PLEN

Privacy policy

First of all – thank you for visiting my website.

Below you will find the purposes, legal bases and retention periods for personal data, set out separately for each purpose of processing.

Your data is safe with me. I keep all data you share with me confidential, protect it against unauthorised access and apply the security measures required by data protection law. Confidentiality is especially important in coaching: what we talk about in our sessions stays between us.

1. General information

1.1. The controller of your personal data is Joanna Laszczak, running a business under the name FocusPoint Coaching Joanna Laszczak, Tax ID (NIP): 7811723859, address: ul. Leszczynowa 36a, 62-090 Mrowino, Poland. If you have any questions about this privacy policy, you can write to me at any time at hello@focuspointcoaching.com.

1.2. The GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data) gives you the following rights:

  1. the right to access your data and to receive a copy of it,
  2. the right to rectification (correction) of your data,
  3. the right to erasure (if you believe there is no basis for me to process your data, you can ask me to delete it),
  4. the right to restriction of processing (you can ask me to limit the processing of your data to storing it or to activities agreed with you),
  5. the right to object to processing (you have the right to object to processing based on legitimate interests; you should indicate the particular situation that, in your view, justifies stopping the processing you object to. I will stop processing your data for those purposes unless I can demonstrate that the grounds for processing override your rights or that the data is necessary for me to establish, exercise or defend legal claims),
  6. the right to data portability (you have the right to receive from me, in a structured, commonly used and machine-readable format, the personal data you provided under a contract or on the basis of your consent; you may ask me to transmit this data directly to another controller),
  7. the right to withdraw consent at any time, where processing is based on consent (withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal),
  8. the right to lodge a complaint with a supervisory authority (if you believe I process your data unlawfully, you can lodge a complaint with the President of the Personal Data Protection Office (UODO) in Poland or another competent supervisory authority).

The rules for exercising these rights are set out in detail in Articles 15–22 of the GDPR. You can also ask me what data I hold about you and for what purposes I process it – simply send a message to hello@focuspointcoaching.com.

1.3. Your data may be processed by providers whose services I use in running my business, to the extent necessary to provide those services. These include in particular:

  • the website hosting provider, whose server also runs the contact form that forwards messages to my email address: OVH Sp. z o.o., registered in Wrocław, Poland (ul. Powstańców Śląskich 9, 53-332 Wrocław), part of the OVHcloud group, which stores data on servers in the European Union,
  • the email provider for hello@focuspointcoaching.com: GoDaddy (GoDaddy Operating Company, LLC, USA), together with the subcontractor that technically operates the mailbox – Titan Solution Ltd SEZC (Cayman Islands); mailbox data is stored on servers in the USA,
  • providers of tools for online sessions (video calls): Zoom (Zoom Communications, Inc., USA) and Microsoft Teams (Microsoft Corporation, USA),
  • the online payment provider: Stripe (Stripe Payments Europe, Limited, based in Ireland),
  • the International Coaching Federation (ICF) – only if you consent to this in the coaching agreement: your first name, surname, email address and session dates, to verify my coaching credential,
  • an accounting office based in Poland.

The domain focuspointcoaching.com is registered with Cloudflare (Cloudflare, Inc., based in the USA), which also manages its DNS settings – that is, it tells browsers which server the website is on. Website traffic does not pass through Cloudflare’s servers, so Cloudflare has no access to visitors’ data or to the content of messages sent through the form.

Where necessary, your data may also be disclosed to authorities entitled to receive it under the law, such as courts, prosecutors, the police or tax authorities, to the extent required by law.

1.4. Some of the tools I use are provided by companies based in the USA or affiliated with US companies: email (GoDaddy and its subcontractor Titan), tools for online sessions (Zoom and Microsoft Teams) and the payment provider (Stripe). As a result, your data may be transferred to the USA. Such transfers are based on the European Commission’s adequacy decision under the EU-US Data Privacy Framework (for certified providers) or on standard contractual clauses approved by the European Commission. GoDaddy, Zoom, Microsoft and Stripe are listed as active participants in the EU-US Data Privacy Framework. Details of how these providers, including their subcontractors, process data are set out in their privacy policies. In my Zoom settings, I have selected data centres in Germany and the Netherlands; for technical reasons, some data may still be processed in the USA.

If you consent to this, to verify my credential I may share with the International Coaching Federation (ICF), based in the USA, only your first name, surname, email address and the dates of our sessions. No other data, including the content of our conversations and my notes, is ever shared; it stays with me.

The ICF does not participate in the EU-US Data Privacy Framework and does not apply any other safeguards provided for in the GDPR for transfers of data outside the European Economic Area. I will therefore share this data only on the basis of your explicit consent (Article 49(1)(a) GDPR). This means there is a risk that your data will be less protected in the USA than in the European Union. US authorities may be able to access it, and enforcing your rights may be more difficult. Your consent is voluntary, you can withdraw it at any time, and not giving it does not affect our work together.

My mailbox data is stored in the USA. According to information provided by GoDaddy (October 2026), transfers of this data, including to its subcontractor Titan, are covered by the safeguards required by the GDPR (the EU-US Data Privacy Framework or standard contractual clauses). GoDaddy publishes its current list of subcontractors on its website.

The website and contact form run on OVH servers in the European Union. However, messages sent through the form are delivered to my mailbox, which is provided by GoDaddy, so the rules described above apply to them.

1.5. I do not make decisions about you based solely on automated processing, including profiling, and I do not use behavioural advertising.

2. Purposes and processing activities

2.1. Contact (form, email, messages)

Data processed: your name, email address, the content of your message and the language version of the website from which the form was sent. If you write directly by email or via LinkedIn – also any other data you choose to provide. Providing data is voluntary but necessary to get in touch.

Messages from the form are sent via the website server to my email address and are not stored in a database on the server.

Please do not include information about your health or other particularly sensitive data in your first message – at this stage, a few sentences about what brings you here are enough.

Purpose: replying to your message, arranging a free initial conversation and further contact about working together.

Retention period: as long as necessary to handle the correspondence and, if we do not start working together, up to 2 years from our last contact, for the purpose of archiving correspondence.

Legal basis: Article 6(1)(f) GDPR – my legitimate interest in replying to messages; where the contact concerns entering into a contract – Article 6(1)(b) GDPR (steps taken prior to entering into a contract).

Your rights: you can ask for a copy of our correspondence (if it has been archived) and for its deletion. I consider each such request individually – I may refuse only in cases provided for in the GDPR, for example where the correspondence is needed to establish, exercise or defend legal claims.

2.2. Free initial conversation and coaching sessions

Data processed: your full name, email address, phone number, session dates and the information you share during our conversations. Providing data is voluntary but necessary to arrange and conduct sessions.

During our work together, I keep session notes. I do not record your full name or any other details that would make it easy to identify you. I keep notes and the summary of our work together only in digital form, on a password-protected device. Despite these safeguards, the notes are still your personal data and all the rights described in section 1.2 apply to them.

During sessions, you may share special category data with me, such as information about your health. I process it only to the extent necessary to conduct the sessions and only with your explicit, voluntary consent, which you give in the coaching agreement. You can withdraw this consent at any time.

Purpose: arranging and conducting the initial conversation and coaching sessions (online), performing the coaching agreement and staying in contact while we work together.

Retention period:

  • the agreement and data needed to show that it was performed (e.g. session dates, correspondence about our work together) – for the duration of our work together and then for 6 years from the end of the calendar year in which it ended (the limitation period for claims),
  • session notes – for the duration of our work together (which may last, for example, 18 months) and for 12 months after it ends, after which I delete them,
  • summary of our work together – for 5 years after it ends. The summary contains only the goal of the process, the general area of work, agreed actions and information about the end of our work together. It does not contain health data or detailed records of our conversations.

Legal basis:

  • performance of the contract and steps taken prior to entering into it (Article 6(1)(b) GDPR),
  • for health data – your explicit consent (Article 9(2)(a) GDPR),
  • after our work together ends, for the agreement and data needed to show that it was performed – my legitimate interest in establishing, exercising or defending legal claims (Article 6(1)(f) GDPR),
  • for the summary of our work together – my legitimate interest in documenting our work and making it easier to resume if you decide to come back (Article 6(1)(f) GDPR),
  • sharing data with the ICF to verify my credential – your consent (Article 6(1)(a) GDPR) and, for the transfer of data to the USA, your explicit consent (Article 49(1)(a) GDPR); you can withdraw your consent at any time.

Your rights: you can withdraw your consent to the processing of health data at any time (this does not affect the lawfulness of processing before its withdrawal), request access to your data, its rectification or erasure – including deletion of session notes and the summary – and object to processing based on legitimate interests. I consider each request for erasure individually – I may refuse only in cases provided for in the GDPR, for example where certain data is necessary to establish, exercise or defend legal claims.

2.3. Working with companies and organisations

I provide coaching for managers and leaders, run workshops and training, and support HR teams in designing development programmes. As part of this work, I process the data of:

  • contact persons at the organisation: full name, job title, business email address, phone number, company name,
  • participants in coaching, workshops and training: full name, job title, business email address and – in the case of coaching – the information shared during sessions.

If your data was provided to me by the organisation you work for (e.g. the HR team when registering you for coaching or a workshop), that organisation is the source of your data.

The content of coaching sessions is confidential. I share with the organisation commissioning the coaching only the information needed to organise and settle the service: the number of sessions held, the number of sessions remaining and the development area agreed at the start together with the participant and the organisation (e.g. communication or leadership). I do not share the content of our conversations, session notes or any information about the participant’s health.

Purpose: preparing an offer, entering into and performing a contract with the organisation, delivering coaching, workshops or training, and staying in contact during our work together.

Retention period: for the duration of our work together and then for 3 years from the end of the calendar year in which it ended (the limitation period for claims). I keep coaching session notes and the summary of our work together as described in section 2.2.

Legal basis: my legitimate interest in entering into and performing a contract with the organisation and in contacting its representatives and participants (Article 6(1)(f) GDPR); for special category data shared during sessions – the participant’s explicit consent (Article 9(2)(a) GDPR).

Your rights: you have the rights described in section 1.2, including the right to object to processing based on legitimate interests.

2.4. Invoicing and accounting records

Data processed: full name or company name, address, tax ID (if applicable), and details of payments and invoices or bills issued.

Purpose: issuing invoices or bills and keeping accounting and tax records.

Retention period: for the period required by tax law, generally 5 years from the end of the calendar year in which the tax payment deadline expired.

Legal basis: a legal obligation under tax and accounting law (Article 6(1)(c) GDPR).

Your rights: you cannot object to the processing or request the deletion of data contained in accounting records before the end of their mandatory retention period.

2.5. Online payments

If you pay for sessions online (e.g. by card), the payment is processed by the payment provider Stripe (Stripe Payments Europe, Limited, based in Ireland). You can also pay invoices by bank transfer to the account shown on the invoice. You enter your card or online banking details directly with the payment provider – I have no access to them.

Data processed: full name, email address, invoice number, amount, currency and date of payment, and its status.

Purpose: accepting payment for sessions and confirming its receipt.

Retention period: as long as necessary to process the payment and then – as part of the accounting records – for the period described in section 2.4.

Legal basis: performance of a contract (Article 6(1)(b) GDPR) and, for accounting records, a legal obligation (Article 6(1)(c) GDPR).

Stripe processes data on my behalf and also processes some of it as an independent controller, for example to prevent fraud and money laundering and to meet legal requirements. Details are set out in Stripe’s privacy policy. Stripe may transfer data to its US affiliate (Stripe, LLC) on the terms described in section 1.4.

2.6. LinkedIn profile

Data processed: data visible on your public profile and the content of your messages, comments and reactions on my profile or on the FocusPoint Coaching company page on LinkedIn.

Purpose: running the profile, communicating with people who follow it and replying to messages.

Retention period: for as long as I run the profile, or until you delete your comment or message.

Legal basis: my legitimate interest in running the profile and promoting my business (Article 6(1)(f) GDPR).

For company page statistics (Page Insights), I am a joint controller together with LinkedIn Ireland Unlimited Company. Details of how LinkedIn processes data are set out in LinkedIn’s privacy policy. Clicking a link to LinkedIn on my website takes you to that service, where its own rules apply.

2.7. Server logs

When you use the website, the hosting server (OVH) automatically records basic technical information, such as your IP address, the date and time of the request, the address of the page visited and the type of browser. This data is used only to ensure the website works properly and securely, on the basis of my legitimate interest (Article 6(1)(f) GDPR), and is kept for the period set by OVH in line with the laws that apply to OVH. I have no influence over the length of this period.

2.8. Client testimonials

Data processed: the content of your testimonial and – depending on your choice – your full name, your first name and the initial of your surname, or a description without personal data (e.g. job title and industry).

Purpose: publishing the testimonial on focuspointcoaching.com and on the FocusPoint Coaching page on LinkedIn.

Legal basis: your consent (Article 6(1)(a) GDPR), given in the coaching agreement. Before publication, you receive the text of the testimonial and how it will be signed for approval.

Retention period: until you withdraw your consent – I then remove the testimonial from the website and from LinkedIn.

Your rights: you can withdraw your consent at any time by writing to hello@focuspointcoaching.com.

3. Cookies

My website does not use cookies or similar technologies for tracking, profiling or advertising. That is why no consent banner appears when you visit the website.

The fonts used on the website are stored on the website’s own server, so your browser does not connect to Google’s servers to load them.

The website contains links to external services, such as LinkedIn. When you click such a link, the privacy rules of that service apply.

4. Changes to this privacy policy

This privacy policy may be updated, for example when I introduce new tools or change the way I provide my services. The current version is always available on this page.

Last updated: 20 October 2026.

If anything in this policy is unclear, please write to me at hello@focuspointcoaching.com.