Privacy policy

Who we are

We are Certified Spaces (certifiedspaces.org) (“we”, “us”). We are the controller of the personal information described here.

Human Garage Certified Spaces issues the seal.

For anything about your personal information, email jordan@humangarage.net.

The short version

• You can read the whole site without giving us anything.
• Our code sets no cookies. We run no advertising scripts, social media pixels, session recording or cross-site tracking, and we do not try to recognise your device.
• We count visits as daily totals: which pages, which places, which links out. The totals hold nothing that identifies you.
• We only get personal information when you send it to us: through a form or by email. Each form says what it is for, and asks your permission to reply.
• Places you save stay in your own browser. We never receive them.
• We take no payments on this site, and we do not sell personal information.

What we collect, and why

1. The retreat list on Community

When you join the list, we save your email address, whether you joined as a guest or a host, and your answers to the two permission boxes, privately in our Cloudflare database.

• Why: guests, to email you when new retreats and gatherings are listed; hosts, to tell you when you can add your own dates. Other updates only if you tick the second box.
• Legal basis: your consent. You can withdraw it at any time by emailing jordan@humangarage.net, or by replying to any email we send.
• Kept: for up to 24 months, or until you ask us to remove it, then removed within 30 days.

2. Ask us about a place

When you ask about a place, we save your question, the place, when you are thinking of going if you say, your email address, your first name if you give it, and your permission choices, in the same database.

• Why: to answer you by email. We may ask the place on your behalf; if we do, we send your question, not your contact details, unless you ask us to.
• Legal basis: your consent to a reply, which the form asks for.
• Kept: 24 months from your question.

3. Properties and retreat leaders

The two forms on For properties save your email address, any first name, the property’s name and link or a note about your retreat, and your permission choices, in the same database. A property’s right of reply, with any documents, is sent through a form on Jotform’s site, or by email.

• Why: to list the property, to correct its record, or to talk about your retreat.
• Legal basis: your consent to a reply for the two forms; for a right of reply, our legitimate interest in keeping records accurate.
• Kept: 24 months after the last contact. Evidence we cite on a record is kept as part of that record’s history, without the sender’s personal details.

4. Assessment property check forms

Properties preparing for a Human Garage Certified Spaces assessment fill in forms, hosted by Jotform, that we send them directly. These collect names, email addresses, phone or WhatsApp numbers, postal addresses, photographs and details about the property.

• Why: to prepare and carry out an assessment and to talk to the property about it.
• Legal basis: taking steps at the property’s request before a contract, and performing that contract.
• Kept: for the life of the certification and 6 years after it ends. Contact details no longer needed are deleted sooner on request.

5. Email

If you email us, we receive your email address, name and whatever you write or attach.

• Why and basis: to reply and keep records accurate; our legitimate interest in answering you.
• Kept: 24 months from the last message.

When you send a form

Every form here saves only after you press send, and shows you a reference once it is saved. If you arrived through one of our tagged links (see below), the tag is saved with what you send, so we can see which post brought you. Nothing else about your visit is attached.

What we count

Our own counters. When a page opens, your browser tells our server which page it was. On a place or retreat page it says which one. When you click through to a place’s or a host’s own site, it says which. It also says when a search ran, a filter changed, the map opened, a place was saved or a form was sent, but never what you searched for, which filter, or what you typed. We add one to a daily total for each.

On the first page you open, we also count the website that linked you here, by its name only (such as instagram.com), never the page or its address.

The totals hold no identifier, no IP address, no browser details and nothing stored on your device. We keep them indefinitely.

Campaign links. Some links to this site carry tags in the address, such as utm_source=certifiedspaces. We and Human Garage put them in our posts, videos and emails; coaches get links marked with a code rather than their name. If you arrive on one, we count the visit against that tag, and again if you click through to a place or send a form. Tags that do not match our format are not counted or kept. Our code holds the tag in this tab’s session storage, never a cookie, and it is gone when you close the tab.

Links out. When you click through to a place’s or a host’s site, the link carries three tags (utm_source, utm_medium and utm_campaign) so they can see the visit came from Certified Spaces. The tags name this site and carry nothing about you.

Cloudflare Web Analytics. Cloudflare also counts page views for us, with a small script it adds to each page. For each view it records the page, the site that linked you here, your country, your browser, operating system and device type, and how fast the page loaded. It uses no cookies or local storage. Cloudflare says it does not use your IP address or browser details to recognise you.

Abuse limits and errors. Our server reads your IP address to limit how many forms and counts one address can send in a minute. It is not saved. When something on our server fails, Cloudflare records the error and the request for up to 7 days so we can fix it.

• Legal basis: our legitimate interest in running a secure site and knowing which pages, places and links are used.

Content from other sites. Some parts load from other servers, which then receive your IP address and browser details: the type faces (Google Fonts), the world map (OpenFreeMap, tiles.openfreemap.org) and its code (jsDelivr), and a video only after you tap to play it (YouTube’s privacy-enhanced mode, youtube-nocookie.com).

Cookies and your browser

Our code sets no cookies. We do not use advertising, social media pixels or cross-site tracking. If that ever changes, we will update this page and ask for your consent first.

The site keeps a few things in your browser’s own storage so it works as you left it: the places you save, the colour theme and view you chose, and whether you joined the list. They are never sent to us. Clearing this site’s data in your browser removes them.

The right-of-reply form opens on Jotform’s site, and Jotform may set its own cookies there. Jotform’s privacy policy covers those.

Who handles your information for us

We do not sell personal information, and we do not share it for advertising.

• Cloudflare, Inc. hosts the website and our database, counts visits and delivers the alert emails we receive about new forms.
• Google (Google Workspace) hosts our email: emails you send us and our replies.
• Jotform Inc. hosts the right-of-reply and assessment forms: anything you enter in them.

We may also share information if the law requires it, or to protect our rights in a dispute.

International transfers

Some of these providers process data outside the EU and UK, including in the United States. Where they do, the transfer relies on the safeguards the provider offers, such as the EU-US Data Privacy Framework and its UK extension where the provider is certified, or the European Commission’s standard contractual clauses and the UK addendum.

Places listed here

Records describe places, which are businesses. They are built from what a place publishes, what it sends us and, for certified places, what is found on site.

Where a record names a person, it is because the place names them publicly in that role, or asked us to. Anyone named can ask us to correct their details or remove their personal contact details, by emailing jordan@humangarage.net. That does not remove the record of the place itself.

Your rights

If you are in the EU, the UK or another place with similar laws, you have the right to:

• access the personal information we hold about you;
• correct it if it is wrong;
• delete it;
• object to our using it on the basis of legitimate interest;
• restrict how we use it while a question is sorted out;
• take a copy of information you gave us, in a common format;
• withdraw consent at any time, where we rely on consent.

Email jordan@humangarage.net. We will reply within one month. We may ask you to confirm who you are first. There is no charge.

You can also complain to a data protection authority: in the EU, the authority in the country where you live; in the UK, the Information Commissioner’s Office (ico.org.uk). We would like the chance to fix it first.

Children

The site is not aimed at children under 16, and we do not knowingly collect their information.

Security

Forms are sent over an encrypted connection. Only the people who run Certified Spaces can read what you send and our email. The providers named above hold it on our behalf.

Changes

We will post any change to this page and update the date at the top. If a change affects how we use information you have already given us, we will email you where we can.

See also our terms of use.