1. Who we are
[Registered business name] ("[Your Name] Coaching", "we") is the responsible party (data controller) for personal information collected through https://stephanie.partnerme.app. Registration number: [Registration number, if registered]. Address: [Registered address]. Our Information Officer / data protection contact is [Name of Information Officer], reachable at privacy@your-domain.example.
We follow the Protection of Personal Information Act 4 of 2013 (POPIA) in South Africa. If you visit from the United Kingdom or European Economic Area we also respect your rights under the UK GDPR / GDPR and PECR.
2. What we collect and why
| Where | What | Why | Lawful basis |
|---|---|---|---|
| Application and contact forms | Name, email, phone/WhatsApp, goals, answers you choose to give, optional CV | To reply, assess fit and arrange a strategy call | Your consent; steps at your request before a contract |
| Newsletter | Name, email, interests | To send the newsletter and updates you asked for | Consent (you can withdraw at any time) |
| Cookie choices | Random ID, choices, time, hashed network address | To prove and respect your cookie preferences | Legal obligation / legitimate interest |
| Analytics (only if accepted) | Pages viewed, device and approximate location | To improve the website | Consent |
| Security | Hashed network address in short-lived rate-limit records | To prevent abuse and spam | Legitimate interest |
Please do not include health or medical details in the forms. If we need such information to coach you safely, we will ask for it separately and only with your explicit consent.
3. How we protect your information
Personal information is encrypted at rest using AES-256-GCM, transmitted over HTTPS, protected by access controls, multi-factor authentication for administrators and rate limiting. Passwords are stored as salted one-way hashes. We keep a breach register and will notify the Information Regulator and affected people as required by law.
4. Who we share it with (operators / processors)
| Provider | Purpose | Country | Transfer safeguard |
|---|---|---|---|
| PartnerMe AI (hosting) | Hosting the website and database | [Hosting country - confirm] | Operator agreement; [UK adequacy / IDTA / EU SCCs where applicable] |
| Resend | Sending emails | United States | Data processing agreement; UK IDTA / UK Addendum and EU SCCs |
| Google Analytics (only if accepted) | Website analytics | United States and other countries | Data processing terms; UK-US data bridge / EU-US Data Privacy Framework and SCCs |
We never sell your information. We share it only with operators acting on our instructions, or when the law requires it.
5. International transfers
Some providers process information outside South Africa. Where we transfer personal information across borders we ensure the recipient is bound by law, binding agreements or standard contractual clauses providing adequate protection, as required by section 72 of POPIA and, for UK/EU visitors, Chapter V of the UK GDPR / GDPR.
6. How long we keep it
- Applications and enquiries: until the matter is concluded, then for up to 3 years of inactivity before being anonymised.
- Newsletter: until you unsubscribe; unsubscribed records are anonymised after 12 months.
- Cookie consent records: up to 3 years as proof of your choices.
- Records we must keep by law (for example financial records, 5 to 7 years): for as long as the law requires.
7. Your rights
You may ask us to confirm what we hold about you and get a copy, correct it, delete or restrict it, object to its use, withdraw consent, and ask for portability (where applicable). Email privacy@your-domain.example and we will respond within 30 days. Every marketing email has an unsubscribe link and an email-preferences link.
You may complain to the South African Information Regulator (inforegulator.org.za). UK visitors may complain to the Information Commissioner's Office (ico.org.uk), and EU visitors to their local data protection authority.
8. Children
Our services are for people aged 18 and over. We do not knowingly collect personal information from children. Forms ask you to confirm your age. If you believe a child has given us information, contact us and we will delete it.
9. Cookies
See our Cookie Policy. Non-essential cookies are only used after you agree, and you can change your mind through "Cookie settings" in the footer.
10. Automated decisions
The "Find my path" quiz runs in your browser to suggest a coaching experience. No automated decision with legal or similar effect is made about you, and the answers are not stored unless you apply.
11. Changes
We will update this policy when our practices change. The date at the top shows the latest version.