Privacy Policy

1 Who We Are and How to Reach Us

The controller responsible for the processing of your personal data in connection with this website is:

State Offline runs 144-minute ambient meditation sessions. The website is published at stateoffline.com.

If you have any questions about how your personal data is handled, or if you wish to exercise any of your rights under applicable data protection law, you are welcome to reach us at the contact details above.

2 The Legal Framework

The processing of personal data in connection with this website is governed by:

Where we refer to a legal basis for processing in this policy, we refer to the bases set out in Article 6 GDPR.

3 General Principles

We process personal data only to the extent necessary for clearly defined purposes. We collect only what is needed. We do not sell personal data. We do not share personal data except as described in this policy.

Where data is shared with service providers, we ensure that appropriate safeguards are in place and that those providers process data only on our documented instructions.

4 Categories of Personal Data We Process

Depending on how you interact with this website, the following categories of personal data may be processed:

No special category data within the meaning of Article 9 GDPR is processed through this website.

5 Contact Form and Email Enquiries

Not yet active. This website has no contact form. Enquiries reach us at the address in section 1.

When a contact route exists, the personal data you provide will be processed only in order to respond to your enquiry, on the basis of Article 6(1)(b) GDPR where your enquiry concerns a session, or Article 6(1)(f) GDPR in other cases.

This section will be updated with retention periods and recipients before any contact route opens.

6 Booking and Attendance

Not yet active. No sessions are on sale and no booking system is connected to this website.

When booking opens, this section will name the booking provider, the data it receives, the legal basis, the retention period and any transfer outside the EEA, before the first booking is taken.

Attendance is counted for capacity and safety. Attendance counts are numbers and are not linked to individuals.

No personal data is collected from you during a session.

The room is lightly scented, candlelit and hazed. If you are sensitive to scent or smoke, tell us at booking and we will seat you away from the source.

Until then, the request form on this website advances the interface only. Nothing you enter leaves your browser.

6a The Request Form on This Website

The form on the access page does not transmit anything. It has no network connection, no storage and no analytics attached to it.

What you type stays in the page until you close the tab. We do not receive it, and it is not saved to your device.

The form exists so the intake sequence can be shown before bookings open.

This section will be rewritten in full before the form is connected to anything.

6b Mailing List

Not yet active. No mailing list is running and this website has no sign-up form.

When a mailing list opens, subscription will be based on your consent under Article 6(1)(a) GDPR. You will be able to withdraw it from any message and from this page, and withdrawing will be as easy as subscribing.

This section will name the provider, what it receives, where it stores data and for how long, before the first address is collected.

7 Invoicing and Payment

Not yet active. This website does not process payment card data or any other payment information, and no payment transaction can be completed through it.

When sessions go on sale, invoicing data will be processed to meet statutory record keeping obligations under Article 6(1)(c) GDPR, and this section will state the retention period that applies.

8 Website Hosting

This website is hosted by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, United States, through its global edge network. Requests from visitors in Europe are served from European data centres.

Cloudflare, Inc. acts as a data processor for the purposes of hosting and delivering this website, on the basis of Cloudflare's Data Processing Addendum, which incorporates the EU Standard Contractual Clauses.

Legal basis: Article 6(1)(f) GDPR (legitimate interest in operating a functioning and secure website).

9 Server Logs

When you visit this website, your browser automatically transmits technical information that is recorded in server logs maintained by Cloudflare. This includes your IP address, the date and time of the request, the page requested, and your browser and operating system.

Server logs are processed for the purpose of ensuring the security and technical stability of the website, diagnosing errors, and defending against unauthorised access.

Legal basis: Article 6(1)(f) GDPR (our legitimate interest in maintaining a secure and functional website).

Server log data is not combined with other data sources for profiling purposes.

10 Cookies and Consent Management

This website uses cookies and comparable technologies. Cookies are small text files stored by your browser on your device.

Analytics is not activated until you accept it. If you decline, or if you make no choice, no analytics request is sent and no analytics cookie is set.

11 Google Tag Manager

This website uses Google Tag Manager, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Tag Manager is a tool for managing other tools. It does not itself create a profile of you and sets no cookies of its own.

Loading Tag Manager transmits your IP address to Google, which is technically unavoidable when any resource is requested from a server.

Tags that require consent are held until you give it. If you decline, Tag Manager loads but the analytics tag inside it does not run.

Legal basis: Article 6(1)(f) GDPR for loading the container, and Article 6(1)(a) GDPR for any tag that requires consent.

12 Google Analytics 4

If you accept analytics, this website uses Google Analytics 4, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Google Analytics records which pages are opened, how far they are scrolled, which links lead away from the site, approximate location at country or city level, and device and browser characteristics. It stores a randomly generated identifier in a cookie so repeat visits in the same browser can be recognised.

IP addresses are shortened by Google before storage. Advertising features and personalised advertising are switched off, and data is collected on European infrastructure.

Legal basis: Article 6(1)(a) GDPR (your consent). Event data is retained for 2 months and user-level data for 14 months, after which Google deletes it.

Google LLC in the United States may act as a further processor. Transfers rely on the EU Standard Contractual Clauses and the EU-US Data Privacy Framework.

13 Meta Pixel and Meta Conversions API

Not active. This website does not use the Meta Pixel, the Meta Conversions API, or any other Meta advertising technology.

If advertising begins, this section will name the tool, its legal basis and its transfers before the first tag is published.

14 Google Ads Conversion Tracking

Not active. This website does not use Google Ads conversion tracking.

If advertising begins, this section will be completed before the first tag is published.

15 Retention Periods

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law.

Your consent record is stored in your own browser and expires after twelve months. You can delete it at any time by clearing your browser data.

Server logs and analytics data are retained by the processors named above, under the settings described in their sections.

16 Recipients and Data Processors

Personal data is disclosed only to processors acting on our documented instructions, and only where necessary.

The processors used by this website are Cloudflare, Inc. for hosting and Google Ireland Limited for tag management and analytics.

No personal data is sold, rented or shared for the purposes of third party advertising.

17 International Data Transfers

Some processors named above are based in, or transfer data to, the United States.

Those transfers rely on the EU Standard Contractual Clauses adopted by the European Commission, and where applicable on the EU-US Data Privacy Framework.

You can request further information about the safeguards in place using the contact details in section 1.

18 Your Rights Under GDPR

You have the following rights in relation to your personal data:

To exercise any of these rights, contact us using the details in section 1. We respond within one month.

Exercising these rights is free of charge.

19 Right to Lodge a Complaint

If you believe that the processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with a supervisory authority.

Österreichische Datenschutzbehörde, Barichgasse 40-42, 1030 Vienna, Austria. dsb.gv.at

You may also complain to the supervisory authority in the country where you live or work.

20 Data Security

This website is served over an encrypted connection. We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss or alteration.

No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

21 Children

This website is not directed at children. Sessions are for adults.

We do not knowingly process the personal data of anyone under 16. If you believe we have, contact us and it will be deleted.

22 Updates to This Policy

This policy is updated when what we collect changes.

The version and date at the top of this page show when it last changed. Where a change affects what is collected under consent, we ask again rather than relying on a choice made under an earlier version.

1 What Are Cookies

Cookies are small text files that a website stores in your browser. They allow a site to recognise your browser on a later visit.

Comparable technologies, such as local storage, work differently but serve the same purpose and are treated the same way in this notice.

2 Our Consent Approach

Nothing that requires consent runs before you give it. Accepting and declining are equally easy, and declining is not penalised.

If your browser sends a Global Privacy Control signal, we treat it as a decline and do not ask again.

3 Strictly Necessary

One entry in your browser's local storage records your own consent choice, the time you made it, and the policy version it applied to.

Two further entries are kept only for the length of one visit: one notes that the threshold sequence has already played, so it is not replayed on every page, and one notes whether you have silenced the sound. Both are deleted when the tab closes, and neither is used to recognise you on a later visit.

It stays in your browser. It is never transmitted to us and never shared. It expires after twelve months.

4 Analytics Cookies

Set only if you accept analytics. Provided by Google Ireland Limited.

If you decline, neither cookie is set and no request is sent.

5 Marketing and Advertising Cookies

None. This website sets no advertising cookies and runs no advertising tools.

If that changes, this notice is updated and consent is asked again before any advertising tool runs.

6 Server-Side Tracking

None. This website performs no server-side tracking and operates no server-side tagging container.

7 Managing Your Preferences

You can change your choice at any time using the MEASUREMENT control in the footer of any page.

You can also delete stored data through your browser settings, which clears the consent record and any analytics cookies.

Withdrawing analytics consent reloads the page, because a script that has already run cannot be un-run.

8 Third-Party Opt-Out Tools

Google offers a browser add-on that prevents Google Analytics from collecting data on any website: tools.google.com/dlpage/gaoptout

Your browser's Do Not Track or Global Privacy Control setting is also honoured by this site.