Privacy Policy

THOR – The House of Rose (‘we’, ‘our’, or ‘us’) respects your privacy. This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, and what rights you have. It applies to information collected through www.thehouseofrose.com and in connection with our services.

If you are a resident of the European Economic Area (EEA) or United Kingdom, please see Section 12 (International Users) for additional rights. If you are a California resident, please see Section 13 (California Residents). If you are a New Jersey resident, please see Section 14 (New Jersey Residents).

1. Information We Collect

We collect information you give us directly and information generated by your use of our website.

1.1 Information You Provide

• Contact details: name, email address, phone number, mailing address
• Account credentials: username and password if you create an account
• Health intake information: fitness level, medical conditions, injuries, dietary needs (collected only to tailor wellness services and never sold)
• Payment information: billing name, address, and payment card details (processed by our PCI-compliant payment processor; we do not store full card numbers)
• Communications: messages you send us via contact forms, email, or chat
• Testimonials or reviews you choose to submit

1.2 Information Collected Automatically

• IP address and approximate geolocation
• Browser type, operating system, and device identifiers
• Pages visited, time spent, links clicked, referring URLs
• Cookie and tracking technology data (see our Cookie Policy for details)

1.3 Information from Third Parties

• Social media platforms when you interact with our pages or use social login
• Analytics providers (e.g., Google Analytics)
• Payment processors (transaction confirmation only)

2. How We Use Your Information

We use your information for the following purposes, each grounded in a lawful basis (where applicable under GDPR):

To provide and fulfill our services (contractual necessity): process bookings, communicate about sessions, deliver programs you have purchased.

To personalize wellness services (legitimate interest / consent): use health intake information to tailor yoga, training, and coaching programs to your needs.

To operate and improve our website (legitimate interest): analyze usage patterns, fix bugs, improve user experience.

To communicate with you (legitimate interest / consent): respond to inquiries, send booking confirmations, and where you have opted in, send marketing emails.

To comply with legal obligations: retain records as required by law, respond to lawful requests from authorities.

To protect safety and prevent fraud (legitimate interest): monitor for suspicious activity and enforce our Terms of Service.

3. Marketing Communications

We send marketing emails only with your consent. Every marketing email includes a clear unsubscribe link at the bottom of each email. You can also opt out at any time by emailing us at [terry @ thehouseofrose.com]. Processing an opt-out may take up to 10 business days for operational systems to update. Opting out of marketing does not affect transactional communications related to your purchases.

4. Cookies and Tracking Technologies

We use cookies and similar technologies. You can manage your preferences through our cookie consent tool, which appears when you first visit the site. See our Cookie Policy for a full description of cookies used, their purposes, and how to control them.

5. How We Share Your Information

We do not sell, rent, or trade your personal information. We share it only as described below:

• Service providers: payment processors, booking platforms, email delivery services, cloud hosting providers, and analytics providers, all bound by data processing agreements limiting their use of your data.
• Professional advisors: attorneys and accountants under confidentiality obligations.
• Legal requirements: when required by law, subpoena, court order, or to protect the rights, property, or safety of The House of Rose, our clients, or the public.
• Business transfers: if we merge with or are acquired by another entity, your data may be transferred as part of that transaction. We will notify you before your data is subject to a materially different privacy policy.

We do not share your health intake information with any third party for advertising or commercial purposes.

6. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this policy and to comply with our legal obligations. Booking records are retained for 7 years in compliance with applicable tax and business record laws. Health intake forms are retained for the duration of your engagement with us plus 3 years. You may request deletion of your data, subject to our legal retention obligations (see Section 8).

7. Data Security

We implement reasonable technical and organizational measures to protect your personal information, including SSL/TLS encryption for data in transit, access controls, and regular security assessments. However, no method of transmission over the internet or electronic storage is completely secure. We cannot guarantee absolute security. If we become aware of a data breach that affects your rights, we will notify you as required by applicable law.

8. Your Rights and Choices

Depending on where you live, you may have rights including:

• Access: request a copy of the personal information we hold about you.
• Correction: request that we correct inaccurate or incomplete information.
• Deletion: request that we delete your information, subject to certain exceptions.
• Portability: receive a machine-readable copy of information you have provided.
• Objection / Restriction: object to certain processing or request that we restrict use of your data.
• Withdraw consent: where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at [terry @ thehouseofrose.com]. We will respond within the timeframe required by applicable law (e.g., 45 days under CCPA/CPRA; 30 days under GDPR; 45 days under NJDPA). We may ask you to verify your identity before processing a request.

9. Children’s Privacy

Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal information from children under 13. If we discover that we have inadvertently collected such information, we will delete it promptly. If you believe a child has provided us with personal information, please contact us at [terry @ thehouseofrose.com].

10. Third-Party Links

Our website may link to third-party websites. We are not responsible for the privacy practices of those sites. We encourage you to review the privacy policies of any site you visit.

11. Changes to This Policy

We may update this Privacy Policy periodically. When we do, we will post the revised version on this page with an updated effective date. If changes are material, we will provide notice by email or a prominent notice on the site at least 30 days before the changes take effect.

12. International Users (EEA / UK)

If you are located in the European Economic Area or the United Kingdom, the following additional terms apply.

Data Controller: The House of Rose, 99 Grayrock Road, Clinton, New Jersey, USA.

Legal Bases: We process your personal data on the bases of contractual necessity, legitimate interests, legal obligation, and consent, as described in Section 2.

International Transfers: Your data may be transferred to and processed in the United States. Where required, we rely on Standard Contractual Clauses (SCCs) adopted by the European Commission to protect such transfers. You may request a copy of these clauses by contacting us.

EEA/UK Supervisory Authority: You have the right to lodge a complaint with your local data protection authority. In the UK, that is the Information Commissioner’s Office (ico.org.uk).

13. California Residents (CCPA / CPRA)

If you are a California resident, in addition to the rights described in Section 8 you have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

• Right to Know: request disclosure of the categories and specific pieces of personal information collected, sources, business purposes, and categories of third parties with whom we share information.
• Right to Delete: request deletion of your personal information, subject to certain exceptions.
• Right to Correct: request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: we do not sell or share personal information for cross-context behavioral advertising. If this changes, we will provide a ‘Do Not Sell or Share’ link.
• Right to Limit Use of Sensitive Personal Information: we do not use sensitive personal information for purposes beyond those permitted under CPRA.
• Right to Non-Discrimination: we will not discriminate against you for exercising your privacy rights.

To submit a request, contact us at [terry @ thehouseofrose.com]. We will verify your identity before processing your request. California residents may also designate an authorized agent to make requests on their behalf.

Global Privacy Control (GPC): we honor GPC opt-out signals as a valid exercise of your right to opt out of sale/sharing of personal information.

14. New Jersey Residents (NJDPA)

If you are a New Jersey resident, the New Jersey Data Protection Act (effective January 15, 2025) grants you the following rights:

• Right to access, correct, delete, and obtain a portable copy of your personal data.
• Right to opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects.
• Right to appeal: if we decline your request, you may appeal by contacting us at [terry @ thehouseofrose.com]. If your appeal is denied, you may contact the New Jersey Division of Consumer Affairs.

We do not process ‘sensitive data’ (as defined under NJDPA, including health information, precise geolocation, or racial/ethnic origin) without your explicit consent.

Global Privacy Control (GPC): we treat a GPC signal as an opt-out of targeted advertising and sale of personal data for New Jersey residents.

15. Contact Us

For privacy questions, to exercise your rights, or to reach our privacy team:

Privacy Contact: Terry Tateossian
THOR – The House of Rose
99 Grayrock Road, Hampton, New Jersey 08809
Email: [terry @ thehouseofrose.com]
Phone: 908 – 200 – 8678
Website: www.thehouseofrose.com/contact-us