How I handle your data.

This page explains what personal data is collected when you use kateycoaching.com, why, how long it’s kept, and what rights you have. It is written to be understandable, not just compliant.

Katey’s primary jurisdiction is Switzerland, so the revised Swiss Data Protection Act (nDSG, in force since 1 Sep 2023) applies. If you visit from an EU/EEA member state, the EU General Data Protection Regulation (GDPR) additionally applies; both sets of rights are honoured together.

1. Who is responsible

The controller in the sense of Art. 5 lit. j nDSG (and Art. 4(7) GDPR for EU visitors) is:

Katarina Gröflin
Kammermattweg 18
CH-4107 Ettingen, Switzerland
Email: katey.coaching.newlife@gmail.com

2. What data is collected, and why

2.1 When you visit the site

The site is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When you load a page, Vercel receives technical data — IP address, timestamp, user-agent, referring URL — to serve the page and defend against abuse. This is a legitimate business purpose under Art. 31 para. 2 lit. c nDSG (and Art. 6(1)(f) GDPR for EU visitors: legitimate interest in running the site securely).

Vercel acts as a data processor under an executed Data Processing Addendum. The transfer to the USA is covered by Standard Contractual Clauses; the USA is currently recognised as providing adequate protection for EU-U.S. Data Privacy Framework participants (Vercel is enrolled). For Swiss data, the transfer relies on Standard Contractual Clauses plus the Swiss-U.S. DPF where applicable.

2.2 When you use the contact form

The contact form collects your name, email address and message, including a selected program or payment option where applicable. This data is used only to reply to your enquiry and, if you become a client, to arrange the work that follows.

• Purpose: reply to your enquiry / pre-contractual measures at your request (Art. 6 lit. a nDSG, i.e. lawful processing tied to a legitimate purpose; Art. 6(1)(b) GDPR for EU visitors).
• Recipients: Katarina Gröflin only.
• Technical processor: Resend Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA — sends the email from the site to Katey’s inbox. Bound by a Data Processing Addendum and Standard Contractual Clauses; Resend is enrolled in the Swiss-U.S. and EU-U.S. Data Privacy Frameworks.
• Retention: kept as long as needed to complete the conversation, and — if you become a client — for the duration of the coaching relationship plus any applicable statutory retention periods. If nothing comes of the enquiry, the message is deleted within 12 months.

2.3 Payments through Stripe

When checkout is enabled, Stripe will process payment, billing and transaction data as an independent service provider under its own privacy terms. Katey receives payment status and transaction details, but not the client’s full card number. The data is used to perform the contract, prevent fraud, manage subscriptions and meet accounting obligations.

2.4 A honeypot field

The form has a hidden field that’s invisible to humans but usually filled in by spam bots. If it’s filled, the message is silently discarded. No data is stored in that case.

3. What is not done here

• No cookies are set. No consent banner is needed.
• No third-party analytics (no Google Analytics, no Meta Pixel, no Plausible, no Fathom).
• No advertising trackers.
• Fonts (Instrument Serif, Pinyon Script and Inter) are self-hosted via next/font — no requests go to Google when you load a page.
• The hero video is served from the same domain, not embedded from a third-party player.

4. Your rights

Under the Swiss nDSG (and the GDPR, if you visit from the EU/EEA) you have the right to:

• request information about the data held about you (Art. 25 nDSG / Art. 15 GDPR);
• have inaccurate data corrected (Art. 32 para. 1 nDSG / Art. 16 GDPR);
• have your data deleted (Art. 32 para. 2 lit. c nDSG / Art. 17 GDPR);
• object to processing (Art. 30 para. 2 lit. b nDSG / Art. 21 GDPR);
• receive your data in a portable format (Art. 28 nDSG / Art. 20 GDPR);
• lodge a complaint with a supervisory authority — in Switzerland the Federal Data Protection and Information Commissioner (FDPIC/EDÖB) www.edoeb.admin.ch; in the EU, the data protection authority of your country of residence.

To exercise any of these rights, email katey.coaching.newlife@gmail.com. A reply follows within 30 days.

5. Automated decisions

There is no automated decision-making, no profiling, and no AI evaluation of your enquiry. Katey reads every message herself.

6. Changes to this notice

If the site or its data-handling practices change, this notice is updated and re-dated at the top. Meaningful changes will be communicated to existing clients directly.