Privacy Statement

Who we are

This privacy statement applies to A Great Team B.V., the Dutch private limited company that operates the Mischulaikah personal practice (the "Founder Cohort" coaching offer) at mischulaikah.com.

For this service we are the data controller — we decide why and how your personal data is processed. We comply with the EU General Data Protection Regulation (GDPR) and Dutch data protection law.

The OrthoFoodie nutrition application is operated by a separate company. When you use OrthoFoodie as part of the Founder Cohort, OrthoFoodie's own privacy policy applies in parallel for activity inside that platform.

What data we collect

We only collect data we actually need to deliver the coaching service, communicate with you, and meet our legal obligations.

Information you give us directly

• Application data: name, email, phone, country, time zone, age range, and the answers you provide on the Founder Cohort application form (including symptom information, severity, prior history, and consent confirmations)
• Booking data: the calendar slot you choose for your sessions, plus any name/email/phone confirmation you re-enter at the booking step
• Payment data: processed by Stripe on our behalf. We never see or store your full card number; we receive only a transaction reference, the amount paid, and basic billing information needed for invoicing
• Communications: the content of emails, messages, and notes from your sessions with Mischulaikah

Information we collect automatically

• Technical data: IP address, device type, browser, and basic interaction data when you visit the website — to keep the site running and secure
• Cookies: see the Cookies section below

Sensitive data — health information

The application form asks about symptoms and aspects of your health. Under GDPR, this is "special category" personal data. We process it on the basis of your explicit consent, which you give when you submit the application. You can withdraw that consent at any time by emailing [email protected].

We do not use your health information for marketing, profiling, or any purpose unrelated to the coaching service you applied for.

Why we process your data

• To assess your application and decide whether the Founder Cohort is a fit (legal basis: pre-contractual steps and your consent)
• To deliver the coaching service — scheduling sessions, communicating between calls, providing personalised guidance (legal basis: contract performance)
• To process payment and issue invoices (legal basis: contract performance and legal obligation)
• To meet our legal obligations, including Dutch tax and accounting requirements (legal basis: legal obligation)
• To improve and protect the service — including basic site analytics and security monitoring (legal basis: our legitimate interest, balanced against your privacy)
• To send you marketing communications, only if you have separately opted in (legal basis: consent — you can unsubscribe at any time)

Who we share your data with

We do not sell your data, ever. We share it only with the small number of providers we use to operate this service:

• Stripe — payment processing
• Google Workspace (Gmail, Calendar, Drive) — communication, scheduling, document storage
• HighLevel (LeadConnector) — the platform we use for the application form, booking calendar, and pipeline
• Zoom — for video sessions (calls are not recorded unless you separately request and consent to a recording)
• OrthoFoodie — the nutrition platform you use during the cohort (operated under its own privacy policy)
• Tax advisors and accountants — bound by professional confidentiality, only for invoicing and bookkeeping

Each of these providers acts as a "processor" on our behalf and is contractually required to handle your data securely and only for the purposes we instruct.

We may also share data if we are legally required to (for example, in response to a valid court order or tax authority request).

Data transferred outside the EU

Some of the providers above (notably Stripe, Google, HighLevel, Zoom) are based in or transfer data to the United States. When this happens, we rely on the EU Standard Contractual Clauses and supplementary safeguards required by GDPR. You can request more information about a specific provider by emailing us.

How long we keep your data

• Application data — if you are not accepted: we retain it for up to 12 months (so we can recognise repeat applications and revisit your case if circumstances change), then delete it.
• Coaching client records: 7 years after your engagement ends — this is the standard Dutch retention period for client and tax records.
• Invoices and payment records: 7 years (Dutch tax law).
• Marketing communications: for as long as you remain subscribed; we delete your data within 30 days of unsubscribe unless we have another lawful reason to retain it.
• Website analytics: aggregated and anonymised after 14 months.

Your rights under GDPR

You have the right to:

• Access the personal data we hold about you
• Correct data that is wrong or incomplete
• Delete your data, where we don't have a legal reason to keep it
• Restrict or object to certain processing
• Receive a portable copy of the data you gave us
• Withdraw consent at any time, where consent is the legal basis
• Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl

To exercise any of these rights, email [email protected]. We will respond within 30 days.

Cookies

Our website uses a small number of cookies:

• Strictly necessary cookies: for the site to function (e.g. session, security). These do not require consent.
• Analytics cookies (if enabled): only set with your consent via the cookie banner. They help us understand which pages people visit, in aggregate.
• Embedded forms and widgets: the application form, booking calendar, and any video may set their own cookies when you interact with them.

You can change your cookie preferences at any time through the cookie banner or your browser settings.

Security

We use encryption in transit (HTTPS) and require all our processors to do the same. Internally, only Mischulaikah and authorised collaborators have access to client data, on a need-to-know basis. If a data breach ever affects you, we will notify you and the Dutch Data Protection Authority within the legally required timelines.

Children

This service is intended for adults aged 18 and over. We do not knowingly process data from children. If you believe we have collected information from a minor, please contact us so we can delete it.

Changes to this statement

We may update this statement from time to time as our service or the law evolves. The "last updated" date at the top will reflect the most recent change. For material changes, we will email you in advance if we have your contact details.

Contact us

For any privacy question, request, or concern, email [email protected]. We aim to respond within 5 business days.