Privacy Policy
English translation for convenience; the Hebrew version governs. Read the Hebrew version
1. Who we are and why this document exists
This Policy explains what personal information we collect on the Journey to Inner Truth website and in the workshop, for what purposes, who we share it with, how long it's kept, and what your rights are. It was written in accordance with Israel's Privacy Protection Law, 5741-1981 (as amended by Amendment 13, which took effect in August 2025), and the Privacy Protection (Data Security) Regulations, 5777-2017.
Data controller (the party that determines the purposes of the processing): Company No. 513494302, address 3 Inbar St., Caesarea, Israel.
Privacy contact: email [email protected].
2. The key points in brief
- We collect only the information needed for registration, payment, running the workshop, and keeping participants safe.
- There's no payment on the Site, and no credit card details are entered on it. Payment is made directly to the Operator, after a fit call.
- Questionnaire answers and the mental-health declaration are sensitive information. They're collected only with your express consent, stored with restricted access, and deleted or anonymized at the end of the set period.
- An employer or organization will not receive identifying information about you unless you've expressly agreed to it in writing.
- Marketing messages are sent only if you checked the consent box, and you can withdraw that consent at any time.
- The Site doesn't use advertising cookies or tracking and analytics tools. Details in Section 9.
3. What information is collected and why
| Type of information | When it's collected | Purpose | Is it required? |
|---|---|---|---|
| Full name, phone, email | Registration form | Identification, contacting you, reminders, transaction confirmation, and invoice | Yes. Without it you can't register |
| Track chosen | Registration form | Calculating the price and tailoring the service | Yes |
| “How did you hear about us?” | Registration form | Improving marketing, in aggregate analysis | No (optional) |
| Free-text note (up to 1,000 characters) | Registration form | Information you chose to give the Facilitator | No (optional). Please don't include health information |
| Acceptance of the Terms, Terms version, and time of acceptance | At registration | Documenting consent and complying with the law | Yes |
| Your choice about marketing messages | At registration | Sending advertising only to those who agreed | Your choice is free |
| Client-area access code (stored only as an encrypted hash) | After registration | Verifying login | Yes, to use the client area |
| Registration status, amounts paid, and payment IDs | At payment | Bookkeeping, deposit and balance, refunds | Yes |
| Messages to the Facilitator through the client area (up to 2,000 characters) | If you choose | Answering questions | No (optional) |
| Informed-consent form and mental-health declaration | Before the first session | Checking fit and safety, and preparing for emergencies | Yes, as a condition of participation. See Section 4 |
| Emergency contact (name and phone) | In the consent form | Contacting them in an emergency only | Yes, as a condition of participation |
| Entry, follow-up, and exit questionnaires (for example, rating items and “inner truth” measures) | During the workshop | Personal feedback and, with separate consent, research and workshop improvement through anonymous analysis | No (optional). You can take part in the workshop without filling them out |
| Communication in the WhatsApp group (follow-up package) | After the workshop | Support and practice | No (optional). Joining the group exposes your phone number to the other group members |
Source of the information. You give us most of the information directly. The payment processor sends us confirmation that the payment was made and a transaction ID.
You are not legally required to give us any information. Providing it is up to you and your consent. Anyone who doesn't provide the information marked “required” won't be able to register for or take part in the workshop, because that information is needed to provide the service or to keep people safe.
4. Sensitive information - express consent and special protections
Under the Privacy Protection Law, information about health, including mental health, information about beliefs and worldview, and information about personality assessment using assessment tools are “information of special sensitivity.” The mental-health declaration and questionnaire answers may include such information, so the following rules apply to them:
- Separate, express consent. The information will be collected only after you've agreed to it in a dedicated box in the informed-consent form. Consent to using questionnaires for research and workshop improvement is given separately, and you can decline it without affecting your participation.
- Minimization. We'll ask only what's needed to check fit and safety. You don't need to describe diagnoses or treatments beyond what the form requires.
- Participant code. Follow-up questionnaires will be filled out under a participant code, not under your name. The table linking the code to the name is kept separately, and only the Facilitator has access to it.
- Restricted access. Only the Facilitator, and the co-facilitator if there is one, may access the information, to the extent their role requires and under a duty of confidentiality.
- No transfer to the organization. In an organizational track, the organization will receive only an aggregate, anonymous report. The report will be produced only when the group has at least 5 participants, and it won't include quotes or details from which a participant could be identified. Personal information will be passed to the organization only with your express written consent.
- Legal obligations. If there's a real danger to your life or someone else's, or where there's a legal duty to report, we may give minimal information to emergency services or the authorities, only to the extent strictly necessary.
5. Basis for using the information
The information is used only for the purposes listed in Section 3 and for purposes closely related to them. We won't use it for any other purpose without informing you and getting your consent where required. We don't sell or rent personal information.
6. Who we share information with
We share information only with the following parties, and only to the extent needed:
| Party | Role | Information shared | Location |
|---|---|---|---|
| Payment processor | Processing payment | Name, email, phone, amount, and registration ID. Card details are entered with the processor directly | - |
| Hosting provider | Hosting the Site and database | All information stored in the system | - |
| Email or messaging provider | Sending confirmations, reminders, and marketing messages (to those who agreed) | Name, email, phone | - |
| Invoicing system | Issuing invoices and receipts | Name, transaction details, and ID number where required by law | - |
| WhatsApp (Meta) | The follow-up group, only for those who choose to join | Phone number and message content | Outside Israel. Subject to WhatsApp's privacy policy |
| Google Fonts (Google) | Displaying fonts on the Site | IP address and technical browser data | Outside Israel. We recommend hosting the fonts on the Site's own server to eliminate this transfer |
| Competent authorities and emergency services | Legal obligation or saving lives | The minimum required | Israel |
| Professional advisers (accountant, attorney) | Advice, under a duty of confidentiality | As needed | Israel |
Every provider that processes information on our behalf will sign an agreement requiring it to maintain confidentiality and security, use the information only according to our instructions, and delete it when the engagement ends, as required by Regulation 15 of the Data Security Regulations.
7. Transferring information outside Israel
Some providers may store or process information outside Israel - for example, cloud, payment, email, and WhatsApp providers. Such transfers will be made only in accordance with the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001. That means: to a country with adequate data protection, or where the provider has committed in writing to protect the information in accordance with Israeli law, or with your consent.
8. How long information is kept
| Information | Retention period |
|---|---|
| Registration and contact details | Up to two years after the last workshop you took part in, then deleted. You can ask for earlier deletion, subject to legal retention obligations |
| Payment records, invoices, and receipts | For the period required by tax law and bookkeeping rules |
| Health declaration and consent form | Up to 12 months after the workshop ends (including the follow-up package), then securely deleted. If an unusual incident occurred, the relevant forms will be kept until it has been fully handled or until the limitation period ends, according to legal advice |
| Questionnaires (under a code) | The identifiable version is kept for up to 12 months after the workshop ends, then deleted or permanently anonymized. Anonymous data is kept for research only if you agreed to it |
| Messages to the Facilitator | Up to 12 months |
| Security records (logs) | At least 24 months, in accordance with the Data Security Regulations |
| Consent to marketing messages | For as long as the consent is in effect, and after it's withdrawn, as needed for documentation |
At least once a year, we'll check whether we're holding information that's no longer needed, and delete it.
9. Cookies, browser storage, and third-party tools
Local browser storage. The Site stores in the browser's temporary memory (sessionStorage) a registration ID, access code, email address, and a client-area login token that's valid for two hours. This information is needed for the Site to work, and it's deleted when you close the browser tab. It's recommended not to store the access code itself in the browser.
Cookies and analytics tools. As of the writing of this Policy, the Site doesn't use cookies, analytics tools, or advertising pixels. If such tools are added in the future, they'll be activated only after getting prior consent through a cookie banner, in line with the Privacy Protection Authority's position on consent, and this Policy will be updated.
Fonts. The Site loads fonts from Google's servers, so your IP address is disclosed to Google.
10. Marketing messages
We'll send you advertising only if you've given express consent. Every marketing message will be labeled “advertisement,” include the Operator's details, and make it easy to unsubscribe, as required by Section 30A of Israel's Communications (Telecommunications and Broadcasting) Law, 5742-1982. You can ask to be removed at any time, free of charge and without giving a reason. Service messages about a workshop you registered for are not advertising.
11. Data security
We take reasonable measures to protect the information in accordance with the Data Security Regulations. These measures include:
- Encrypted communication (HTTPS).
- A Content Security Policy (CSP) and rate limiting.
- Storing the access code as a hash only.
- Restricted file access permissions.
- A database definitions document and a security-incident procedure.
- Encrypted backup.
Sensitive information (declarations and questionnaires) will be stored separately from registration details and encrypted. If a serious security incident occurs, we'll act in accordance with Regulation 11 of the Data Security Regulations, including reporting to the Privacy Protection Authority where required.
No system is completely immune, so we can't guarantee absolute protection against intrusion.
12. Your rights
Your rights under the Privacy Protection Law:
- Access. To review the information held about you (Section 13 of the Law). There may be limited exceptions set by law.
- Correction or deletion. To ask that information that is inaccurate, incomplete, unclear, or out of date be corrected or deleted (Section 14 of the Law).
- Unsubscribing. To ask to be removed from a direct-marketing mailing list.
- Withdrawing consent. To withdraw at any time consent you gave to processing sensitive information or to using questionnaires for research. Withdrawal doesn't affect processing done before it, and is subject to legal retention obligations.
You can submit requests to the privacy contact listed in Section 1. We'll respond within 30 days. If you're not satisfied with the response, you can contact the Privacy Protection Authority at the Ministry of Justice.
13. Minors
The adult workshop and the registration site are intended for people 18 and over. Information about minors in the “Belonging to Myself” youth workshop is collected only with the consent of a parent or guardian, in accordance with the dedicated consent documents, and kept to a minimum. In the youth workshop, sensitive information about a minor will not be collected unless it's necessary for their safety, and with their parent's consent.
14. Changes to this Policy
We'll update this Policy if the way information is collected, the way it's used, or our providers change. The date of the update will appear at the top of the document. We'll notify registered participants of any significant change by email.