Forge Bali
Privacy Policy
Last updated: 2 August 2026
This policy explains what personal information we collect when you join our waitlist, enquire about or book a retreat, how we use it, who we share it with, and the rights you have over it. We take your privacy seriously and only ever collect what we need.
01Who we are
Forge Bali is operated by Forge Retreat Ltd (company number 17329803), registered at 124–128 City Road, London EC1V 2NX. For the purposes of UK data protection law, Forge Retreat Ltd is the "data controller" responsible for your personal information. This policy is governed by the UK GDPR and the Data Protection Act 2018.
If you have any questions about this policy or your data, contact us at info@forge-bali.com.
02What information we collect
Information you give us:
- Your name and email address, when you join the waitlist or get in touch.
- Booking and payment details when you reserve a place. Card payments are handled directly by our payment provider: we never see or store your full card details.
- Dietary requirements, and any health, injury or medical information relevant to taking part safely (see section 04).
- Practical details needed to run your retreat, such as travel dates or an emergency contact.
Information we collect automatically: we use privacy-friendly, cookieless website analytics that measure aggregate traffic (such as which pages are viewed) without tracking you individually or building a profile. See section 06.
03How we use your information
We use your information for the following purposes, each with a lawful basis under UK GDPR:
- To respond to enquiries and manage the waitlist: on the basis of your consent, or our legitimate interest in answering people who contact us.
- To take your deposit and administer your booking and the retreat: because it is necessary to perform our contract with you.
- To keep you updated about Forge Bali (early access, pricing, future cohorts): on the basis of your consent. You can withdraw this at any time using the unsubscribe link in any email.
- To meet our legal, tax and accounting obligations: because we are required to by law.
04Health and dietary information
Because Forge Bali is a fitness and recovery retreat, we may ask you for health, injury, medical or dietary information so that we can run sessions safely and cater to you properly. This is treated as "special category" data under UK GDPR and given extra protection.
We only collect it with your explicit consent, only use it to plan and deliver your retreat safely, and only share it with the people directly involved in delivering that retreat. You are never obliged to share more than you are comfortable with, though some information may be necessary for us to keep you safe.
05Who we share your information with
We do not sell your personal information. We share it only where necessary, with:
- Service providers acting on our behalf ("processors"), including our payment processor (Stripe), our email and mailing-list providers (Kit and Zoho Mail), and our website host (Netlify). Each processes your data under our instructions and their own data protection commitments.
- Our on-the-ground delivery partner and local suppliers in Bali, so they can deliver your retreat. We share only what they need, such as your name and any dietary or health needs relevant to your stay.
- Authorities or advisers where we are required to by law, or to establish, exercise or defend legal claims.
06Cookies and analytics
Our website uses cookieless analytics that report aggregate visitor numbers without placing tracking cookies on your device or identifying you personally. Because of this, our own site does not set non-essential tracking cookies.
When you interact with third-party services linked from our site, such as the payment page or the sign-up form, those services may set their own cookies governed by their own privacy policies.
07International transfers
Delivering your retreat means some of your information is shared with our partner and suppliers in Indonesia, which is outside the UK and the European Economic Area. Where we transfer data internationally, we take steps to ensure it is given an appropriate level of protection, including sharing only the minimum necessary and putting suitable contractual safeguards in place.
08How long we keep your information
- Waitlist and enquiry data: until you unsubscribe or ask us to delete it.
- Booking, payment and accounting records: retained for at least 6 years, to meet UK tax and accounting requirements.
- Health and dietary information: deleted after your retreat, unless you are booked onto a future one.
09Your rights
Under UK GDPR you have the right to access your information, to have it corrected or erased, to restrict or object to how we use it, to data portability, and to withdraw your consent at any time. To exercise any of these, email info@forge-bali.com and we will respond within the timeframes the law requires.
10Complaints
If you are unhappy with how we have handled your information, we would appreciate the chance to put it right, so please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk.
11Changes to this policy
We may update this policy from time to time. When we do, we will change the "last updated" date at the top of this page. Please check back occasionally.