| Data controller | Viola de Boer |
| Trading name | Flow & Focus Coaching |
| info@studioflowandfocus.com | |
| Chamber of Commerce | 94503974 |
This notice covers studioflowandfocus.com, its contact form and the services of Flow & Focus Coaching. It explains whose personal data is used, why it is needed, the legal basis for using it, who receives it and how long it is kept.
1. Who is responsible?
Viola de Boer, trading as Flow & Focus Coaching, determines the purposes and means of processing personal data within the coaching practice and through the website. She is therefore the controller under the General Data Protection Regulation (GDPR).
For privacy questions or to exercise your rights, email info@studioflowandfocus.com.
2. Whose personal data is used?
Flow & Focus Coaching uses personal data about:
- visitors to studioflowandfocus.com;
- people who get in touch or ask about coaching;
- personal and business coaching clients, including clients aged 16 or 17;
- parents or legal representatives of a client aged 16 or 17, where their information is needed for the agreement, payment or practical arrangements;
- contacts at commissioning organizations, prospective clients and other business contacts;
- people who consent to having a review published;
- people who submit a complaint, privacy request or other legal inquiry.
3. What data is processed, why and on what legal basis?
Ordinary personal data needed for coaching is processed to perform the coaching agreement. Consent is not sought as the GDPR legal basis for this processing. Consent is used only where separately required, particularly for special category personal data and publication of reviews.
3.1 Website visitors
| Processing and purpose | Personal data | Legal basis |
|---|---|---|
| Displaying and operating the website; preventing, detecting and addressing misuse, attacks and technical issues; obtaining limited insight into website use. | IP address; date and time of the request; requested page or URL; browser, device and operating system information; language and request headers; technical session, routing and security identifiers; an encrypted bot score and, where enabled, a session identifier in the __cf_bm cookie. | Legitimate interests (Article 6(1)(f) GDPR): providing a secure, available and properly functioning website and obtaining an overall understanding of its use. |
| Loading and securing the contact page and its embedded Microsoft Forms form. | IP address; browser and device information; technical session and security data; the security token in the __RequestVerificationToken cookie. Following submission, a response number, start and completion times and the resulting completion duration are also recorded. | Legitimate interests (Article 6(1)(f) GDPR): providing a secure and reliable contact channel and protecting against misuse and forged requests. |
3.2 People who get in touch or request an introductory call
| Processing and purpose | Personal data | Legal basis |
|---|---|---|
| Answering questions, maintaining contact and, where requested, arranging an introductory call. | Name, email address, selected subject, optional telephone number and brief explanation, appointment details and subsequent correspondence. | Steps taken prior to entering into a contract or performance of a contract (Article 6(1)(b) GDPR) where the inquiry concerns coaching. For general or business correspondence: legitimate interests (Article 6(1)(f) GDPR) in answering questions and maintaining a business relationship. |
3.3 Coaching clients
| Processing and purpose | Personal data | Legal basis |
|---|---|---|
| Entering into an agreement, verifying identity and age where necessary, scheduling appointments and communicating. | Name, contact details, age or date of birth only where needed to verify the minimum age requirement, appointment details, the agreement and practical correspondence. | Performance of the coaching agreement (Article 6(1)(b) GDPR). |
| Intake, delivery and evaluation of the coaching program. | Topics you want to work on, goals, intake responses, agreed actions and exercises, feedback on progress, attendance and limited coaching notes. For organizational coaching, the client's organization and role may also be recorded. | Performance of the coaching agreement (Article 6(1)(b) GDPR). |
| Adapting the coaching where a client voluntarily shares information about stress, mental or physical wellbeing, or other health information. | Only special category personal data that the client shares voluntarily and that is relevant to the agreed coaching goal. As little information as possible is recorded. No medical record, diagnosis or treatment information. | Performance of the coaching agreement (Article 6(1)(b) GDPR) and, for health data or other special category personal data, explicit consent (Article 9(2)(a) GDPR). |
3.4 Parents or legal representatives
| Processing and purpose | Personal data | Legal basis |
|---|---|---|
| Arranging the agreement, payment and practical matters for a client aged 16 or 17, where necessary. | Name, contact details, relationship to the minor, consent to or signature of the agreement where required, invoice and payment details, and practical correspondence. | Performance of a contract (Article 6(1)(b) GDPR) and, for practical coordination not directly arising from a contract, legitimate interests (Article 6(1)(f) GDPR) in delivering the program with appropriate care. |
3.5 Contacts at organizations and other business contacts
| Processing and purpose | Personal data | Legal basis |
|---|---|---|
| Assessing business inquiries, preparing, delivering and administering an assignment, and coordinating practical matters. | Name, organization, role, business email address and telephone number, quotation and agreement details, invoice details, appointment details, correspondence and administrative information agreed in advance, such as attendance. | Performance of a contract or steps prior to entering into a contract (Article 6(1)(b) GDPR) where the contact is a contracting party. Otherwise: legitimate interests (Article 6(1)(f) GDPR) in business communication and delivery of the assignment. |
3.6 Invoicing, payments and administration
| Processing and purpose | Personal data | Legal basis |
|---|---|---|
| Issuing invoices, processing payments, maintaining financial records and complying with tax obligations. | For the client, paying parent or organization: name, address where required on an invoice, email address, organization and contact details, Chamber of Commerce and VAT numbers where applicable, invoice number, date and description of the service, amount, VAT, payment status, IBAN and transaction details. | Performance of a contract (Article 6(1)(b) GDPR) and compliance with a legal obligation (Article 6(1)(c) GDPR), including tax record-keeping and retention requirements. |
3.7 Reviews
| Processing and purpose | Personal data | Legal basis |
|---|---|---|
| Publishing a client's experience on the website. | The review text, first name, initials or other agreed attribution. | Consent (Article 6(1)(a) GDPR). Consent may be withdrawn for future use. If a review contains special category personal data, it is published only with explicit consent (Article 9(2)(a) GDPR). |
3.8 Complaints, privacy requests and legal matters
| Processing and purpose | Personal data | Legal basis |
|---|---|---|
| Handling a complaint or privacy request and establishing, exercising or substantiating rights, obligations or claims. | Name, contact details, correspondence, the content of the request or complaint, relevant file information and, only where reasonably necessary, additional information to verify identity. An identity document is not requested or retained as standard. | Compliance with a legal obligation (Article 6(1)(c) GDPR) for handling GDPR requests. For complaints and protection of legal rights, depending on the circumstances: performance of a contract (Article 6(1)(b) GDPR) or legitimate interests (Article 6(1)(f) GDPR). |
4. Where does the information come from, and what is required?
Most information comes directly from you. Technical data is generated automatically when you visit the website or use the contact form. Payment information may also come from the bank or a payment transaction.
For coaching arranged through an organization, the organization may provide the client's name, role, business contact details and practical appointment information in advance. Substantive information about the client is not requested from the organization. Where information is first received through an organization, the client receives this privacy notice no later than the first direct contact.
Name, email address and inquiry subject are required in the contact form. Without this information, Flow & Focus Coaching cannot respond or direct the inquiry appropriately. Telephone number and explanation are optional. Coaching also requires the information necessary to arrange appointments, perform the agreement and issue invoices. Sharing special category personal data and providing a review are voluntary.
5. Special category personal data and clients aged 16 or 17
Flow & Focus Coaching provides coaching, not medical or psychological treatment. No diagnoses are made and no medical records are created. During coaching, a client may voluntarily share information about stress or mental or physical wellbeing. This is recorded only where relevant to the agreed coaching goal and with explicit consent. Consent may be withdrawn for future processing. This does not affect the lawfulness of processing carried out before withdrawal.
Please do not include medical information or other sensitive personal data in the public contact form. A brief, general description of what you would like help with is enough.
Personal coaching is available from age 16. For clients aged 16 or 17, only information needed to check the age requirement is recorded. A parent's or legal representative's details may be necessary for entering into the agreement, payment or practical arrangements. Coaching content is not shared with a parent, guardian or commissioning organization unless the client gives specific consent or disclosure is legally required.
6. Website, contact form and cookies
6.1 Website hosting
The website is hosted using ChatGPT Sites. OpenAI Ireland Limited processes hosted website data and the technical data needed to deliver, maintain, secure and support the website on behalf of Flow & Focus Coaching. Flow & Focus Coaching has not added tracking technology or advertising cookies to the website. Limited usage data is processed within the hosting environment and made available in aggregated form for website management. This information is not used to profile individual visitors or for marketing.
6.2 Cookies
| Cookie | Who sets it? | Purpose and data | Duration / consent |
|---|---|---|---|
| __cf_bm | Cloudflare within OpenAI's hosting chain | Protection against bots and misuse. Contains an encrypted bot score and, where enabled, a session identifier; no tracking across websites or sessions. | 30 minutes after inactivity. Strictly necessary; no consent required. |
| __RequestVerificationToken | Microsoft Forms | Protection against forged form requests and association with the correct form session. Secured and inaccessible to scripts. | Until the end of the browser session. Strictly necessary; no consent required. |
6.3 Microsoft Forms contact form
The contact form is embedded in the contact page as a Microsoft Forms form and is part of Flow & Focus Coaching's business Microsoft 365 environment. You do not need to sign in to a Microsoft account to complete it. Submitted responses are available to Flow & Focus Coaching in Microsoft Forms. An email notification indicates a new submission.
When the embedded form loads, the browser connects directly to Microsoft. Microsoft processes the form contents, response number, start and completion times, completion duration and technical data needed to deliver and secure the service. Data is encrypted in transit and at rest. Flow & Focus Coaching does not use this information for visitor analytics.
6.4 Instagram
The website contains only a standard link to Instagram. No Instagram feed, pixel or other Meta component is embedded in the website. Only when the link is clicked does the visitor leave the website, at which point Meta processes data under its own privacy policy.
7. Who receives personal data?
Personal data is shared only where necessary for the purposes described below.
| Recipient | Data and purpose |
|---|---|
| OpenAI Ireland Limited and hosting subprocessors, including Cloudflare | Hosted website content and technical request, device, network and security data relating to visitors, for website hosting, content delivery, maintenance, security and support. |
| Microsoft | Contact form data, email and calendar information, online appointments and video calls, files and client correspondence for Microsoft Forms and Microsoft 365. Microsoft acts as a processor for these business services. |
| MoneyMonk B.V. and its subprocessors | Customer, invoice, payment and administrative data for invoicing and financial administration. |
| Bank and payment services | Name, IBAN, amount, date, payment description and transaction details for receiving and recording payments. The bank also processes data under its own legal responsibilities. |
| Commissioning organization for business coaching | Only practical or administrative information agreed in advance, such as attendance or overall program status. The organization receives no session content, coaching notes or special category personal data without specific consent or a legal obligation. |
| Competent public authorities or regulators | Only information that must be provided where a specific legal obligation, binding order or legally valid demand requires it. |
8. Transfers outside the European Economic Area
Microsoft 365 and Microsoft Forms content for the Dutch business tenant is generally stored and processed within the EU/EFTA region. The arrangements for MoneyMonk are described below. For website hosting, OpenAI and its subprocessors may process data outside the EEA. Microsoft may also allow access or processing outside the EU/EFTA region in limited circumstances.
| Service | Location and nature of processing | Transfer safeguard |
|---|---|---|
| ChatGPT Sites / OpenAI | OpenAI Ireland Limited is the contracting processor for EEA data. Hosting, infrastructure, moderation and support subprocessors may process data in the EEA and elsewhere, including the United States, United Kingdom, Canada, Australia, Brazil, India, Indonesia, Japan, Malaysia, Mexico, Singapore, South Korea, United Arab Emirates, South Africa and the Philippines. The subprocessor used depends on the hosting or support function. A data processing agreement is in place between the controller and OpenAI. | A European Commission adequacy decision where available; for other transfers, the European Commission's standard contractual clauses (SCCs) under Article 46 GDPR, as included in the OpenAI Data Processing Addendum. |
| Cloudflare | Cloudflare generally processes traffic in a data center close to the visitor. Data from the security cookie may also be processed in the United States. | Cloudflare uses the EU-US Data Privacy Framework where applicable and otherwise SCCs with supplementary safeguards. For this website, Cloudflare is a subprocessor within OpenAI's hosting chain. |
| Microsoft 365 and Microsoft Forms | Customer data and pseudonymised personal data for an EU/EFTA tenant are stored and processed within the EU Data Boundary. Limited transfers or access from outside the region may occur for global security, network routing, identity and directory services, technical support and user-initiated communication with people outside the region. Remote access is restricted and encrypted and, according to Microsoft, generally does not result in persistent storage at the remote access point. | An adequacy decision where available, and SCCs in the Microsoft Products and Services Data Protection Addendum for other transfers, together with technical and organizational security measures. |
| MoneyMonk | All personal data, hosting and backups are located within the EU. A US provider is used only for email functionality. | Transfers take place on the basis of an adequacy decision. A data processing agreement is in place with the provider. |
For more information about a specific transfer, email info@studioflowandfocus.com. The providers publish the relevant terms and current subprocessor information online:
- OpenAI Data Processing Addendum
- Current OpenAI subprocessor list
- Microsoft EU Data Boundary
- MoneyMonk data processing agreement
9. How long is information kept?
Personal data is retained no longer than necessary for its purpose. A statutory retention requirement, ongoing dispute or specific legal claim may require longer retention. Data is then deleted or anonymized.
| Data | Retention period or criterion |
|---|---|
| A contact message or introductory call that does not lead to coaching | 6 months after the last substantive contact. |
| Microsoft Forms submission | Where no coaching program follows: 6 months after the last substantive contact. Where coaching begins, necessary information is added to the client file and the Forms submission is deleted within 1 month of that transfer. The response number, timestamps and completion duration are deleted with the submission. |
| Contact, appointment and intake details, practical correspondence and limited coaching notes | 2 years after the final coaching session. |
| Special category personal data in coaching notes | No longer than the coaching notes, and earlier once no longer needed or consent is withdrawn, unless another legal basis requires retention. |
| Agreement and essential contractual correspondence | 5 years after the end of the program, where needed as evidence of agreements or for a specific legal claim. |
| Invoices, payment details and tax records | 7 years after the end of the financial year to which the information relates. |
| Business contact details | During the business relationship and for up to 2 years afterward. Information in contractual or tax records follows the applicable longer retention period. |
| Review and consent record | The review remains published until consent is withdrawn or it is removed for another reason. The consent record is retained while the review is used and for up to 5 years after removal, where necessary to demonstrate that the previous publication was lawful. |
| Complaints and privacy requests | 2 years after final resolution, or longer while legal proceedings or a specific legal claim are ongoing. |
| __cf_bm cookie | 30 minutes after the last activity. |
| __RequestVerificationToken cookie | Until the end of the browser session. |
| Technical hosting and security data | Flow & Focus Coaching does not retain its own copy of raw hosting logs. Within the hosting chain, technical data is retained for as long as needed to deliver, secure and manage the website. Limited aggregated usage data may be available within the hosting environment for as long as the website is in use. Once hosting ends, hosted personal data is deleted or returned under OpenAI's data processing terms, except where retention is legally required. |
10. Security
Flow & Focus Coaching takes technical and organizational measures appropriate to the small practice and the sensitivity of the data. These include:
- encrypted HTTPS connections for the website and encryption in transit and at rest within Microsoft 365 and Microsoft Forms;
- a business Microsoft 365 environment with strong access security and multifactor authentication;
- access to client information limited to the coach and providers performing their defined tasks;
- a password-protected device, automatic screen locking, up-to-date software and standard malware protection;
- data minimization: limited coaching notes and as little sensitive information as possible in emails and forms;
- separation of substantive coaching notes from financial records;
- periodic deletion based on retention periods and a procedure for security incidents and personal data breaches;
- no recording or automatic transcription of coaching conversations without a separate prior agreement and a valid legal basis.
11. Your privacy rights
Depending on the circumstances, you may request:
- access to your personal data;
- correction of inaccurate or incomplete information;
- erasure of data;
- restriction of processing;
- portability of data processed on the basis of consent or a contract;
- to object to processing based on legitimate interests;
- withdrawal of consent for future processing.
Requests can be sent to info@studioflowandfocus.com. Flow & Focus Coaching responds without undue delay and generally within one month. For complex or multiple requests, this period may be extended by up to two further months; the reasons for the extension will be provided within the first month. Additional information to verify identity may be requested only where reasonably necessary to prevent misuse. Requests are generally handled free of charge.
If a request is not acted upon, the reasons will be explained within one month, together with information about the right to complain to the Dutch Data Protection Authority or seek a judicial remedy.
A complaint may be submitted to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
12. Automated decision-making
Flow & Focus Coaching does not make decisions based solely on automated processing or use profiling that produces legal effects or similarly significantly affects a person.
13. Contact
Flow & Focus Coaching, Viola de Boer
Email: info@studioflowandfocus.com
Chamber of Commerce: 94503974
Website: studioflowandfocus.com
Last updated: 23 August 2026