, email hello@boutiqueretreatexperiences.com. If you are not satisfied with our response, you may also have the right to complain to a data-protection authority in your country.