Opens in a new tab

Book a Complimentary 20-minute assessment call

Privacy Policy

Last Updated: September 2026 | KvK Number: 42157799 | Rotterdam, The Netherlands

1. Data Controller & Grievance Contact

This Privacy Policy explains how Sonia Joseph Coaching (“we,” “us,” or “our”), operating under Dutch Chamber of Commerce (Kamer van Koophandel) registration number 42157799 out of Rotterdam, The Netherlands, processes, collects, and protects your personal information across soniajoseph.com, our web forms, self-assessment quizzes, and online coaching sessions.

  • Data Controller & Legal Entity: Sonia Joseph Coaching
  • KvK Registration: 42157799
  • Registered Business Seat: Rotterdam, The Netherlands
  • Official & Grievance Email: connect@soniajoseph.com
  • Appointed Grievance & Privacy Officer: Sonia Joseph

2. Personal Information We Collect

We process personal data gathered directly from you and automatically via technical interactions:

  • Inquiry & Consultation Form Data: Full name, email address, referral channel, and subjective reflections regarding challenges you are working through (e.g., people-pleasing, boundary-setting, overthinking, career decisions, or burnout) submitted via our native website forms.
  • Assessment Call & Session Booking Data: Name, email address, time zone, preferred schedule, and intake notes processed through Calendly.
  • Quiz & Self-Assessment Data: Answers, scores, and self-reported patterns submitted via interactive website quizzes, along with contact details provided to receive personalized results.
  • Financial & Transaction Data: Billing name, address, transaction totals, and card metadata handled directly via Stripe. Full credit/debit card numbers are processed directly by Stripe and are never stored on our servers.
  • Direct Electronic Correspondence: Inbound communications, session scheduling updates, and private coaching notes exchanged via our Google Workspace (Gmail) business account.
  • CRM Records: Communication timestamps, onboarding milestones, and administrative records organized within our Customer Relationship Management platform.
  • Marketing & Lead Magnet Records: First name and email address provided when opting into email insights or downloading guides.
  • Technical & Device Data: IP addresses, browser specifications, operating system details, and visit timestamps recorded automatically through server logs and cookies.

3. Processing of Sensitive & Health-Adjacent Information

Life coaching is not clinical psychotherapy, psychiatric intervention, or medical healthcare. However, in sharing personal challenges (such as emotional burnout, workplace stress, or interpersonal patterns), you may voluntarily disclose sensitive personal reflections. Under Article 9 of the EU GDPR, the UAE PDPL, and India’s DPDPA, this information is processed strictly on the basis of your explicit consent (GDPR Art. 9(2)(a)). It is utilized exclusively to deliver contextualized coaching guidance, maintained under strict professional confidentiality, and never disclosed or used for automated commercial profiling.

4. Purposes and Legal Bases for Processing (EU GDPR)

We process personal data under the following legal bases pursuant to Article 6(1) of the GDPR and the Dutch Implementation Act (Uitvoeringswet AVG):

  • Contractual Performance & Pre-Contractual Steps (Art. 6(1)(b)): Facilitating 20-Minute Assessment Calls, scheduling and conducting online coaching sessions, sending administrative session follow-ups, and managing payments.
  • Explicit Consent (Art. 6(1)(a)): Delivering opt-in downloadable resources, interactive quiz evaluations, email newsletters, and publishing voluntary testimonials. You may revoke consent at any time.
  • Legal Compliance (Art. 6(1)(c)): Retaining fiscal transaction documents, customer invoices, and payment confirmations for 7 years in accordance with Dutch statutory tax law (Rijksbelastingdienst).
  • Legitimate Interests (Art. 6(1)(f)): Securing digital platform operations, defending against fraudulent bookings, and responding to non-contractual business inquiries.

5. Third-Party Data Processors & Embedded Content

We share personal data only with third-party service providers bound by strict confidentiality obligations and Data Processing Agreements (DPAs):

  • Web Hosting: Hostinger International Ltd. (cloud hosting infrastructure and web server security).
  • Webforms: Native Bricks Builder Forms (capturing and routing on-site intake inquiries).
  • Email & Video Conferencing: Google Ireland Ltd. / Google LLC (Google Workspace, Gmail, and Google Meet for video consultations).
  • Scheduling Management: Calendly LLC (self-service appointment booking).
  • Payment Infrastructure: Stripe Inc. (secure, PCI-DSS Level 1 compliant payment processing).
  • CRM & Email Marketing: HubSpot (client profile management, transactional notifications, and newsletter delivery).
  • Embedded Third-Party Content (Instagram & Vimeo): Our website embeds videos via Vimeo LLC and interactive social posts via Instagram (Meta Platforms Ireland Ltd.). Merely loading pages containing these embeds or interacting with them transmits your IP address, browser headers, and cookie identifiers to these third parties, who process data in accordance with their independent privacy policies.

6. International Data Transfers

Because third-party providers (including Google, Calendly, and Stripe) maintain server infrastructure outside the European Economic Area (EEA), your personal information may be transferred across international borders. Transfers to the United States and other non-EEA jurisdictions are safeguarded by:

  • Certification under the EU-U.S. Data Privacy Framework (DPF); and/or
  • Standard Contractual Clauses (SCCs) approved by the European Commission, ensuring equivalent statutory protections.

7. Regional Privacy Rights

  • European Union / EEA (GDPR & Dutch UAVG): You have the right to access, rectify, or erase your data, restrict or object to processing, and request data portability. You have the statutory right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
  • United States (State Laws including California CCPA/CPRA): You have the right to request disclosure of personal information collected and request deletion. We do not sell your personal data or share it with third parties for cross-context behavioral advertising.
  • United Arab Emirates (UAE PDPL – Decree Law No. 45/2021 & DIFC Law): Clients residing in the UAE maintain statutory rights to withdraw consent, inspect processed personal data, and request the cessation or restriction of processing.
  • India (Digital Personal Data Protection Act, 2023 – DPDPA): As a Data Principal, you possess the right to access an overview of your processed data, request correction or erasure, designate a nominee to act in case of death or incapacity, and seek redressal through our designated Grievance Officer at connect@soniajoseph.com. Inquiries are resolved within 30 calendar days.

8. Cookies and Storage Technologies

Our website utilizes cookies and local storage tokens categorized as follows:

  • Strictly Necessary: Essential cookies required for website routing, security, and session management.
  • Functional & Embedded Media: Cookies and local storage deployed by Vimeo and Instagram embeds to render multimedia content and manage user playback preferences.
  • Analytics (Optional): Deployed strictly upon affirmative opt-in via our cookie banner to measure anonymous website traffic patterns.

Non-essential cookies and embed scripts remain disabled until you affirmatively grant consent through our cookie consent mechanism. You can adjust your cookie settings through your browser at any time.

9. Automated Decision-Making & Age Thresholds

We do not perform automated decision-making or algorithmic profiling that produces legal or significant effects. Our website and coaching services are strictly directed to individuals aged 18 years and older. We do not knowingly process personal data belonging to minors. Any information discovered to have been submitted by an individual under 18 will be permanently deleted immediately.

10. Data Retention & Policy Revisions

Administrative client notes and form submissions are retained for the duration of the active coaching engagement plus a reasonable period not exceeding 24 months from last contact, unless required for ongoing legal claims. Financial and invoicing records are maintained for 7 years pursuant to Dutch statutory fiscal retention mandates. We reserve the right to revise this Privacy Policy periodically. Any modifications will be posted to this page with an updated effective date.