A Sun Ritual
back Legal

Privacy Policy

Last updated: 21 October 2026

1. Controller

AHASH ONE OÜ
Sepapaja 6, 15551 Tallinn, Estonia
Registry code: 17145116
VAT ID: EE102833379
Managing director: Khashayar Voshmgir
Email: [email protected]
Phone: +43 699 13570707

The mailbox runs on Google Workspace.

This policy explains what personal data is processed when you visit asunritual.com, subscribe to our letter, register for an event or contact us, on what legal basis, and what rights you have. It is based on the EU General Data Protection Regulation (GDPR) and applicable Estonian law.

2. Hosting and Cloudflare

This website is hosted and delivered by Cloudflare (Cloudflare Pages, DNS, content delivery and protection against attacks). Cloudflare processes technical data your browser transmits, such as IP address, date and time, page requested, referrer and browser type. We have no access to individual server logs.

If a page fails to load, your browser may send a short error report (Network Error Logging) to Cloudflare at a.nel.cloudflare.com. That report can include your IP address, the URL and the type of error. On this site the success fraction is 0, so reports are sent when a connection fails.

Cloudflare may set the cookie __cf_bm (about 30 minutes) and, after a security check, cf_clearance (up to one year). These cookies distinguish people from bots. They are used to protect the site.

On pages that show an email address, Cloudflare may replace the address with a short script (email obfuscation, under /cdn-cgi/l/email-protection) so that automated scrapers do not collect it. That script does not build a profile of you.

Provider: Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA, certified under the EU-US Data Privacy Framework. Cloudflare's privacy policy applies (cloudflare.com/privacypolicy).

Legal basis: legitimate interest in the secure, fast and stable operation of the website (Art. 6 (1) f GDPR).

3. Web analytics

This website uses Cloudflare Web Analytics. The beacon is added by Cloudflare when the site is served. It sets no cookies, stores nothing in your browser and only produces aggregated statistics, such as page views, referrers and loading times. No personal profile is created. It stays on without a choice in the cookie banner, because it does not store or read information on your device for analytics.

Legal basis: legitimate interest in understanding how the website is used (Art. 6 (1) f GDPR).

4. Cookies and consent

The tools in this section store or read information on your device. Each one loads only after you allow its category in the cookie banner, and only once we have connected an identifier for it. Optional categories start switched off. Without them, the website works the same.

The banner offers Accept all, Reject all and Settings, with the same visual weight. Settings lists:

Your choice is stored in local storage in this browser, with a timestamp and a version number, for 12 months, so the banner does not appear on every page. This storage is technically necessary and contains no profile of you. You can change or withdraw it at any time, with effect for the future, under Cookie settings at the bottom of every page. When you withdraw, we stop loading the tools and delete their cookies on this website where your browser allows it. Cookies already set on YouTube's or beehiiv's own domains are removed in your browser, or they expire as those providers state.

Legal basis: your consent (Art. 6 (1) a GDPR). Storing or reading information on your device for these tools also requires consent under Art. 5 (3) of the ePrivacy Directive, implemented in Austria by § 165 (3) TKG 2021.

4.1 Google Analytics 4 (statistics)

Purpose: to see which pages are read, how visitors arrive and how long they stay, so that we can improve the website. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework. Google processes it on our behalf under a data processing agreement.

Data processed: pages visited, time, referrer, browser and device information, and an approximate location derived from the IP address. The tag is configured so that Google signals and ad personalisation stay off. Cookies: _ga and _ga_* (up to 2 years). The tag loads only with Statistics consent, and only when a measurement ID is set.

4.2 Google Tag Manager (statistics)

Purpose: to deliver the statistics tags we configure, including Google Analytics 4, from one container. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework.

The container loads only with Statistics consent, and only when a container ID is set. Marketing tags are not placed in this container. Meta, LinkedIn, X, TikTok and Pinterest have their own loaders and run only with Marketing consent. A separate Google Tag Manager container belongs to beehiiv and loads inside the newsletter form, as described in section 6.

4.3 Microsoft Clarity (statistics)

Purpose: to see how pages are used, through heatmaps and recordings of mouse movements, clicks and scrolling, so that we can improve the website. Text you type is masked and is not recorded. Provider: Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Data may be transferred to Microsoft Corporation in the USA, which is certified under the EU-US Data Privacy Framework.

Data processed: pages visited, interactions on the page, time, referrer, browser and device information, and an approximate location derived from the IP address. Cookies: _clck (1 year) and _clsk (1 day). Advertising use is switched off in the Clarity project. Microsoft's privacy statement applies (www.microsoft.com/privacy). The tag loads only with Statistics consent, and only when a project ID is set.

4.4 Meta Pixel (marketing)

Purpose: to show our ads on Facebook and Instagram to people who have visited this website, and to measure whether the ads work. Provider: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. Data may be transferred to Meta Platforms, Inc. in the USA, which is certified under the EU-US Data Privacy Framework.

Data processed: pages visited, time, IP address, browser and device information, and an identifier in the cookie _fbp (90 days). If you are logged in to Facebook or Instagram, Meta can link the visit to your account. For collecting and transmitting this data, Meta and we are joint controllers (Art. 26 GDPR) under Meta's Controller Addendum (facebook.com/legal/controller_addendum). Further processing is Meta's responsibility under its privacy policy (facebook.com/privacy/policy). The pixel loads only with Marketing consent, and only when a pixel ID is set.

4.5 LinkedIn Insight Tag (marketing)

Purpose: to show our ads on LinkedIn to people who have visited this website, to measure the ads, and to receive statistics about visitors in aggregate form (for example job function or industry, never individual names). Provider: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. Data may be transferred to LinkedIn Corporation in the USA, which is certified under the EU-US Data Privacy Framework.

Data processed: page visited, time, referrer, IP address, browser and device information, and cookies set by LinkedIn (up to 1 year). LinkedIn pseudonymises direct identifiers within 7 days and deletes the remaining data within 180 days. For collecting and transmitting this data, LinkedIn and we are joint controllers (Art. 26 GDPR) under LinkedIn's Joint Controller Addendum. Further processing is LinkedIn's responsibility under its privacy policy (linkedin.com/legal/privacy-policy). The tag loads only with Marketing consent, and only when a partner ID is set.

4.6 X Pixel (marketing)

Purpose: to show our ads on X to people who have visited this website, and to measure whether the ads work. Provider: Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland. Data may be transferred to X Corp. in the USA, which is certified under the EU-US Data Privacy Framework.

Data processed: pages visited, time, referrer, IP address, browser and device information, and cookies set by X (up to 2 years). If you are logged in to X, X can link the visit to your account. For collecting and transmitting this data, X and we are joint controllers (Art. 26 GDPR). Further processing is X's responsibility under its privacy policy (x.com/privacy). The pixel loads only with Marketing consent, and only when a pixel ID is set.

4.7 TikTok Pixel (marketing)

Purpose: to show our ads on TikTok to people who have visited this website, and to measure whether the ads work. Provider: TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, D02 T380, Ireland. Data may be transferred to other TikTok companies, including in the USA and Singapore. Where a recipient is certified under the EU-US Data Privacy Framework, that certification is the transfer tool. Otherwise the safeguards described in TikTok's privacy policy apply, including standard contractual clauses (tiktok.com/legal/privacy-policy).

Data processed: pages visited, time, IP address, browser and device information, and the cookie _ttp (about 13 months). The pixel loads only with Marketing consent, and only when a pixel ID is set.

4.8 Pinterest Tag (marketing)

Purpose: to show our ads on Pinterest to people who have visited this website, and to measure whether the ads work. Provider: Pinterest Europe Ltd., Waterloo Exchange, Waterloo Road, Dublin 4, Ireland. Data may be transferred to Pinterest, Inc., 651 Brannan Street, San Francisco, CA 94107, USA, which is certified under the EU-US Data Privacy Framework.

Data processed: pages visited, time, IP address, browser and device information, and cookies such as _pinterest_sess and _pin_unauth (up to about 1 year). Pinterest's privacy policy applies (policy.pinterest.com/privacy-policy). The tag loads only with Marketing consent, and only when a tag ID is set.

5. Fonts

The fonts on this website, Philosopher and Proza Libre, are stored on our own server. Loading our pages does not connect to Google or to any other font provider.

6. Our letter (newsletter)

If you enter your email address under "Stay in touch", we send you an occasional letter when something is ready, such as new dates for Dance Prayer, retreats and festival appearances. Entering your first name is optional. The form loads only when you click Subscribe, or when you allow External media in the cookie banner. You first receive an email asking you to confirm your subscription. Double opt-in is switched on. You can unsubscribe at any time with the link in every letter, or by writing to us.

The form and the letter are provided by beehiiv (beehiiv, Inc., 228 Park Avenue South, New York, NY 10003, USA). The beehiiv account is registered to AHASH ONE OÜ. beehiiv processes the data on our behalf under a data processing agreement. Transfers to the USA are based on the EU standard contractual clauses (Art. 46 (2) c GDPR). beehiiv's EU representative under Art. 27 GDPR is Prighter EU Rep GmbH, Schellinggasse 3/10, 1010 Vienna, Austria.

Data processed: email address, first name if given, date and time of subscription and confirmation, IP address, the page and campaign you came from (referrer and UTM parameters), and whether and when you open the letter or click a link in it. Opens and clicks are tracked. This helps us see which content is useful.

The form is embedded from beehiiv and loads from beehiiv's servers. To protect it against spam and abuse, beehiiv uses Cloudflare and HUMAN Security (HUMAN Security, Inc., New York, USA), which set technical cookies on the beehiiv domain (such as __cf_bm, cf_clearance, _pxvid and _px3) and analyse browser characteristics. beehiiv also loads Google Tag Manager and Google Fonts within the form. These services are operated by beehiiv. Their privacy policy applies (beehiiv.com/privacy).

Legal basis: your consent (Art. 6 (1) a GDPR) for the letter and for measuring opens and clicks. Marketing email also follows the ePrivacy rules as implemented in Estonia (Elektroonilise side seadus § 103¹) and in Austria (§ 174 TKG 2021). Legitimate interest in protecting the form against abuse (Art. 6 (1) f GDPR) covers the bot-protection cookies on the beehiiv domain. How long we keep the address, the suppression list and the consent record is set out under Retention.

7. Video (YouTube)

The video from Boom Festival is provided by YouTube. The preview image is stored on our own server. The player uses youtube-nocookie.com and loads only when you click the video, or when you allow External media in the cookie banner. Only then does your browser connect to YouTube, transmit your IP address and browser information, and YouTube may set cookies or similar identifiers (such as YSC and VISITOR_INFO1_LIVE) and measure your viewing. If you are logged in to Google, YouTube can link the view to your account.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA, which is certified under the EU-US Data Privacy Framework. Google's privacy policy applies (policies.google.com/privacy).

Legal basis: your consent (Art. 6 (1) a GDPR and § 165 (3) TKG 2021).

8. Events and community (Luma, Telegram)

Event registration via Luma. We use Luma (Luma Labs, Inc., San Francisco, USA) to publish our events and manage registrations and tickets. When you register, we receive your name, email address, your answers to the registration questions and, for paid events, ticket and payment status. Payments are processed by Stripe on Luma's behalf; we do not receive your card details. We use this data only to organise the event you registered for: managing the guest list and check in, sending practical information, changes or cancellations, and handling refunds. Legal basis: Art. 6(1)(b) GDPR (performance of the participation agreement). Luma acts as our processor under its Data Processing Addendum and stores data in the United States; transfers are safeguarded by the EU Standard Contractual Clauses included in that addendum. Luma also processes some data as an independent controller under its own privacy policy (luma.com/privacy-policy).

Health related questions. For some sessions we may ask about health conditions relevant to your safety (for example pregnancy or conditions affected by breath or sound work). Answering is voluntary unless stated otherwise. We process this information only with your explicit consent (Art. 9(2)(a) GDPR), only to keep the session safe, and delete it no later than 30 days after the event.

Newsletter via event registration. We add you to our newsletter only if you actively tick the optional newsletter box in the registration form and then confirm your subscription in the confirmation email (double opt in). Legal basis: Art. 6(1)(a) GDPR. You can unsubscribe at any time via the link in every email. We do not use your registration data for marketing without this consent.

Telegram. We run a Telegram channel and group for announcements and community exchange. Telegram (Telegram Messenger Inc.) is responsible for its platform under its own privacy policy (telegram.org/privacy). When you join, we as administrators can see your public profile name, username and profile picture, and any messages you post; your phone number is visible only if your Telegram privacy settings allow it. We use this only to run the channel and group, for example moderation and answering your messages. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in running an online community). We do not export member lists, phone numbers or usernames, do not add members to our newsletter or any other database, and do not send individual promotional messages to members. You can leave the channel or group at any time.

9. Email and phone

If you contact us by email or phone, we process the data you provide in order to answer. The mailbox runs on Google Workspace (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Processing also takes place in the USA. Google LLC is certified under the EU-US Data Privacy Framework.

Legal basis: preparation or performance of a contract (Art. 6 (1) b GDPR), or legitimate interest in answering enquiries (Art. 6 (1) f GDPR). How long we keep these messages is set out under Retention.

10. Links to other platforms

This website links to Instagram and Facebook. These are plain links. No data is sent to those platforms until you click. Once you are there, the privacy policy of that platform applies.

Links to Luma (luma.com/asunritual) and to our Telegram channel and group work the same way until you open them. What we do with registration data, and what we see inside Telegram, is described under Events and community.

11. Recipients

Personal data is shared with the providers named in this policy. Where they process it on our behalf, they do so under a data processing agreement. It is also shared with authorities where the law requires it. Data is not sold. It is shared for advertising only with the marketing tools in section 4, and only after you consent to that category.

12. Retention

We keep personal data only as long as necessary for the purpose for which it was collected, or as long as the law requires:

Where data must be kept for legal reasons, we restrict its use to that purpose (Art. 17(3) and Art. 18 GDPR).

13. Your rights

You have the right to access your personal data, to have it corrected or deleted, to restrict its processing, to receive it in a portable format, and to object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time with effect for the future.

To exercise these rights, write to [email protected].

You also have the right to lodge a complaint with a supervisory authority, in particular the authority of your place of residence. In Estonia the supervisory authority is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, www.aki.ee.

14. Changes

This policy is updated when the tools or processes on this website change. The date at the top shows the current version.