Published Date: 1st July, 2025
This privacy policy is prepared for all Data Subjects (including but not limited to future Users and Coaches) who visit the websites of ADVANCED BREATH COACHING – FZCO (https://airvana.pro/, https://airvana.app/) (hereinafter jointly referred to as: Websites) and use the Airvana breathwork coaching service (hereinafter referred to as: Application). The purpose of the policy is to inform on the circumstances of Data Processing activities in relation to the Website and the Application according to relevant legislation. If you have any questions or comments, please do not hesitate to contact us on our contacts below.
The ADVANCED BREATH COACHING – FZCO (hereinafter referred to as: Airvana) is the Data Controller. All present and future members, employees, and other companies who join Airvana in the future have access to Personal Data processed by Airvana. All the aforesaid persons are under a strict confidentiality obligation.
Some of the most frequently used definition in this policy, is detailed at the end of this document for the sake of better understanding. If you have any questions or comments, please do not hesitate to contact us on our contacts below.
Data Controller’s name: ADVANCED BREATH COACHING – FZCO
Data Controller’s seat: Premises Number 51979-001, IFZA Business Park,
DDP, Dubai Silicon Oasis, Dubai, United Arab Emirates
Data Controller’s email: [email protected]
Data Controller’s phone no.: +971 50 276 9570
Data Protection Officer’s name: Mariann Godor
Representative’s name: Mariann Godor
Data Processing for registration as User
Purpose of Data Processing activity: | Registration – Account Creation: In order to access the Services offered through the Airvana Website/Application, the User is required to provide certain Personal Data to Airvana. |
Legal basis of Data Processing: | Performance of the contract concluded with the Data Subject (Article 6 (1) (b) of the GDPR) |
Personal Data related to the Data Processing activity: | Full name, declarations required for use of the Website/Application, postal address |
Retention period: | For a period of 5 years following the termination of the contract (deletion of the user account). |
Legal basis of Data Processing: | With respect to billing-related data, compliance with legal obligations set out in accounting legislation (Article 6 (1) (c) of the GDPR). |
Personal Data related to the Data Processing activity: | Billing address and bank account details |
Retention period: | The retention period for strictly accountable documents is eight calendar years from the end of the relevant calendar year. |
Legal basis of Data Processing: | The data subject’s Consent (Article 6 (1) (a) of the GDPR) Consent may be withdrawn at any time by sending a message to the email address provided above. The withdrawal of Consent does not affect the lawfulness of Data Processing based on Consent before its withdrawal. |
Personal Data related to the Data Processing activity: | Email address, phone number, password |
Retention period: | Until the withdrawal of Consent, but no later than the deletion of the user account. |
Data transfer to Third Countries or international organizations: | There is no data transfer to Third Countries and international organizations. |
Consequences of failure to provide data: | Providing Personal Data to Airvana is never mandatory. Without the above data, we are unable to provide the user account necessary for accessing our Services. |
Data Processing for registration as Coach
Purpose of Data Processing activity: | Registration – Account Creation: In order to participate in the provision of services through the Airvana Website/Application by conducting Consultations, the Coach is required to provide certain data within the Website/Application to Airvana. |
Legal basis of Data Processing: | Performance of the contract concluded with the Data Subject (Article 6 (1) (b) of the GDPR) |
Personal Data related to the Data Processing activity: | Name, declarations required for use of the Website/Application, copy of personal identification document, postal address, business details, if the Coach intends to provide services in the form of a business entity, Personal Data of the representative of the business entity, if the Coach intends to provide services in the form of a business entity |
Retention period: | For a period of 5 years following the termination of the contract (deletion of the user account). |
Legal basis of Data Processing: | With respect to billing-related data, compliance with legal obligations set out in accounting legislation (Article 6 (1) (c) of the GDPR). |
Personal Data related to the Data Processing activity: | Billing address |
Retention period: | The retention period for strictly accountable documents is eight calendar years from the end of the relevant calendar year. |
Legal basis of Data Processing: | The data subject’s Consent (Article 6 (1) (a) of the GDPR) Consent may be withdrawn at any time by sending a message to the email address provided above. The withdrawal of Consent does not affect the lawfulness of Data Processing based on Consent before its withdrawal. |
Personal Data related to the Data Processing activity: | Email address, phone number, password |
Retention period: | Until the withdrawal of Consent, but no later than the deletion of the user account. |
Legal basis of Data Processing: | The Data Controller’s legitimate interests (Article 6 (1) (f) of the GDPR) |
Personal Data related to the Data Processing activity: | Proof of qualification |
Retention period: | For a period of 5 years following the termination of the contract (deletion of the user account). |
Impact assessment: | The Data Controller has carried out a Data Protection Impact Assessment in accordance with Article 35 of the General Data Protection Regulation (GDPR). Based on the outcome of the assessment, the data processing activities described herein are considered to present a low level of risk to the rights and freedoms of data subjects. Therefore, no prior consultation with the supervisory authority was required. |
Data transfer to Third Countries or international organizations: | There is no data transfer to Third Countries and international organizations. |
Consequences of failure to provide data: | Providing Personal Data to Airvana is never mandatory. Without the above data, no contract is concluded between the parties. |
Data Processing for use of the Application
Purpose of Data Processing activity: | Use of the Application: Data voluntarily provided by the Data Subject during use of the Application |
Legal basis of Data Processing: | Performance of the contract concluded with the Data Subject (Article 6 (1) (b) of the GDPR) |
Personal Data related to the Data Processing activity: | Full name, email address, phone number, postal address, profile picture, height, weight, age, gender, oxygen saturation, pulse rate, systolic and diastolic blood pressure values, perfusion index |
Retention period: | For a period of 5 years following the termination of the contract (deletion of the user account). |
Impact assessment: | The Data Controller has carried out a Data Protection Impact Assessment in accordance with Article 35 of the General Data Protection Regulation (GDPR). Based on the outcome of the assessment, the data processing activities described herein are considered to present a low level of risk to the rights and freedoms of data subjects. Therefore, no prior consultation with the supervisory authority was required. |
Data transfer to Third Countries or international organizations: | There is no data transfer to Third Countries and international organizations. |
Consequences of failure to provide data: | Proving Personal Data to Airvana is never mandatory. Without the above data Airvana is unable to provide the Service to the Data Subject. |
Data Processing for invoicing
Purpose of Data Processing activity: | Billing: Invoicing of Services accessed through the Website/Application, as well as the retention of documents related to such invoicing, including any applicable service fees. |
Legal basis of Data Processing: | With respect to billing-related data, compliance with legal obligations set out in accounting legislation (Article 6 (1) (c) of the GDPR). |
Personal Data related to the Data Processing activity: | Type of Service, full name and data required for contract conclusion, service fee, invoice amount, payment deadline, invoice issue date, performance date, other invoice-related details, method and date of payment, and data of the person making the payment (name, credit card details, and payment- related information). |
Retention period: | The retention period for strictly accountable documents is eight calendar years from the end of the relevant calendar year. |
Data transfer to Third Countries or international organizations: | There is no data transfer to Third Countries and international organizations. |
Consequences of failure to provide data: | Proving Personal Data to Airvana is never mandatory. Without the above data are unable to provide accurate measurements within the Application. |
Data Processing related to shipping
Purpose of Data Processing activity: | Shipping out the pulse oximeter in relation to the service |
Legal basis of Data Processing: | Performance of the contract concluded with the Data Subject (Article 6 (1) (b) of the GDPR) |
Personal Data related to the Data Processing activity: | Full name, phone number, email address, postal address |
Retention period: | For a period of 5 years following the termination of the contract (deletion of the user account). |
Data transfer to Third Countries or international organizations: | There is no data transfer to Third Countries and international organizations. |
Consequences of failure to provide data: | Providing Personal Data to Airvana is never mandatory. Airvana is not able to send newsletters to subscribers. |
Data Processing related to newsletters
Purpose of Data Processing activity: | Sending newsletter to the subscribers of Airvana regarding its services and offers. |
Legal basis of Data Processing: | The data subject’s Consent (Article 6 (1) (a) of the GDPR) Consent may be withdrawn at any time by sending a message to the email address provided above or via the unsubscribe link included in each newsletter. The withdrawal of Consent does not affect the lawfulness of Data Processing based on Consent before its withdrawal. Please note that using the unsubscribe link only removes the User from the newsletter mailing list and does not affect the processing of personal data related to the User’s registration or use of the Application. |
Personal Data related to the Data Processing activity: | Full name, email address |
Retention period: | We process the Personal Data of subscribers until they unsubscribe or withdraw their Consent. |
Data transfer to Third Countries or international organizations: | There is no data transfer to Third Countries and international organizations. |
Consequences of failure to provide data: | Providing Personal Data to Airvana is never mandatory. Airvana is not able to send newsletters to subscribers. |
The Data Controller hereby informs the Data Subject that profiling is carried out as part of the data processing activities. The purpose of profiling is to personalise user experience and therefore better recommend services, based on data collected via the pulse oximeter.
The profiling is performed using automated means, and while it does not result in decisions producing legal effects concerning the Data Subject or similarly significantly affecting them, it may influence the content and timing of certain communications or recommendations displayed in the Website/Application.
We may ask for some service of external service providers during our Data Processing activities for example: sending a newsletter or maintaining our website. These external service providers shall be considered as Data Processors, which means that they process Personal Data upon the instructions of Airvana (as Data Controller), this also means that they have access to some and all of the Personal Data processed in relation to our website. These Data Processors conduct their services upon a written agreement and they are under confidentiality. For further information on Data Processors please contact us directly via email or post.
In order to comply with its statutory bookkeeping obligations, the Data Controller engages the following accounting service provider (hereinafter referred to as: Accountant):
Name: Alchemist Accounting LLC Representative: Afsal KP
Address: Al Masood Tower, 301 Airport Rd, Port Saeed, Dubai, United Arab Emirates
The Data Controller shall transfer to the Accountant only those data that are necessary for the performance of bookkeeping obligations. The Accountant shall store the data received solely for the period prescribed by the applicable legal provisions.
Airvana stores certain data under its management on servers provided by the following server hosting providers (hereinafter referred to as: Server Hosting Provider):
name: Amazon Web Services representative: Matt Garman
address: 410 Terry Avenue North, Seattle, WA 98109-5210, USA
7.4.2. The Server Hosting Providers engaged by Airvana are responsible solely for storing the data provided to Airvana; they do not carry out any other Data Processing activities.
7.4.3. The Server Hosting Providers shall provide the necessary storage capacity for the duration required to fulfil the contract concluded with Airvana.
Airvana provides online credit card payment options through the following online payment service providers (hereinafter referred to as: Payment Service Providers):
name: STRIPE PAYMENTS EUROPE, LIMITED
representative: Patrick Collison
address: 1 Grand Canal Street Lower, Grand Canal Dock, Dublin D02 H210, Ireland
7.5.2. The Data Subject acknowledges that, in the case of payment by credit card, the following Personal Data will be transferred to STRIPE PAYMENTS EUROPE, LIMITED as Data Processor. The scope of the transferred data includes:
the name as it appears on the Data Subject’s credit card;
the Data Subject’s credit card number;
the expiry date of the Data Subject’s credit card;
the CVV code of the Data Subject’s credit card.
7.5.3. The nature and purpose of the Data Processing activities carried out by STRIPE PAYMENTS EUROPE, LIMITED as a Data Processor are detailed in the STRIPE PAYMENTS EUROPE, LIMITED Privacy Notice, available at the following link: https://stripe.com/en-hu/privacy
Airvana stores and manages certain data transferred to it through the following tools and systems:
name: Google LLC representative: Sundar Pichai
address: 1600 Amphitheatre Parkway, Mountain View, CA 94043
name: Apple Inc
representative: Timothy Donald Cook
address: One Apple Park Way, Cupertino, CA 95014
name: Meta Platforms, Inc. representative: Mark Zuckerberg
address: 1 Meta Way, Menlo Park, CA 94025
name: Auth0, a product of Okta, Inc. representative: Todd McKinnon (CEO, Okta, Inc.)
address: 100 First Street, 6th Floor, San Francisco, CA 94105, USA
Function: Auth0 provides authentication services, acting as a secure gateway to Airvana. It stores and manages user login credentials, such as email addresses and encrypted passwords. Auth0 is engaged as a data processor for handling this sensitive data.
Airvana provides shipping information to the following merchant in order to ship out the pulse oximeters in relation with the service (hereinafter referred to as: Merchant)
name: HONGKONG YUNEXPRESS LOGISTICS LIMITED
representative: Ron Jansen
address: Room 1502 (82) Easycomm Bldg 253-261 Henessy Rd, Wanchai Hong Kong
Airvana stores the Personal Data specified in Section 3 in a secure system protected by IT algorithms and manages it using closed software systems that are also protected by such security measures.
Personal Data held on paper is stored by Airvana in a secure, lockable facility that complies with physical security requirements, in an organized manner.
Airvana undertakes to take all necessary and reasonable measures to protect the processed data—during both network transmission and storage—against unauthorized access, alteration, transmission, disclosure, deletion or destruction, as well as accidental loss, damage, or inaccessibility due to technological changes.
You as data subjects are entitled to the following rights:
Right of Access - You may initiate access to the Personal Data concerning you, and processed by the Data Controller, you may initiate the access to your Personal Data. [The right of access ensures, that data subjects may receive information from the Data Controller, whether his/her Personal Data are being processed, if yes, then the data subjects is entitled to access them, and ask for information from the Data Controller on the details of the processing activity and also ask a copy of his/her Personal Data.
Rights to request rectification, erasure of data, restriction of processing - You may request rectification or erasure of your Personal Data or restriction of the Data Processing activity. Rectification and erasure of data (‘right to be forgotten’) ensure the possibility, to ask for rectification of inaccurate or incomplete Personal Data, and also the deletion of your data. If the data subjects exercise the right for restriction of processing, then the Data Controller may restrict processing activity accordingly. If the data subjects contest the accuracy of the Personal Data, then the restriction is, for a period enabling the controller to verify the accuracy of the Personal Data. The data subjects as data subject could oppose the erasure of the Personal Data if the processing is unlawful and requests the restriction of their use instead; You may require such a claim also if the controller no longer needs the Personal Data for the purposes of the processing, but it is needed for you to establishments, exercise or defence of legal claims of.
Right to data portability – The data subjects shall have the right to receive the Personal Data in a structured, commonly used, and machine-readable format and have the right to transmit those data to another data controller without hindrance from the Data Controller. The data
subject shall have the right to have the Personal Data transmitted directly from one controller to another, where technically feasible.
Right to object – The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on point (e) or (f) of Article 6(1), including profiling based on those provisions. The controller shall no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.
Right to withdraw Consent – The data subjects shall have the right to withdraw their Consent anytime, free of charge. We draw the attention to the fact, that the withdrawal of Consent shall not affect the lawfulness of processing based on Consent before its withdrawal.
If you as a data subject would like to exercise your rights listed above, or have any questions related to the Data Processing activity, please contact Airvana to those contacts referred to above in this Privacy Policy.
The following options are available to all Data Subjects if your rights are infringed during the Data Processing activity:
You may contact directly the Data Controller in written form via email or post. Please find our postal and email address listed in Article 2. of this privacy policy);
You may initiate a legal claim before the court. You may find out more information on jurisdiction and contact details of courts on the following webpage: https://u.ae/en/about-the- uae/the-uae-government/the-federal-judiciary/the-system-of-courts
You may lodge a complaint before the competent supervisory activity: the data subject may apply to the data protection authority of his/her place of residence, workplace, or the place of the data protection incident. You can find the list of the National data protection authorities under this URL: https://en.wikipedia.org/wiki/National_data_protection_authority
Coach: | Means a natural person who possesses at least one professional or educational qualification authorising them to teach breathwork, stress management, or mind-body wellness techniques (e.g., yoga instructor certification, health development qualification, degree in psychology, bodywork or mindfulness trainer certificate, physiotherapy qualification, etc.). In addition, the Coach has adequate knowledge of the risks and contraindications associated with various breathing exercises and undertakes to perform their activities with Users in a manner that takes such factors into careful consideration. |
Consent: | ‘Consent’ of the data subject means any freely given, specific, informed and unambiguous indication of the data subject's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of Personal Data relating to him or her. |
Data Controller: | Data Controller means the natural or legal person, public authority, agency, or other body that, alone or jointly with others, determines the purposes and means of the processing of Personal Data. In this privacy policy, PV Partners Attorney Association is the data controller. |
Data Processor: | Data Processor means a natural or legal person, public authority, agency, or other body which processes Personal Data on behalf of the controller; In this privacy policy, the Data Processor is, for example, the service provider who maintains our Website. |
Data Processing: | ‘processing’ means any operation or set of operations that are performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. |
Data Protection Officer: | ‘data protection officer’ means an independent expert who ensures an organization complies with data protection laws. They monitor compliance, advise on obligations, and act as a contact point for data protection authorities and individuals. |
Data Subject: | ‘data subject’ means any person who’s Personal Data is being Processed. |
Personal Data: | ‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. |
Representative in the Union: | ‘representative’ means a natural or legal person established in the Union who, designated by the controller or processor in writing, represents the controller or processor with regard to their respective obligations under this Regulation; |
Third Countries: | Those countries which are not members of the EEA (European Economic Area) |
User: | means the natural person who registers in the Website/Application operated by the Service Provider in their own name and uses the Service. |
If you have any questions or comments, in relation to our Data Processing or your rights, or you need an explanation, please do not hesitate to contact us at [email protected]. | |