Privacy Policy

Last updated: 28 September 2026

1. Introduction

This Privacy Policy explains how personal data is collected, used and protected when you visit www.fayecardwellcoaching.com (the "Website") or use the business mentoring services offered through it. Personal data is processed in accordance with the EU General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG).

2. Controller

The controller responsible for data processing on this Website is:

Faye Cardwell
Hohenzollernstrasse 61
80796 Munich, Germany
Email: [email protected]

A data protection officer has not been appointed, as there is no legal obligation to do so.

3. Hosting and Website Platform

This Website, including its contact forms, booking system, email marketing and customer relationship management, is operated on the FEA Create platform, provided by Carrie & Co Ltd (trading as Female Entrepreneur Association), PO Box 164, Stockport, SK7 3WH, United Kingdom ("FEA"). FEA uses the infrastructure of HighLevel, Inc., USA, as a sub-processor, which is hosted on Amazon Web Services and Google Cloud. When you visit the Website, the platform automatically collects technical information in server log files, including your IP address, browser type and version, operating system, referring URL, and the date and time of access. This data is required to deliver the Website securely and reliably and is processed on the basis of legitimate interest (Art. 6(1)(f) GDPR). A data processing agreement has been concluded with FEA in accordance with Art. 28 GDPR. The European Commission has recognised the United Kingdom as providing an adequate level of data protection. Data is transferred to the United States on the basis of the EU–US Data Privacy Framework and Standard Contractual Clauses (see Section 11).

4. Cookies

The Website uses cookies. Technically necessary cookies, which are required for the Website to function, are set on the basis of § 25(2) TDDDG and Art. 6(1)(f) GDPR. All other cookies are only set with your consent, given via the cookie banner, on the basis of § 25(1) TDDDG and Art. 6(1)(a) GDPR. You may withdraw or change your consent at any time via the cookie settings on the Website or by deleting cookies in your browser.

5. Contact and Enquiries

If you contact me by email or via the contact form, the data you provide (such as your name, email address and message) will be processed to handle your enquiry. Where your enquiry relates to a contract or pre-contractual steps, the legal basis is Art. 6(1)(b) GDPR; otherwise it is my legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR). Email is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus, with whom a data processing agreement has been concluded. Enquiry data is deleted once the matter has been concluded, unless statutory retention obligations apply.

6. Booking Appointments

Calls and sessions, including Coffee & Clarity conversations, can be booked via the booking system on the Website. For this purpose, your name, email address, selected appointment time and any information you enter in the booking form are processed. When you book an online session, a Zoom meeting is created automatically (see Section 9.3). The legal basis is Art. 6(1)(b) GDPR (pre-contractual steps or performance of a contract).

7. Newsletter and Free Resources

If you subscribe to the Tuesday Takeaways newsletter or request a free resource (such as the Aligned Offer Audit), your email address and name are processed to send you the requested content and the newsletter. The time of registration is recorded to document your consent. The legal basis is your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in every email; your data will then be removed from the mailing list. The lawfulness of processing carried out before withdrawal remains unaffected.

8. Payments

Payments are processed by Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland ("Stripe"). When you make a payment, your payment details (such as name, email address, card or bank information and billing address) are transmitted directly to Stripe. I do not receive or store your full card details. The legal basis is Art. 6(1)(b) GDPR. A data processing agreement has been concluded with Stripe. For certain purposes, such as fraud prevention and compliance with financial regulations, Stripe processes data as an independent controller. Stripe may transfer data to Stripe, Inc. in the United States; see Section 11. Further information: https://stripe.com/privacy.

9. Coaching and Mentoring Services

9.1 Client Data

If you become a client, I process the information required to deliver my services, including your contact details, information about your business, notes from sessions, materials you share, and correspondence. The legal basis is Art. 6(1)(b) GDPR. Please do not share sensitive personal data (such as health information) unless it is genuinely necessary; if you do, it will be processed only on the basis of your explicit consent (Art. 9(2)(a) GDPR).

9.2 Storage of Client Records

Client records are stored using Hetzner Storage Share, provided by Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany. Data is stored exclusively on servers located in Germany. A data processing agreement has been concluded with Hetzner in accordance with Art. 28 GDPR.

9.3 Online Sessions (Zoom)

Online sessions are held via Zoom, provided by Zoom Communications, Inc., 55 Almaden Blvd, Suite 600, San Jose, CA 95113, USA. When you take part in a session, data such as your name, email address, IP address, device information, and your image and voice are processed. The legal basis is Art. 6(1)(b) GDPR. A data processing agreement has been concluded with Zoom. Zoom is certified under the EU–US Data Privacy Framework, on the basis of which data transfers to the United States take place (see Section 11). Further information: https://www.zoom.com/en/trust/privacy/privacy-statement/.

9.4 Session Recording, Transcripts and Summaries (Zoom)

With your prior consent, online sessions may be recorded using Zoom's cloud recording function, and a transcript and AI-generated summary may be created using Zoom AI Companion. The summary is reviewed before being sent to you. The legal basis is your consent (Art. 6(1)(a) GDPR). You will be informed before recording begins, and you may decline or withdraw consent at any time without any effect on the service you receive. Recordings, transcripts and summaries are automatically deleted from Zoom after 60 days and permanently removed within a further 30 days. The provider and data transfer details set out in Section 9.3 apply.

9.5 AI-Assisted Session Analysis

To prepare session summaries and follow-up materials, anonymised excerpts from session transcripts may be analysed using AI tools. Names and other identifying details are removed before any such analysis takes place.

10. Retention Periods

Client data is generally retained for 18 months after the end of the working relationship and then deleted. You may request earlier deletion at any time, subject to statutory obligations. Session recordings, transcripts and summaries held in Zoom are deleted as described in Section 9.4. Invoices and other records required under German commercial and tax law (§ 257 HGB, § 147 AO) are retained for the statutory periods, which are generally up to 10 years. Where data is subject to such an obligation, its processing is restricted to that purpose.

11. Transfers to Third Countries

Some of the service providers listed above are based in, or may transfer data to, countries outside the European Union/European Economic Area, in particular the United States (FEA's infrastructure provider HighLevel, Inc., Zoom, Stripe, and certain sub-processors used by Hostinger for email delivery and security). Such transfers take place on the basis of an adequacy decision of the European Commission, including the EU–US Data Privacy Framework where the provider is certified, or on the basis of Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR. Client records stored with Hetzner remain within Germany.

12. Your Rights

You have the following rights regarding your personal data:

the right of access (Art. 15 GDPR)

the right to rectification (Art. 16 GDPR)

the right to erasure (Art. 17 GDPR)

the right to restriction of processing (Art. 18 GDPR)

the right to data portability (Art. 20 GDPR)

the right to object to processing based on legitimate interest (Art. 21 GDPR)

the right to withdraw consent at any time, with effect for the future (Art. 7(3) GDPR)

To exercise any of these rights, please contact [email protected].

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible is the Bavarian State Office for Data Protection Supervision (Bayerisches Landesamt für Datenschutzaufsicht), Promenade 18, 91522 Ansbach, Germany (www.lda.bayern.de).

13. Automated Decision-Making

No automated decision-making, including profiling, within the meaning of Art. 22 GDPR takes place.

14. Security

Appropriate technical and organisational measures are used to protect your data, including SSL/TLS encryption of this Website, which is indicated by "https://" in your browser's address bar.

15. Changes to This Policy

This Privacy Policy may be updated to reflect changes in services or legal requirements. The current version is always available on this Website.