Last updated: August 2026
1. General information
This Privacy Policy explains how personal data is collected, used, stored and protected in connection with pirtsmastery.lv, Jānis Pavlovičs Sauna School, its training activities and related events.
Personal data is processed in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR) and other applicable Latvian and European Union legislation.
This Privacy Policy applies to website visitors, current and prospective students, representatives of corporate clients, cooperation partners and other individuals whose personal data is processed in connection with the School.
Training is intended for persons aged 18 and over.
2. Data Controller
The Data Controller is:
Jānis Pavlovičs, self-employed person
Registration / Taxpayer No.: 28057110134
Address: “Rozēni”, Skulte, Skulte Parish, Limbaži Municipality, LV-4025, Latvia
Email: janis@pirtsmastery.lv
Telephone: +371 29196438
No separate Data Protection Officer has been appointed. Questions concerning personal data or the exercise of data protection rights may be addressed directly to Jānis Pavlovičs using the contact details above.
3. Personal data we process
Depending on your interaction with the School, we may process:
- identification data, including name, surname and personal identification number where required for training records or certificates;
- contact details, including email address and telephone number;
- application information, including the selected course and message content;
- training information, including attendance and assessment, examination or practical test results;
- information concerning certificates and other training documents issued;
- payment and transaction information;
- company and contact-person details where training is ordered by a legal entity;
- photographs, videos and testimonials where the individual has agreed to their use;
- health information where necessary for safe participation in practical sauna training;
- technical website data, such as IP address, device and browser information, cookie identifiers and website usage data;
- communication data generated through email, telephone or WhatsApp communications.
4. Course applications and communication
Applications may be submitted through the website application form, by email, telephone or WhatsApp.
The website form may collect your name, surname, email address, telephone number, selected course and message.
Application form data is not intended to be permanently stored in the WordPress database and is sent to janis@pirtsmastery.lv.
An automatic email confirming receipt of the application may be sent to the email address provided.
The legal basis for processing is taking steps at the request of the individual prior to entering into a contract and the performance of a contract (Article 6(1)(b) GDPR).
5. Organisation of training
Personal data may be processed for:
- communication concerning training;
- registration and attendance records;
- organisation and administration of training;
- assessment of knowledge and practical skills;
- recording examination, assessment and practical test results;
- preparing and issuing certificates;
- maintaining records of certificates and training documents issued;
- preparing agreements and invoices.
Processing is primarily necessary for the performance of the training agreement and the provision of training services.
Information concerning certificates issued and relevant assessment results may be retained after completion of training in order to verify participation, substantiate the issuance of a certificate or replace a lost document.
6. Health data and safety during practical training
Practical sauna training may involve increased physical and thermal stress. Participants may therefore be asked before practical training to disclose circumstances relevant to safe participation.
This may include information concerning health restrictions, medical conditions, allergies, injuries, implanted medical devices or other contraindications.
The information may be discussed verbally or provided in a safety questionnaire.
Health information constitutes a special category of personal data. Where such information is recorded, it is processed for the purpose of ensuring safe participation on the basis of the participant’s explicit consent (Article 9(2)(a) GDPR).
Health information provided in a questionnaire will only be used for training safety purposes and will not be retained for longer than necessary for that purpose.
Jānis Pavlovičs does not perform medical diagnosis or medical assessment. Where there are reasonable concerns regarding safe participation in a particular practical activity, participation may be restricted or refused and the participant may be asked to consult a medical professional before taking part.
7. Participants registered by companies or organisations
Where training is ordered by a company or other organisation, basic participant information may be provided to the School by that organisation.
Such information may include the participant’s name, surname, email address and telephone number.
Health information and other sensitive information, where required, will be obtained directly from the participant.
For corporate bookings, company details and contact-person information may also be processed for the preparation of agreements, training and invoices.
Where training has been commissioned by an employer or another organisation, information concerning the attendance and training results of the participants registered by that organisation may be provided to the commissioning organisation where necessary for the performance of the commissioned service.
8. Invoices and payments
For invoicing purposes, identification information, contact details, company details and information concerning the service received may be processed.
Invoices are prepared using Excel and stored locally. Payments are made by bank transfer.
Payment processing involves Swedbank AS.
Accounting and transaction documentation is retained for the periods required by applicable legislation.
The legal basis is performance of a contract and compliance with legal obligations (Articles 6(1)(b) and 6(1)(c) GDPR).
9. WhatsApp
WhatsApp may be used for communications relating to the organisation of training.
A WhatsApp group may be created for a particular course. When joining such a group, a participant’s telephone number and, depending on their WhatsApp privacy settings, profile name, photograph and other profile information may be visible to other participants.
After completion of training, the group may continue to operate as an alumni or sauna practitioner community group.
Remaining in such a group after training is voluntary, and participants may leave the group at any time.
10. Photographs and video
Photography and filming may take place during training, festivals, competitions and other School-related events.
The use of identifiable photographs or video on the website, social media or in informational or advertising materials is agreed with the individuals concerned.
Where processing is based on consent, consent may subsequently be withdrawn. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
11. Testimonials
A participant’s testimonial, name and photograph may be published on the website or other School communication channels only with that person’s consent.
Consent may subsequently be withdrawn by contacting the Data Controller.
12. Information about new courses and events
Information about new courses, masterclasses, festivals, competitions and other offers may be sent by email, telephone or WhatsApp only to individuals who have consented to receiving such information.
Marketing consent is voluntary and is not a condition of participation in training.
Consent may be withdrawn at any time by contacting the Data Controller.
13. Festivals, competitions and external events
Training activities may include participation in festivals, competitions, seminars or other external events.
Where registration requires personal data to be provided to an external event organiser, only the data necessary for that purpose will be disclosed. Participants will be informed about such disclosure.
Training may also take place in rented premises or saunas owned by third parties. Participants’ personal data is not disclosed to the owners or operators merely because the training takes place on their premises.
14. Website analytics and advertising
The website may use:
- Google Analytics;
- Google Ads;
- Meta Pixel;
- Google Maps;
- YouTube;
- Facebook and Instagram content or links.
These services may process technical information such as IP addresses, device and browser information, cookie identifiers, website usage and interaction data.
Analytics and marketing technologies that require consent will only be activated after the website visitor has provided the relevant consent through the website’s cookie consent mechanism.
Consent can subsequently be changed or withdrawn.
Further information will be provided in a separate Cookie Policy.
15. Hosting and email
The website and email infrastructure are provided by SIA “Area IT”.
As part of providing technical infrastructure, the service provider may process technical information necessary for hosting, email, security and server operation. SIA “Area IT” states in its privacy information that data processed for website statistics and security may include IP address, device and browser information and date/time information.
16. Recipients of personal data
Depending on the circumstances, personal data may be accessible to or disclosed to:
- SIA “Area IT” for hosting and email infrastructure;
- Swedbank AS for payment processing;
- Google service providers where the individual has consented to the relevant analytics, advertising or embedded-content technologies;
- Meta group companies in connection with Meta Pixel, Facebook, Instagram and WhatsApp;
- organisers of festivals, competitions or other external events where disclosure is required to register the participant;
- public authorities or other persons where disclosure is required by applicable law.
Within the School, access to participants’ personal data is held by Jānis Pavlovičs.
17. International data transfers
Use of certain external services, particularly Google, Meta and WhatsApp, may result in personal data being processed outside the European Economic Area.
Where applicable, such transfers are carried out using the transfer mechanisms available under the GDPR and safeguards implemented by the relevant service providers.
18. Data retention
Personal data is not retained for longer than necessary for the purpose for which it was collected.
As a general rule:
- initial enquiries and application data are retained for as long as necessary to process the application, communicate with the applicant and organise subsequent training;
- agreements, invoices and transaction records are retained for the periods required by applicable law;
- training, attendance and assessment information is retained for as long as necessary for training and certification records;
- certificate records may be retained on a long-term basis in order to verify or replace issued documents;
- health questionnaire information is retained only for as long as necessary to ensure safety during the relevant training;
- information processed on the basis of consent is retained until consent is withdrawn or the relevant purpose ceases to exist, unless another lawful basis requires continued retention.
19. Data security
Reasonable technical and organisational measures are taken to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
Access to personal data is restricted according to necessity.
However, no electronic transmission or storage system can guarantee absolute security.
20. Your rights
Depending on the circumstances and the applicable legal basis, you may have the right to:
- receive information about the processing of your personal data;
- access your personal data;
- request correction of inaccurate information;
- request deletion of personal data in certain circumstances;
- request restriction of processing;
- object to processing in certain circumstances;
- exercise the right to data portability where applicable;
- withdraw consent at any time where processing is based on consent.
Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.
Requests concerning personal data may be submitted to:
janis@pirtsmastery.lv
+371 29196438
21. Right to lodge a complaint
If you believe that your personal data is being processed unlawfully, you are encouraged to contact the Data Controller first.
You also have the right to lodge a complaint with the Latvian supervisory authority:
Datu valsts inspekcija (Data State Inspectorate of Latvia).
Data State Inspectorate of Latvia
22. Third-party websites
The website may contain links to Facebook, Instagram and other third-party websites.
When you follow such a link or use a third-party service, the processing of personal data is governed by the privacy terms of the relevant third party.
23. Changes to this Privacy Policy
This Privacy Policy may be amended where the School’s activities, website functionality, services used or applicable legal requirements change.
The current version of the Privacy Policy will always be available on pirtsmastery.lv.