Privacy Policy

1. General information

 

The protection of your personal data is important to us. This Privacy Policy explains how personal data is collected, processed, and stored when you visit this website or use our services.

 

“Personal data” means any information that can be used to identify you personally, such as your name, email address, or IP address.

 

This Privacy Policy applies to the website ivintila.com, related services and communications, and associated social media channels (e.g. YouTube and Instagram).

 

​

2. Controller (data controller under GDPR)

 

Ioana Vintila

c/o IP-Management #9180

Ludwig-Erhard-Str. 18

20459 Hamburg

Germany

 

Email: hello@ivintila.com

 

The controller is the individual responsible for deciding how and why personal data is processed.

 

​

3. Hosting and website platform

 

This website is hosted on Wix.com Ltd. When you visit the website, Wix automatically collects technical data (e.g. browser type, operating system, IP address, time of access) via server log files to ensure the secure and functional operation of the website.

 

The use of Wix is based on Art. 6(1)(f) GDPR (legitimate interest in operating a secure and functional website).

 

 

4. Contact form and email communication

 

If you contact us via the contact form on the website or by email, we process the information you provide (e.g. name, email address, message) solely to respond to your inquiry. Email communication is handled via Google Workspace (Google LLC).

​​

Legal basis:

 

Art. 6(1)(b) GDPR (pre-contractual or contractual communication)

 

Art. 6(1)(f) GDPR (legitimate interest in effective communication)​

 

Google may process data outside the EU. Transfers are safeguarded through certification under the EU-US Data Privacy Framework (DPF) and additional contractual safeguards where applicable.

​

 

5. Newsletter subscription (Mailchimp)

 

If you subscribe to the newsletter, your email address and name is transferred to Mailchimp, which is used for email communication and basic engagement analytics (e.g. open and click rates). You can unsubscribe at any time via the link in each email.

​​

Legal basis:

 

Art. 6(1)(a) GDPR (consent)​

 

Mailchimp is a US-based provider. Data transfers are safeguarded using appropriate mechanisms (see Section 11).

​

 

6. Course platform (Xperiencify)

 

We use Xperiencify to provide access to digital courses and group resources. Processed data may include: Name and email address, login data, course progress and engagement data, and group content access.

​​

Legal basis:

 

Art. 6(1)(b) GDPR (performance of a contract)​

 

Xperiencify is US-based. Appropriate safeguards are in place for international data transfers.

​

 

7. Health intake forms, notes, and scheduling (Google Workspace)

 

We use Google Workspace (including Google Forms, Google Drive, Google Calendar, and Gmail) to collect health intake information, store client notes and records, and manage appointments and communication.​ This may include health-related data, which is considered a special category of personal data

​​

Legal basis:

 

Art. 6(1)(b) GDPR (contract), and

 

Art. 9(2)(a) GDPR (explicit consent for health data)

​​

Client records and notes are retained for up to seven (7) years, in line with professional and legal obligations, unless a longer retention period is required by law.​

 

Google Workspace is a third-party service provider and may process data outside the EU with appropriate safeguards.

​​

 

8. Payments (Stripe)

 

Payments are processed via Stripe. We do not store payment card details ourselves. Processed data may include: name, email address, billing information, and transaction details.

 

Legal basis:

 

Art. 6(1)(b) GDPR (contractual necessity)

​

Stripe operates globally and uses appropriate safeguards for international data transfers.

 

​​

9. Video and audio conferencing (Google Meet)

 

We use Google Meet for: group coaching calls, and 1:1 calls.

​

Processed data may include: name and email address, meeting metadata (date, duration, participants), technical data (IP address and device information), and audio, video, or chat content (if shared).

​

Recording of group coaching sessions

 

Group coaching calls are recorded so participants can review sessions later.1:1 calls are not recorded. Recordings are shared only with participants of the same group via Xperiencify. Recordings are not used for marketing and are not shared publicly. Recordings are stored for a limited period and deleted when no longer needed.

​​

Legal basis:

 

Art. 6(1)(b) GDPR, and

 

Art. 9(2)(a) GDPR where sensitive information is shared.

 

Google may process data in the United States or other countries under appropriate safeguards, including participation in the EU-US Data Privacy Framework and/or standard contractual clauses.

 

 

10. Testimonials and marketing recordings

 

In individual cases, testimonials may be recorded with clients for marketing or informational purposes (written, audio, or video). Testimonials are recorded only with explicit, voluntary consent and are separate from coaching sessions. Published testimonials may include first name, voice, or image as agreed.

​​

Legal basis: Art. 6(1)(a) GDPR (explicit consent).

​​

Consent can be withdrawn at any time with effect for the future.

​

 

11. Embedded third-party content

 

We embed content from: YouTube and Instagram.​ When these are loaded, the respective providers may receive technical data such as your IP address. This occurs only after interaction or consent, depending on your cookie settings.

​​

Legal basis:

 

Art. 6(1)(a) GDPR (consent), or

 

Art. 6(1)(f) GDPR (legitimate interest in presenting content)

​

 

12. Cookies and consent management

 

This website uses cookies. Cookies are small text files stored on your device. We use Wix’s built-in cookie consent banner, which allows you to accept or reject non-essential cookies. Cookies may be technically necessary (required for website functionality) and/or functional or statistical (depending on your consent).

​

Legal basis:

 

Art. 6(1)(f) GDPR for essential cookies

 

Art. 6(1)(a) GDPR for optional cookies (consent)

 

You can change your cookie settings at any time via the cookie banner or your browser settings.

​

 

13. International data transfers (third countries)

 

Some service providers (Mailchimp, Xperiencify, Practice Better, Google) are based outside the EU/EEA, including the United States.

 

Data transfers are safeguarded using: EU Standard Contractual Clauses (SCCs), and/or participation in the EU–US Data Privacy Framework, where applicable.

​

 

14. Data retention

 

Personal data is stored only as long as necessary for the purpose for which it was collected, or as required by law.

 

Statutory retention obligations (e.g. tax or professional requirements) remain unaffected.

 

 

15. Your rights

 

You have the right to access your personal data, request rectification or deletion, restrict processing, receive your data in a portable format, withdraw consent at any time, and lodge a complaint with a supervisory authority.

​

 

16. Data security

 

We use appropriate technical and organizational measures, including SSL/TLS encryption, to protect your data.

 

Please note that no internet transmission is completely secure.

​

 

17. Updates to this policy

 

This Privacy Policy may be updated to reflect legal or operational changes. The current version published on the website always applies.​