Privacy Policy

Effective date: 8 September 2026

This draft is designed for a coaching practice established in Spain and serving clients who may be located internationally.

  1. Who This Policy Applies To

This Privacy Policy describes how personal data is handled in connection with Claudia's expat coaching practice, including information provided through the website, introductory conversations, enquiries, and coaching services.

Data controller: [Insert full legal/business name]
Business address: [Insert business/postal address]
Email: [Insert privacy/contact email]

  1. Personal Data We May Collect

• Contact information, such as name, email address, telephone number, and country or time zone.

• Information you voluntarily provide in enquiries, intake forms, scheduling, communications, and coaching conversations.

• Administrative and transaction information relating to appointments, invoices, and payments. Payment-card details should generally be processed directly by the chosen payment provider rather than stored by the Coach.

• Website and technical information, such as device, browser, IP address, cookie information, and usage data, where collected by the website or its service providers.

  1. Why We Use Personal Data

Depending on the circumstances, personal data may be used to respond to enquiries, arrange and provide coaching, administer the client relationship, process or document payments, maintain business records, comply with legal obligations, protect legitimate business interests, and - where valid consent is obtained - send optional marketing communications.

The appropriate GDPR legal basis may include performance of a contract or steps requested before entering a contract, compliance with a legal obligation, legitimate interests, or consent, depending on the particular processing activity.

  1. Coaching Information and Sensitive Data

Clients may choose to discuss personal matters during coaching. The Coach does not require Clients to provide special-category or highly sensitive personal data unless it is genuinely relevant and appropriate. Clients are encouraged not to send unnecessary sensitive information by ordinary email or website forms.

Where special-category data is processed, an appropriate lawful basis and GDPR condition must apply. The final policy and intake process should be reviewed to ensure that the practice's actual handling of such information is properly documented.

  1. Sharing Personal Data

Personal data may be shared only as reasonably necessary with service providers that support the practice, such as website hosting, email, scheduling, video conferencing, accounting/invoicing, cloud storage, or payment services; with professional advisers where appropriate; or where disclosure is required by law.

Before publication, this section should be updated to identify the actual providers used by the practice and, where appropriate, link to or describe their privacy practices.

  1. International Data Transfers

Some technology providers may process data outside the European Economic Area. Where GDPR applies, the practice should ensure that an appropriate transfer mechanism or other lawful safeguard is in place, such as an adequacy decision or approved contractual safeguards, where required.

  1. Data Retention

Personal data will be kept only for as long as reasonably necessary for the purposes for which it was collected, including providing services, maintaining appropriate business and tax records, resolving disputes, and complying with legal obligations. Specific retention periods should be established for client records, invoices, enquiries, and marketing data.

  1. Your Data-Protection Rights

Where GDPR applies, individuals may have rights including access to their personal data, correction of inaccurate data, erasure in certain circumstances, restriction of processing, objection to certain processing, data portability where applicable, and withdrawal of consent where processing is based on consent.

Individuals may also have the right to lodge a complaint with the competent supervisory authority. For a practice established in Spain, the relevant authority will generally be the Spanish Data Protection Agency (Agencia Española de Protección de Datos - AEPD), subject to the circumstances.

  1. Cookies and Website Analytics

If the website uses non-essential cookies, analytics, advertising technologies, embedded media, or similar tools, appropriate information and consent mechanisms may be required. This policy should be coordinated with the website's cookie banner and cookie policy once the website technology stack is confirmed.

  1. Security

Reasonable technical and organisational measures will be used to protect personal data. No internet, email, video-conferencing, or storage system can be guaranteed to be completely secure, and Clients should use reasonable care when sending personal information electronically.

  1. Children

The coaching service and website are intended for adults unless the Coach expressly offers services to minors under a separate process. If services to minors are contemplated, additional consent, safeguarding, and privacy provisions should be prepared before those services are offered.

  1. Changes to This Policy

This Privacy Policy may be updated from time to time to reflect changes in the practice, technology providers, or legal requirements. The current version should display an effective date.

Effective date: [Insert date]

  1. Contact

Questions about this Privacy Policy or requests relating to personal data may be sent to:

Expat Transition Coach
claudia@expattransitioncoach.com

Important: This template is a practical starting point and is not legal advice. Because the practice is based in Spain and may serve clients internationally, it should be reviewed by a qualified Spanish/EU lawyer or data-protection professional before publication or use.