Privacy Policy
Last updated: September 30, 2026
This policy explains what personal data is collected on this site, why, for how long, and what rights you can exercise. It applies to the website warrenshanti.com and the services offered there. It supplements the legal notice and the terms and conditions of sale.
The processing described here is implemented in compliance with Regulation (EU) 2016/679 of April 27, 2016, known as the “General Data Protection Regulation” or “GDPR,” supplemented by the German Federal Data Protection Act (BDSG), as the data controller is established in Germany, and, for individuals residing in France, by the French Data Protection Act (Loi Informatique et Libertés). Personal data means any information relating to an identified or identifiable natural person.
1. Data Controller
The data controller is Warren Ruiz, trading as “Warren Shanti,” site publisher.
Address: Hörder Strasse 323, 58454 Witten, Germany.
Email address: contact@warrenshanti.com.
Phone: +33 7 85 84 03 49.
Other information about the publisher can be found in the legal notice.
2. Data Collected and Purposes
The data processed is limited to what is necessary. Most of it is data you provide yourself when you place an order, register, or write to us. Technical data generated by visiting any page is also included, as described at the end of this list. No so-called sensitive data is requested when ordering.
- Order for a workshop, retreat, or digital content: your name, email address, and billing information requested by the order form, necessary to manage the order, issue the invoice, send you confirmation by email, provide access to purchased content, and send you practical information. Legal basis: performance of the contract and, for invoicing and retention of accounting records, compliance with our legal obligations.
- Payment: bank details are entered directly into Stripe’s secure fields and are never stored on this site. If you choose Klarna (deferred or installment payment, subject to eligibility), offered via Stripe, your data is processed by Klarna according to its own terms and privacy policy, including to assess your eligibility for this payment method. Legal basis: performance of the contract.
- Customer area: SureCart gives you access to a customer area where your orders and invoices are grouped. Your login credentials and order history are stored there. Legal basis: performance of the contract.
- Newsletter: the data entered in the registration form, at minimum your email address. Legal basis: your consent, which can be withdrawn at any time (see Article 8).
- Member area and community: your login credentials and the content you publish. The community is hosted on the site itself, with the same host. Legal basis: performance of the contract.
- Community Member Map: If you request it by checking the designated box, your displayed name (first name and initial, or pseudonym), your city or region, your country, an optional phrase, and your profile picture, if you have one, will appear on a map visible only to logged-in community members, with a link to your profile. Your point is placed at the center of your municipality or region, offset by a few kilometers: no address is requested. The date and version of the text you have accepted are retained. The map is restricted to individuals aged 16 or over. Legal basis: your consent, which you may withdraw at any time by deleting your entry from the map page.
- Messages addressed to us: your contact details and the content of the message, to respond to it and follow up. Legal basis: legitimate interest in processing received requests.
- Supporting document submitted with a cancellation request: the terms and conditions of sale provide that supporting documentation may be requested in cases of force majeure. Such a document is used solely to process the request in question. When it contains information about your health or that of a relative, it is processed only with your explicit consent, which you express by submitting it on your own initiative; you may submit only the strictly necessary elements, for example a certificate without mention of the diagnosis. Legal basis: performance of the contract and, for health information, your explicit consent, which you can withdraw at any time.
- Technical data: each time a page is visited, the server records in its logs your IP address, the date and time of access, and the pages visited, to ensure the security and proper functioning of the site. Legal basis: legitimate interest in securing the service.
- Resources loaded from third-party servers: the site’s fonts, Inter Tight and Outfit, are provided by Google Fonts, and the newsletter form script is loaded from Kit’s servers on all pages. Displaying a page therefore transmits your IP address to Google and Kit, whether you are a subscriber or not (see Article 3). Legal basis: legitimate interest in displaying the site consistently and offering newsletter registration.
The data requested when placing an order, registering for the community, or subscribing to the newsletter is necessary for the corresponding service: without it, the order, access, or sending cannot take place. No information is requested from you for simply visiting the site.
3. Recipients and Processors
Your data is not sold, traded, or transferred to third parties for commercial purposes. It is accessible to the publisher and, solely for service needs, to the following providers:
- Nexcess, a brand of Liquid Web, LLC (2703 Ena Drive, Lansing, Michigan 48917, United States), which hosts the site and stores the database and files, including community accounts and posts, on a server located in the United Kingdom.
- SureCart (United States), which manages the shop, orders, invoices, customer area, and sending of order emails.
- Stripe (Stripe Payments Europe, Ltd., Ireland), which processes credit card payments, payment via Klarna and, where applicable, other payment methods it offers, and which provides payment fraud prevention.
- Kit (formerly ConvertKit, United States), which hosts the newsletter registration form and handles sending. Its script is loaded from its servers on all pages of the site: displaying a page transmits your IP address to it, whether you are a subscriber or not.
- Google Fonts (Google Ireland Ltd, Ireland), whose servers provide the site’s fonts, Inter Tight and Outfit: displaying a page transmits your IP address to Google.
- OpenStreetMap Foundation (United Kingdom), through its Nominatim geocoding service: to place a city on the member map, the site’s server transmits only the entered city name and country, without your name or IP address. The base map is hosted on the site’s server: displaying the map does not transmit any data to a third party.
- Monarobase (France), which hosts the contact@warrenshanti.com email, where messages you send us are received and stored.
Two services also process your data under their own responsibility, and not on behalf of the site: Klarna, if you choose this payment method offered via Stripe, and Skool (United States), an external platform that hosts the online school and to which the site only links. If you register there, the subscription is managed by Skool and your data is processed there according to that service’s own privacy policy.
Order emails are sent by SureCart and the newsletter by Kit. Other emails related to site operation, such as password reset, are sent from the site’s server or from the publisher’s email, both described above.
Your data may also be disclosed to administrative or judicial authorities when required by law.
4. Transfers Outside the European Union
The site is hosted on a server located in the United Kingdom, where the OpenStreetMap Foundation, which is used for the member map, is also established. These transfers are covered by the European Commission’s adequacy decision, which recognizes an adequate level of protection for this country.
SureCart and Kit are established in the United States. Stripe Payments Europe, Ltd. and Google Ireland Ltd are established in Ireland, but may process certain data in the United States. These transfers rely on the safeguards provided by the GDPR: certification under the EU–U.S. Data Privacy Framework or the European Commission’s standard contractual clauses, depending on the provider. You can request details at contact@warrenshanti.com.
Skool, which you join directly, is also established in the United States: the data you provide when registering there is subject to its own terms.
5. Retention Periods
- Order data and invoices: for the period required by applicable accounting and tax obligations, from the end of the relevant fiscal year.
- Newsletter: until you withdraw your consent, then removal from the mailing list.
- Member account, community, and customer area: for the duration of your registration, then deletion after account closure; order data remains stored for the period indicated above.
- Member Map: until you delete your entry, or until your account is deleted.
- Messages received: the time necessary to process the request and any resulting follow-up.
- Cancellation supporting document: the time needed to process the request in question, then deletion; only the outcome of the request is retained with the order data.
- Technical logs: for a limited period, not exceeding what is necessary for detecting and analyzing security incidents.
- Cookies and local storage: the durations are listed in Article 9.
Beyond these periods, data necessary for establishing, exercising, or defending a legal claim may be retained in archive form, with restricted access, for the applicable limitation periods.
6. Security
The site is served via HTTPS and administrative access is restricted. Appropriate technical and organizational measures are implemented to protect your data against loss, alteration, and unauthorized access. However, as no measure is infallible, absolute security cannot be guaranteed.
7. Your Rights
In accordance with the GDPR (Articles 7 and 15 to 22), you have the right to access, rectify, erase, and port your data, as well as the right to restrict processing and withdraw your consent at any time. When processing is based on our legitimate interest, you may also object to it for reasons relating to your particular situation. If you reside in France, you may also define directives on the fate of your data after your death (Article 85 of the French Data Protection Act).
To exercise these rights, write to contact@warrenshanti.com or by mail to the address indicated in Article 1. Exercising them is free, except for manifestly unfounded or excessive requests. A response will be provided within one month, which may be extended by two months in the case of a complex request; you would then be informed. Proof of identity may be requested in case of reasonable doubt about the requester’s identity.
Withdrawing your consent does not affect the lawfulness of processing carried out before such withdrawal. The publisher does not make any decision based exclusively on automated processing that produces legal effects concerning you.
8. Newsletter
You only receive the newsletter if you have subscribed to it, using the form provided for this purpose on the site. This form is hosted by Kit, which also handles sending. Registration is based on your consent.
You can unsubscribe at any time, via the link at the bottom of each mailing or by writing to contact@warrenshanti.com. Your address is then removed from the mailing list.
The Kit script is loaded on all pages of the site; this loading transmits your IP address to Kit on each page visited, as indicated in Article 3. When you open the site from a link in a newsletter, this script also records a subscriber identifier, called “ckid,” in your browser’s local storage, to link your visit to your subscription. During an ordinary visit, no identifier is recorded. You can avoid this tracking by accessing the site other than through email links, or by clearing your browser’s local storage. This identifier is described with the other storage in Article 9.
9. Cookies and local storage
Simply visiting the site does not set any audience measurement or advertising cookies. The site uses no audience measurement tool, no advertising tracker, and no embedded social network button.
The cookies and local storage it uses are, with one exception, those required for the operation of the services you request: remembering the chosen language, keeping an order in progress, maintaining your session when you are logged into an account, or securing payment. As such, they are exempt from prior consent. The exception is the Kit subscriber identifier, described in Article 8 and below.
Cookies
- wp-wpml_current_language (the site, via its WPML translation module): remembers the chosen display language. Duration: the browsing session.
- __stripe_mid and __stripe_sid (Stripe): payment fraud prevention. They are set on warrenshanti.com when Stripe’s payment module is loaded, i.e., on the payment page and in the customer area. Duration: one year for the first, thirty minutes for the second.
- wordpress_logged_in_*, wordpress_sec_*, and wordpress_test_cookie (the site): maintain your session when you are logged into an account, for the member area, community, or administration. Duration: the session, or fourteen days if you selected “Remember me.”
- wp-settings-* (the site): remember your display preferences when you are logged in. Duration: one year.
Local storage
Local storage is information recorded by your browser on your device, without being sent back to the server on each page. It is kept until you delete it.
- surecart-local-storage (SureCart): keeps the order in progress. Duration: until deletion.
- ckid (Kit): subscriber identifier, recorded only when you arrive at the site from a newsletter link, to link the visit to the subscriber (see Article 8). It is not necessary for displaying the site. Duration: until deletion.
Absence of consent banner
This site does not display a consent banner: it uses no audience measurement, no advertising tracker, and the cookies and storage described above, with the exception of the Kit identifier, are necessary for the services you request. This identifier is recorded only following the opening of a link from a newsletter to which you are subscribed; you can avoid or delete it as indicated in Article 8. If a tool subject to consent were to be added, this policy would be updated and your agreement would be requested beforehand.
Manage cookies in your browser
You can configure your browser to refuse or delete cookies, and clear local storage. However, refusing necessary cookies and clearing local storage may prevent ordering and logging into an account from working, and hinder payment. The CNIL explains how to configure the main browsers on its website www.cnil.fr.
10. Complaint to a supervisory authority
You may at any time lodge a complaint with a supervisory authority, without prior contact with us. However, we invite you to write to us first at contact@warrenshanti.com: most difficulties are resolved directly.
As the data controller is established in Bochum, the competent authority in its regard is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), the data protection authority of the state of North Rhine-Westphalia.
If you reside in France, you may also contact the Commission nationale de l’informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or via its website www.cnil.fr. More generally, you may contact the supervisory authority of the Member State of your habitual residence, your place of work, or the place where the alleged infringement occurred.
11. Modification of this policy
This policy may be modified to reflect changes to the site, its providers, or regulations. The date of last update appears at the top of this page.
