PRIVACY POLICY

Last updated: 26th November 2026

1. Introduction

This Privacy Policy explains how [Insert Business Name], a sole trader (auto-entrepreneur) registered in France, (“we”, “us”, “our”) collects, uses, stores, and protects your personal information when you visit our website, participate in our programmes, use our learning portal, or communicate with us.

We are committed to complying with the EU General Data Protection Regulation (GDPR), French data protection law (CNIL requirements), and global privacy best practices.

2. Data Controller

Data Controller:
Sofia Messara
Registered Address: 14 rue de Rixheim 68100 Mulhouse, France
Email: contact@sofiamessara.com

We do not appoint a Data Protection Officer (DPO), as this is not legally required.

3. What Data We Collect

We may collect the following types of personal data:

3.1 Information You Provide Directly

• Name

• Email address

• Organisation name

• Contact form submissions

• Programme registration details

• Survey or Typeform/Google Forms data

• Coaching or consultation notes

• Payment information (processed securely by Stripe/PayPal)

3.2 Automatically Collected Data

Using third-party analytics and tracking tools, including:

• Google Analytics

• Meta Pixel

• Squarespace analytics

This may include:

• IP address

• Browser type

• Pages visited

• Time spent on website

• Referrer information

• Device information

3.3 Cookies & Tracking Technologies

See our Cookie Policy for full details.

4. Legal Basis for Processing (GDPR)

We process your data under the following legal bases:

• Contractual necessity – to deliver programmes, coaching, digital access.

• Consent – for newsletters, downloads, and marketing cookies.

• Legitimate interests – improving services, site security, basic analytics.

• Legal obligation – tax and accounting purposes.

5. How We Use Your Data

We use your data to:

• Provide coaching, consulting, and training services

• Deliver programme materials and learning portal access

• Respond to enquiries

• Process payments

• Improve website performance

• Send marketing communications (only with consent)

• Analyse service usage and website traffic

6. Sharing Your Data

We only share your data with secure third-party service providers, including:

• Google Analytics (analytics)

• Meta Pixel (marketing tracking)

• Squarespace (website hosting)

• Stripe / PayPal (payment processing)

• Typeform / Google Forms (surveys and onboarding)

• Adobe (document management)

All providers operate under GDPR-compliant Data Processing Agreements (DPAs).

We do not sell your data.

7. International Data Transfers

Some providers store data outside the EU (e.g., US).
Transfers are protected through:

• EU–US Data Privacy Framework

• Standard Contractual Clauses (SCCs)

• GDPR-compliant safeguards

8. Data Retention

We retain data according to the following schedule:

• Client records: up to 6 years

• Enquiries: 12 months

• Payment records: as required by French tax law

• Coaching notes: 3 years (unless requested otherwise)

9. Your Rights (GDPR)

You have the right to:

• Access your data

• Rectify inaccurate data

• Request deletion

• Restrict processing

• Withdraw consent

• Data portability

• Object to processing

• Lodge a complaint with CNIL (France)

Contact us at contact@sofiamessara.com to exercise your rights.

10. Security

We use industry-standard measures to protect your data, including:

• SSL encryption

• Secure cloud storage

• Strong password protection

• Limited access controls

11. Children

We do not knowingly collect data from individuals under age 16.

12. Updates

This policy may be updated periodically. All changes will appear on this page.