Privacy Policy

Effective date: 28 August 2026

This Privacy Notice explains how Ilaria Orlandi collects, uses, stores and shares personal data when you visit this website, contact me, subscribe to communications, purchase or use my services, participate in coaching, or otherwise interact with me.

1. Who is responsible for your personal data?

The data controller is:

Ilaria Orlandi
Sole proprietor
Route de Nyon 10
1270 Trélex
Switzerland

Email: [email protected]

In this Privacy Notice, “I”, “me” and “my” refer to Ilaria Orlandi.

2. Who are my services intended for?

My paid coaching services are intended for individuals aged 18 or over. I do not knowingly collect personal data from children in connection with those services.

If you believe that a child has provided personal data to me without appropriate authorisation, please contact me so that I can take appropriate action.

3. What personal data may I collect?

Depending on how you interact with me, I may collect the following categories of personal data.

Contact and identification data

This may include your:

Name and full legal name.

Email address.

Telephone number.

Postal and billing address.

Country of residence.

Other contact details you choose to provide.

Enquiry and consultation data

This may include:

Information submitted through contact, application or booking forms.

Information shared during an introductory or clarity call.

Your interests, objectives and reasons for contacting me.

Email correspondence and other communications.

Contract and transaction data

This may include:

Proposals, agreements and electronic signatures.

Services or programmes purchased.

Dates and status of contracts.

Invoices and payment status.

Transaction identifiers and limited payment information.

Records required for accounting, taxation and the establishment or defence of legal claims.

Payment-card information is generally processed directly by the relevant payment provider. I do not ordinarily receive or store your complete card number.

Coaching and service-delivery data

This may include:

Appointment and scheduling information.

Intake-form responses.

Coaching objectives and reflections.

Information you choose to share during sessions.

Relevant session notes.

Integration emails.

Questions, reflections and messages exchanged between sessions.

Information about your participation in courses, practices, workshops or other services.

Information about your access to prerecorded practices and digital content.

Files or documents you choose to provide.

Live coaching sessions are conducted through Zoom. Coaching sessions are not recorded or transcribed unless this has been expressly discussed and agreed with you in advance.

Sensitive personal data

Because my work may involve the body, nervous system, emotions and personal development, you may choose to share information concerning your physical or mental health, emotional wellbeing, relationships or other private aspects of your life.

Some of this information may constitute sensitive personal data under the Swiss Federal Act on Data Protection or special-category data under the EU General Data Protection Regulation.

Please share only information that you consider relevant and appropriate for the coaching relationship. I process this information only where necessary to provide the services you have requested and with additional care and confidentiality.

Where the law requires explicit consent for particular processing of sensitive data, I will request that consent separately. You may withdraw consent at any time, although this will not affect processing that has already lawfully taken place and may affect my ability to continue providing certain services.

My services are coaching services and are not medical treatment, psychotherapy or emergency support.

Website and technical data

When you use my website or client portal, certain information may be collected automatically, including:

IP address.

Browser and device type.

Operating system.

Approximate location inferred from technical information.

Pages visited and links selected.

Date, time and duration of visits.

Referring website or source.

Login and client-portal activity.

Cookie identifiers and similar technical information.

Marketing data

This may include:

Newsletter subscriptions.

Communication preferences.

Records of consent.

Email engagement information, such as whether an email was delivered or opened.

Records of unsubscribing or opting out.

4. How do I collect personal data?

I may collect personal data:

Directly from you when you contact me, complete a form, book a call, enter into an agreement, make a purchase or participate in coaching.

Through Ivorey forms, proposals, contracts, client portals, courses and other platform features.

Through email, WhatsApp, Zoom and other communication channels you use to interact with me.

Through payment providers when you make a purchase.

Automatically through cookies and similar technologies.

From third parties where you have authorised the disclosure or where it is otherwise lawful.

5. Why do I process personal data?

I may process personal data to:

Respond to enquiries.

Arrange introductory calls and appointments.

Assess whether my services are an appropriate fit.

Prepare, enter into and administer agreements.

Deliver coaching, courses, workshops and other purchased services.

Personalise the focus and delivery of coaching.

Provide integration emails and between-session support.

Provide access to prerecorded practices and other digital content.

Manage client-portal access.

Process payments, issue invoices and maintain transaction records.

Communicate about appointments, services and administrative matters.

Provide technical or customer support.

Maintain the security and proper operation of my website and systems.

Prevent misuse, fraud and unauthorised access.

Comply with accounting, taxation and other legal obligations.

Establish, exercise or defend legal claims.

Send newsletters or marketing communications where you have requested them.

Understand and improve my website, communications and services.

Protect the rights, safety and legitimate interests of clients, myself and others.

6. Legal grounds for processing

Under Swiss data-protection law, I process personal data in accordance with the principles of lawfulness, good faith, transparency, proportionality, purpose limitation and data security.

Where the GDPR applies, I generally rely on one or more of the following legal grounds:

Steps before entering into a contract or performance of a contract: for enquiries, bookings, agreements, payments and delivery of services.

Legal obligations: for accounting, taxation and other mandatory records.

Legitimate interests: for operating and protecting my business, communicating with clients, maintaining appropriate records, improving services and establishing or defending legal claims, provided those interests are not overridden by your rights.

Consent: for newsletters, non-essential analytics cookies and any other processing for which consent is required.

Explicit consent: where required for particular processing of sensitive or special-category data.

Protection of vital interests or other grounds permitted by law: in exceptional circumstances involving serious and imminent risk.

You may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing undertaken before withdrawal.

7. Marketing communications

I will send you marketing emails only where you have requested them or where another lawful basis permits me to do so.

You may unsubscribe at any time by:

Selecting the unsubscribe link in a marketing email; or

Contacting me at [email protected].

After you unsubscribe, I may retain limited information on a suppression list so that I can respect your preference and avoid sending further marketing communications.

Administrative communications connected with an agreement, appointment or purchased service are not marketing messages and may still be sent where necessary.

8. Who may receive your personal data?

I do not sell your personal data.

I may share personal data with carefully selected service providers where reasonably necessary to operate my business and deliver the services.

Ivorey and HighLevel

I use Ivorey Pty Ltd for website hosting and management, forms, bookings, client records, proposals, contracts, electronic signatures, invoices, automations, client portals, courses and access to prerecorded practices and other digital content.

Ivorey operates using software and infrastructure provided by HighLevel, Inc. Ivorey and HighLevel may process contact details, contract and payment records, communications, portal activity, technical information and content submitted through the platform.

Ivorey and its underlying infrastructure may also record information about whether and when you access courses, prerecorded practices or other digital content.

Zoom

I use Zoom Video Communications, Inc. to conduct live online coaching sessions.

When you join a Zoom session, Zoom may process information such as your name, display name, email address, IP address, device information, meeting participation details and any audio, video, chat or other content you choose to share during the session.

Coaching sessions are not recorded or transcribed unless this has been expressly discussed and agreed with you in advance.

Payment providers

I use Stripe or another connected payment provider to process payments, issue payment confirmations, manage transaction records and help prevent fraud.

The payment provider may process your name, contact details, billing information, payment-card details, transaction amount and other information necessary to complete and protect the transaction. I do not ordinarily receive your complete payment-card details.

WhatsApp and Meta

If you choose to communicate with me through WhatsApp, information such as your telephone number, profile information, message metadata and message content will be processed through WhatsApp and its provider, Meta.

You should avoid using WhatsApp for emergencies or for information that you do not wish to communicate through that service.

Google Analytics and Google Tag Manager

I use Google Analytics to understand how visitors use my website, including which pages are visited, how visitors reach the website and how they interact with its content.

Google Analytics may process information including your IP address, device and browser information, approximate location, website activity and cookie or similar identifiers.

I may use Google Tag Manager to manage website tags. Google Tag Manager does not itself provide website analytics, but it may activate Google Analytics and other technologies in accordance with the website configuration and your consent choices.

Google Analytics is used only after you provide consent through the website’s cookie controls where that consent is legally required. You may withdraw consent or change your preferences at any time through those controls.

Other recipients

I may also share personal data with:

Email-delivery and communication providers.

Cloud-storage, website-security and technical-support providers.

Cookie-consent and website-management providers.

Professional advisers, including accountants, lawyers and insurers, where reasonably necessary and subject to appropriate confidentiality duties.

Public authorities, courts or regulators where disclosure is required or permitted by law.

Service providers receive only the personal data reasonably necessary for their role and process it subject to contractual, confidentiality and data-protection obligations where required.

9. International transfers

Some service providers and their subprocessors are located in, or may process personal data from, countries outside Switzerland, including Australia, the United States and countries within the European Economic Area.

These countries may not provide the same level of statutory data protection as Switzerland.

Ivorey is based in Australia and operates using HighLevel infrastructure. Zoom, Stripe, Meta and Google operate internationally and may process personal data in the United States and other countries in which they or their service providers operate.

Where required, international transfers are protected through an applicable legal mechanism, such as:

A determination that the destination country provides adequate protection.

The Swiss–U.S. Data Privacy Framework or EU–U.S. Data Privacy Framework where the recipient is appropriately certified and the framework applies.

Approved standard contractual clauses, supplemented where necessary for Swiss law.

Another safeguard or exception permitted by applicable data-protection law.

Information about the relevant safeguards may be requested by contacting me.

Because service providers and subprocessor arrangements can change, I periodically review the providers used and update this Privacy Notice where necessary.

10. Data security and confidentiality

I take appropriate organisational and technical measures designed to protect personal data from accidental or unlawful loss, destruction, alteration, unauthorised disclosure or access.

These measures may include:

Password-protected systems.

Restricted access on a need-to-know basis.

Two-factor authentication where available.

Secure service providers.

Access controls and activity records.

Appropriate confidentiality obligations.

Regular review of account permissions and security settings.

Zoom meeting passcodes and waiting-room controls.

No internet-based system can be guaranteed to be completely secure. If you choose to communicate sensitive information through ordinary email or WhatsApp, you should be aware that these channels may carry privacy and security risks.

Information shared within the coaching relationship is treated confidentially. It may be disclosed only:

With your consent.

To service providers who need access to support delivery or administration.

Where required by law or a competent authority.

Where reasonably necessary and legally permitted to address a serious and imminent risk of harm.

If a personal-data breach is likely to create a high risk to the personality or fundamental rights of affected individuals, I will notify the Swiss Federal Data Protection and Information Commissioner as soon as required by law. I will inform affected individuals where necessary for their protection or otherwise required by applicable law.

11. How long do I retain personal data?

I retain personal data only for as long as reasonably necessary for the relevant purpose, including contractual, accounting, legal and security requirements.

Indicative retention periods include:

Accounting, invoice, payment and transaction records: generally ten years where required under Swiss law.

Contracts, proposals and electronic-signature records: for the period reasonably necessary to administer the agreement and establish or defend legal claims, which may be up to ten years.

Coaching notes, intake responses and substantive coaching communications: ordinarily up to three years after the coaching relationship ends, unless earlier deletion is appropriate or longer retention is required to protect legal rights.

Routine appointment and administrative communications: ordinarily up to three years after the relationship ends.

Enquiries that do not result in a client relationship: ordinarily up to 24 months after the last meaningful contact.

Marketing information: until you unsubscribe, withdraw consent or the information is no longer required, subject to retaining limited suppression information.

Website analytics and cookies: according to the relevant tool settings and cookie-retention periods.

Security and activity logs: for the period reasonably required for security, troubleshooting and fraud prevention.

Data may be retained for longer where required by law, where a dispute or legal claim exists, or where necessary to protect an overriding legitimate interest.

When personal data is no longer required, I will delete or anonymise it where reasonably practicable. Residual copies may remain temporarily in secure backups until they are overwritten through normal backup cycles.

12. Your rights

Depending on the law applicable to you, you may have the right to:

Ask whether I process personal data about you.

Request access to your personal data.

Request correction of inaccurate or incomplete data.

Request deletion of personal data.

Object to particular processing.

Request restriction of processing.

Request the transfer or portability of certain data.

Withdraw consent at any time.

Receive information about applicable international-transfer safeguards.

Express your point of view and request human review if an automated individual decision significantly affects you.

These rights are not absolute. A request may be limited where processing or retention is required by law, necessary for an agreement, required to protect the rights of another person, or supported by another lawful basis.

To exercise your rights, contact:

[email protected]

I may need to verify your identity before responding. I will respond within the period required by applicable law.

If you are in Switzerland, you may also contact the:

Federal Data Protection and Information Commissioner (FDPIC)
www.edoeb.admin.ch

If the GDPR applies to you, you may complain to the competent data-protection authority in your country of residence, work or the place of the alleged infringement.

13. Automated decision-making

I do not currently use solely automated decision-making that produces legal effects or similarly significant effects concerning coaching clients.

If this changes, I will provide the information required by applicable law.

14. Cookies and similar technologies

My website uses cookies and similar technologies that may be necessary to:

Operate the website.

Remember preferences.

Protect forms and accounts.

Measure website use and performance.

Understand the effectiveness of communications or marketing.

The website uses Ivorey/HighLevel technology, Google Analytics and Google Tag Manager.

Strictly necessary cookies may be used without consent where permitted. Google Analytics and other non-essential analytics or marketing technologies are used only after consent where legally required.

You can manage or withdraw cookie preferences through the cookie controls provided on the website. You may also adjust your browser settings, although disabling certain cookies may affect website functionality.

Further details about active cookies, providers, purposes and durations should be available through the website’s cookie banner or cookie settings panel.

15. Third-party websites and services

My website, emails or client portal may contain links to third-party websites or services. Those third parties process personal data according to their own privacy notices and practices.

I am not responsible for the privacy practices of third-party websites that I do not control. You should review their privacy information before providing personal data.

If I later embed content from another provider, such as YouTube, I will update this Privacy Notice and the relevant cookie information where necessary.

16. Changes to this Privacy Notice

I may update this Privacy Notice to reflect changes in my services, systems, providers or legal obligations.

The current version will be published on my website with the date of the latest update. Where a change materially affects the way I process existing client data, I will take reasonable steps to bring the change to the attention of affected individuals.

17. Contact

If you have questions about this Privacy Notice or how your personal data is handled, contact:

Ilaria Orlandi
Route de Nyon 10
1270 Trélex
Switzerland

Email: [email protected]