Legal
Privacy and data protection
What this website does with personal data (and, in most places on this site, what it deliberately does not do with it).
Pending legal review
This page is pending legal review
The controller, contact details and the external services named here (Paperbell, LinkedIn and Trustpilot, all reached only through ordinary links) are carried over from the data protection page of the previous MindWise website or verified against the current implementation. Every technical statement about this website has been checked against its source code. What is still open (the hosting and form providers, retention periods and the competent supervisory authority) is marked.
No lawyer has reviewed this text. It must not go live in this state.
- Status
- Draft for legal review: no effective date, because it is not yet in effect.
- Applies to
- www.mindwise-coaching.com
Who is responsible
The controller is the person or entity that decides why and how personal data is processed through this website. The full company details belong in the Legal Notice; the contact point for data protection questions is repeated here so it is easy to find.
- Responsible entity
- MindWise Coaching & Consultancy FZCO
- Registered or business address
- Dubai Digital Park, Bldg. A1, Dubai, United Arab Emirates
- Contact for data protection enquiries
- contact@mindwise-coaching.com
- Data protection officer
- To supplyName and contact details, or a statement that no officer is required
To be confirmedThe previous site gave admin@mindwise-coaching.com as the controller address on its English page and contact@mindwise-coaching.com on its German page. This page uses contact@, which matches the rest of the site. Confirm which address is correct, and whether a data protection officer has to be appointed. Brief §44.11.
What this notice covers
This notice covers this website. It does not cover the external services reached through links, such as the booking provider, LinkedIn, Trustpilot or your own email provider. Each of those has its own privacy notice.
To be confirmedWhich data protection law governs: the GDPR for visitors in the EU and EEA, and separately whichever law applies where the practice is established. That is a legal question and has been left open on purpose. Brief §44.9.
What this website collects automatically
This is a static website. Its pages are plain files, generated ahead of time and served as they are. There is no application server behind them, no database and no user account.
The site itself sets no cookies and runs no first-party analytics, advertising, heat-mapping or session recording. It neither reads from nor writes to your browser’s local or session storage, and it loads no third-party scripts.
Typefaces are served from this domain. They are packaged into the site when it is built rather than requested from Google Fonts while you read, so opening a page does not disclose your address to a font provider. Images, stylesheets and scripts are served from this domain too.
What remains is what any web server sees. Whoever hosts these files will normally record standard access data: IP address, time of request, the file requested, the referring page and the browser’s user-agent string. That happens at the hosting layer rather than in this site’s code, so what is recorded, and for how long, is determined by the hosting provider.
To be confirmedThe hosting provider and its location, what its access logs contain, how long it keeps them, whether a data processing agreement is in place, and whether a CDN or proxy sits in front of the site.
Cookies and browser storage
This site does not set cookies or use browser storage, and it embeds nothing from other providers that could.
If non-essential cookies, analytics, an embedded booking calendar, a video player or a chat widget are added later, this section and the site’s consent controls must be reviewed before those technologies are allowed to load.
To be confirmedThe previous website offered a “Cookie settings” control (brief §36). While the site sets no cookies and embeds nothing, there is nothing for it to control. Confirm with legal counsel that no consent control is needed, and reinstate it before adding any non-essential cookie, storage technology or third-party embed.
Enquiry forms
The contact page separates two routes: a short private enquiry and a professional enquiry. Both ask for as little as will do the job, and neither asks anything about your health.
- Private enquiry: your name, your email address, your preferred language, and an optional short message.
- Professional enquiry: your name, your email address, your organisation, your role (optional), the type of enquiry, and a short message.
- Both also send your consent, the language you were reading the site in, and which of the two forms you used.
Because this is a static site there is no server of its own to receive a form. Your browser sends the submission straight to a configured endpoint, which means the provider behind that endpoint sees your address and browser details as well, the way any recipient of a web request does. Until that endpoint is set the forms render in a visibly disabled state with an email address instead, rather than accepting what you write and quietly discarding it. Spam is caught by a hidden field rather than a third-party captcha: a captcha would put somebody else’s tracker on the page people reach when they are already hesitant.
To be confirmedThe form endpoint that will be live at launch and the provider behind it, where submissions are stored, who can read them, how long they are kept, whether the provider is inside the EEA, and whether a data processing agreement is in place.
Please do not send health information
A web form and an email are not a confidential clinical channel. Please do not describe symptoms, a diagnosis, medication or anything else about your health in a first enquiry.
One line about what you would like help with is enough to arrange a conversation. Everything clinical belongs in the consultation itself, where it can be handled properly.
To be confirmedCrisis and emergency wording: what this site should say to someone in acute distress, and which service it should point them to in each country served. Brief §44.19. That wording belongs on the contact and individuals pages as well; this page should not be the only place it appears.
Email, LinkedIn and other direct contact
If you contact us by email, the data you provide is used to process your request. We need this data to process and answer your enquiry; without it we cannot answer in full, or at all. The legal basis is Art. 6(1)(b) GDPR. Your data is deleted once your enquiry has been fully answered and there is no further legal obligation to keep it, for example because an order or contract resulted from it.
If you message us through LinkedIn or Telegram, the privacy information of that service applies to the exchange: see the Telegram privacy policy at telegram.org/privacy and the LinkedIn privacy policy at linkedin.com/legal/privacy-policy.
To be confirmedThe mail provider, where the mailbox is hosted, and how long correspondence is kept. Also whether Telegram remains a public contact channel (brief §44.26). The previous site listed it in its Legal Notice, and the Legal Notice here still does. The previous site also named WhatsApp and Instagram; neither is linked from this site, so both have been left out.
Booking a consultation
Booking is handled by an external scheduling provider. This site holds only the link, and the provider is a configuration value so the practice can change it without redesigning anything.
When you follow the booking link you leave this website. Whatever you enter there (your name, your email address, the appointment time, and any payment details) is processed by that provider under its own privacy notice.
To sell our services, schedule appointments and manage clients we use Paperbell. Paperbell is a service of Charlotte Corrigan Limited, a company incorporated in England with company number 11274474, whose registered office is at 95 Ditchling Road, Brighton, BN1 4ST, United Kingdom.
This may mean that user data is processed outside the European Union, in particular in the United States. That can increase risks for users, for example by making later access to the data more difficult. We do not have access to this data ourselves. Paperbell’s privacy policy is at paperbell.com/privacy-policy.
To be confirmedThat Paperbell is still the booking provider at launch (the booking link is a configuration value and may point elsewhere), where it stores data, and whether a data processing agreement and transfer safeguards are in place. Brief §44.16.
We keep a presence on LinkedIn to present our practice and services and to communicate with clients and prospective clients. LinkedIn is a service of LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland, a subsidiary of LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA.
This site links to LinkedIn with an ordinary link and does not embed a LinkedIn plug-in, so nothing is sent to LinkedIn until you click it. Once you do, LinkedIn may record information about you and your visit, and this may be processed in the United States. Only LinkedIn has access to that data. LinkedIn’s privacy policy is at linkedin.com/legal/privacy-policy.
Third-party content on these pages
There is none. This site embeds no content from other providers: no review widgets, maps, videos, externally hosted fonts, chat widgets, payment scripts or advertising pixels.
The reviews on this site are copied from the practice’s public Trustpilot profile and shown as text, so your browser does not contact Trustpilot to display them. The links to Trustpilot and LinkedIn are ordinary links and send nothing until you click them. From then on, Trustpilot’s or LinkedIn’s own privacy notice applies.
To be confirmedA lawyer must confirm how publishing reviewers’ first names, initials and review texts is covered: where the data comes from, the legal basis, and how a reviewer can object. Reviews of counselling can reveal information about health.
Legal bases
Under the GDPR every processing activity needs a legal basis. The bases that would normally apply to a site like this one are set out below so the structure is in place. Which basis actually applies to which activity is a legal judgement, and it has not been made here.
- Steps taken at your request before entering a contract (Art. 6(1)(b)): for enquiries and booking requests.
- Legitimate interests (Art. 6(1)(f)): for operating and securing the site.
- Consent (Art. 6(1)(a)): where you give it, for example on the enquiry form.
- Legal obligation (Art. 6(1)(c)): where retention is required by law.
- Special category data (Art. 9): if health information is ever processed, which is exactly why this site asks you not to send it.
To be confirmedA lawyer must map each processing activity to a basis, and confirm whether Art. 9 GDPR is engaged by enquiries that mention health.
How long data is kept
Personal data is deleted or blocked as soon as the purpose for which it was stored no longer applies, unless deleting it would breach a statutory retention obligation.
To be confirmedA retention period for each category (enquiry form submissions, email correspondence, booking records and hosting access logs), together with who deletes them and how.
Who data is shared with
Nothing on this site sells, rents or trades personal data, and there is no advertising relationship of any kind. Data reaches third parties only through the services needed to run the practice.
- The provider that hosts and serves these pages.
- The provider that receives enquiry form submissions.
- The mail provider that carries email correspondence.
- The external booking provider, if you choose to use it.
- Professional advisers or public authorities, where the law requires it.
To be confirmedEach provider by name, together with the contract that governs it.
International transfers
This practice works across Germany, Saudi Arabia and the United Arab Emirates, so data may be processed outside the European Economic Area. Whether it is, and on what safeguard, depends entirely on the providers that are chosen.
To be confirmedFor each provider: where data is stored, whether it leaves the EEA, and the transfer mechanism relied on: an adequacy decision, standard contractual clauses, or another safeguard.
Your rights
Where the GDPR applies to the processing of your data, you have the rights below. To exercise any of them, write to the contact address named at the top of this page.
- Access: a copy of the personal data held about you (Art. 15).
- Rectification: correction of data that is wrong or incomplete (Art. 16).
- Erasure: deletion, where the conditions are met (Art. 17).
- Restriction: processing paused rather than deleted (Art. 18).
- Portability: your data in a portable, machine-readable format (Art. 20).
- Objection: to processing based on legitimate interests (Art. 21).
- Withdrawal of consent: at any time, without affecting what was lawful before (Art. 7(3)).
- Complaint: to a data protection supervisory authority (Art. 77).
To be confirmedThe competent supervisory authority and its contact details, which follow from where the operating entity is established. If services are offered from the UAE, the equivalent rights under UAE data protection law have to be described alongside these.
Automated decision-making
There is none. No profiling, scoring or automated decision-making takes place on this website.
Security
This site’s canonical address is an HTTPS address, so pages and any form submission are intended to travel encrypted between your browser and the server.
To be confirmedThat HTTPS is enforced in production with a redirect from http, the security of the form endpoint and of the mailbox, who has access to enquiry data, and the procedure to follow in the event of a data breach.
Changes to this notice
This notice will carry a date and a version once it has been reviewed. Until then it has neither, because it is not yet in effect.
Contact
Questions about how this website handles personal data can go to contact@mindwise-coaching.com, the address that also appears in the footer of every page and on the contact page.
To be confirmedWhether data protection enquiries should go to the general contact address or to a dedicated one.