Privacy Policy
Version 2026-08-02. This notice explains what we do with your personal data when you use the Dharma Chakra bot and this website.
1. Who is responsible
The controller within the meaning of Art. 4(7) GDPR is:
Meditation Steps e.V.Adolf-Kolping-Str. 11, 46236 Bottrop, Germany
info@meditationsteps-germany.de · +49 1764 1149292
Represented by: Alexandr Popeliaev, Alexandra Kuz
We are not required to appoint a data protection officer, and have not appointed one. Please send any question about your data to the address above.
2. What we collect, why, and on what legal basis
2.1 Your membership profile
When you accept an invitation you fill in a registration form. We store: your first and last name, your spiritual (Sanskrit) name, date of birth, place of birth, country and city of residence, marital status, email address, telephone number, preferred language, and the free-text description you write about yourself.
We also store details about your spiritual practice: when you began meditating, when you were initiated, how many lessons you have received, and the name of your Acarya.
Some of this reveals religious beliefs and is therefore a special category of personal data under Art. 9(1) GDPR. We process it under Art. 9(2)(d) GDPR, which permits a not-for-profit body with a religious aim to process the data of its members in the course of its legitimate activities, provided the data is not disclosed outside the body without your consent. The purpose is to run the Dharma Chakra: to know who our members are, to support their spiritual development, and to let mentors accompany the people assigned to them.
2.2 Attendance
We record whether you attended each weekly meeting, and — when you join through the personal link we send you — the times at which you joined and left. Mentors can correct these records by hand. The purpose is to follow how the community and its individual members are doing over time.
2.3 Your Telegram account
The bot stores your Telegram user ID, and, if you have one, your public @username and display name. It needs the ID to be able to message you at all.
2.4 Records of your agreement
We keep a log of when you agreed to this policy and to your details being passed to Zoom, which version of the policy you saw, and whether you later withdrew. Art. 7(1) GDPR requires us to be able to demonstrate this, so the log is kept for as long as your account exists.
3. If you are in our Telegram group but have never registered
This section is the information required by Art. 14 GDPR, because we did not obtain this data from you directly.
Our bot is an administrator of our Telegram group. When you join, leave, or change your status there, Telegram notifies the bot and it records your Telegram user ID, your @username and your display name, together with the dates we first and last saw you. In some cases this list was assembled from an export of the group's membership rather than from live notifications.
We do this so that we can tell who in the group has not yet been invited to register, and so that our mentors do not invite the same person twice. The legal basis is our legitimate interest under Art. 6(1)(f) GDPR in organising our own community.
You can object to this at any time under Art. 6(1)(f) and Art. 21 GDPR. Send /forgetme to the bot and the record will be deleted. Please note the limit of this: while you remain in the Telegram group, Telegram will notify the bot about you again and a new record will be created. Leaving the group stops that.
4. Who else sees your data
4.1 Inside the association
Your mentor can see your name and your attendance. Administrators can see your full profile. Nobody else has access, and we never publish your data or pass it to other organisations for their own purposes.
4.2 Zoom
Our meetings are held on Zoom. About an hour before each meeting we register you as a participant, which means passing your name and email address to Zoom Communications, Inc. in the United States. We send the first and last name held in your profile; if we do not hold those, we send your spiritual name instead. That is a disclosure outside our association, so we ask for your consent to it when you register (Art. 9(2)(a) and Art. 49(1)(a) GDPR).
You can withdraw this at any time by sending /stopzoom to the bot. If you do, we stop registering you and you stop receiving personal join links — you remain a member of the Dharma Chakra, and you can still attend by asking an Acarya for the meeting details.
Zoom processes this data under its Global Data Processing Addendum, which forms part of the Zoom Terms of Service. For transfers to countries without an adequacy decision, that addendum applies the European Commission's Standard Contractual Clauses (Implementing Decision 2021/914 of 4 June 2021). Zoom is additionally self-certified under the EU-US Data Privacy Framework. We have configured our Zoom account to keep data stored within the European Union. Zoom remains a company established in the United States, so access from outside the European Union cannot be ruled out, which is why the safeguards above still apply.
4.3 Telegram
The bot reaches you through Telegram, so everything it sends you passes through Telegram's servers. Your relationship with Telegram is your own: they hold your account under their own privacy policy and we have no control over it. We keep what we send you through Telegram to a minimum — for example, meeting reminders show your email address only in shortened form.
4.4 Hosting
This website and its database are hosted by IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany, under a data processing agreement pursuant to Art. 28 GDPR. IONOS processes the data only on our instructions, and within the European Union or the European Economic Area unless a transfer to a third country is necessary in order to provide the service — in which case IONOS undertakes to meet the requirements of Art. 44 et seq. GDPR.
5. How long we keep it
- Your profile: for as long as you are a member, and until you ask us to delete it.
- Attendance records: for as long as your account exists. After deletion only anonymous totals remain, which cannot be traced back to you.
- Login and profile-editing links: deleted within a day of being used or expiring.
- Invitations that were never accepted: 90 days.
- Records of people who have left the Telegram group: 30 days.
- Zoom join links and participant IDs: 180 days after the meeting.
6. Your rights
Under the GDPR you have the right to:
- obtain a copy of your data and information about how it is used (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data erased (Art. 17);
- have its processing restricted (Art. 18);
- receive it in a portable, machine-readable form (Art. 20);
- object to processing based on legitimate interests (Art. 21);
- withdraw any consent you have given, at any time, without affecting what was lawful before (Art. 7(3)).
You can exercise most of these directly in the bot:
/mydata— sends you a machine-readable copy of everything we hold about you/profile— lets you correct your details yourself/stopzoom— withdraws your consent to your details being passed to Zoom/forgetme— deletes your account and your personal data/privacy— links back to this page
For anything else, write to us at the address in section 1. We will answer within one month.
7. Complaints
If you believe we are handling your data unlawfully you can complain to a data protection supervisory authority, in particular in the country where you live or work. The authority responsible for us is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-WestfalenKavalleriestraße 2–4, 40213 Düsseldorf, Germany
poststelle@ldi.nrw.de · +49 211 38424-0
8. Is providing your data required?
Providing the data in the registration form is necessary to become a member and to take part in the meetings; we cannot register you without it. There is no legal obligation on you to provide it, and there is no consequence to declining other than not being able to join.
9. Automated decision-making
We do not use your data for automated decision-making or profiling within the meaning of Art. 22 GDPR.
10. Cookies and tracking
This website sets only the cookies it needs to work: one to keep mentors and administrators logged in, and one to protect forms against cross-site request forgery. These are strictly necessary under § 25(2) TDDDG, so we do not ask for consent and there is no cookie banner.
We use no analytics, no advertising, and no third-party fonts, scripts or stylesheets. Everything this site loads is served from our own servers, so no third party learns your IP address by you visiting us.
11. Changes
If we change this policy substantially we will publish a new version and, where the law requires it, ask you to agree again. The version this page shows is 2026-08-02.