Last Updated: October 26, 2025

1. Controller Information

Gabriela Birova
Leadership & Executive Coaching
Email: hi@gabrielabirova.com
Website: www.gabrielabirova.com

As the controller, I am responsible for the processing of your personal data in accordance with the General Data Protection Regulation (GDPR) and the Austrian Data Protection Act (DSG).

2. Personal Data We Collect

2.1 Information You Provide Directly

• Contact Forms & Inquiries: Name, email address, phone number, company information, and any details you share in your message
• Booking Appointments: Name, email, time zone, scheduling preferences
• Mentoring Programs: Professional background, career goals, leadership challenges, and any information shared during sessions
• Payment Information: Billing details (processed securely through third-party payment processors)
• Newsletter Subscriptions: Email address and communication preferences

2.2 Information Collected Automatically

• Technical Data: IP address, browser type and version, device information, operating system
• Usage Data: Pages visited, time spent on pages, click patterns, referral sources
• Cookies and Similar Technologies: See Section 5 for details

3. How We Use Your Personal Data

3.1 Legal Bases and Purposes

We process your personal data based on the following legal grounds:

Contractual Necessity (Article 6(1)(b) GDPR)

• Delivering mentoring and coaching services
• Processing bookings and appointments
• Communicating about our services
• Managing client relationships

Legitimate Interest (Article 6(1)(f) GDPR)

• Analyzing website performance and user behavior
• Improving our services and website functionality
• Preventing fraud and ensuring security
• Marketing our services to existing clients

Consent (Article 6(1)(a) GDPR)

• Sending marketing communications and newsletters
• Using cookies and analytics tools (where required)
• Recording mentoring sessions (only with explicit consent)

Legal Obligation (Article 6(1)(c) GDPR)

• Maintaining records for tax and accounting purposes
• Complying with legal requirements

4. Data Sharing and Disclosure

4.1 Service Providers

We share your data with carefully selected service providers who assist us in operating our business:

Website Hosting & Infrastructure

• Hosting services for website operation
• Contractual data processing agreements in place

Analytics Services

• Google Analytics: Website traffic and user behavior analysis (anonymized IP addresses)
• Microsoft Clarity: User session recordings and heatmaps for improving user experience

Communication Tools

• Email service providers for communications
• Video conferencing platforms for mentoring sessions (Zoom, Microsoft Teams, Google Meet)
• Scheduling tools (Calendly or similar)

Payment Processors

• Stripe and/or PayPal for secure payment processing
• These providers have their own privacy policies

All service providers are contractually obligated to protect your data and may only use it for the specified purposes.

4.2 Legal Requirements

We may disclose your information if required by law, court order, or governmental authority, or to protect our legal rights.

4.3 No Selling of Data

We do not sell, rent, or trade your personal information to third parties for their marketing purposes.

5. Cookies and Tracking Technologies

5.1 What Are Cookies?

Cookies are small text files stored on your device when you visit our website. They help us provide you with a better experience.

5.2 Types of Cookies We Use

Strictly Necessary Cookies

• Essential for website functionality
• Cannot be disabled without affecting site performance
• Legal basis: Legitimate interest

Analytics Cookies

• Google Analytics (performance tracking)
• Microsoft Clarity (user experience analysis)
• Legal basis: Consent (obtained through cookie banner)

Functional Cookies

• Remember your preferences and settings
• Legal basis: Consent

5.3 Managing Cookies

You can control cookies through:

• Our cookie consent banner (when you first visit)
• Your browser settings
• Opt-out tools: Google Analytics Opt-out

6. International Data Transfers

Some of our service providers are located outside the European Economic Area (EEA), particularly in the United States. When transferring data internationally, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions where applicable
• Other legally approved transfer mechanisms

7. Data Retention

We retain your personal data only as long as necessary for the purposes outlined in this policy:

• Client Records: Duration of mentoring relationship plus 7 years (for tax/legal purposes)
• Contact Inquiries: Up to 2 years if no engagement occurs
• Newsletter Subscriptions: Until you unsubscribe
• Analytics Data: Anonymized after 26 months (Google Analytics default)
• Payment Records: 7 years (Austrian tax law requirement)

8. Your Rights Under GDPR

You have the following rights regarding your personal data:

8.1 Right of Access (Article 15)

Request a copy of the personal data we hold about you.

8.2 Right to Rectification (Article 16)

Request correction of inaccurate or incomplete data.

8.3 Right to Erasure (Article 17)

Request deletion of your data (“right to be forgotten”) under certain circumstances.

8.4 Right to Restriction (Article 18)

Request that we limit how we use your data.

8.5 Right to Data Portability (Article 20)

Receive your data in a structured, commonly used format.

8.6 Right to Object (Article 21)

Object to processing based on legitimate interests or for direct marketing.

8.7 Right to Withdraw Consent (Article 7(3))

Withdraw your consent at any time where processing is based on consent.

8.8 Right to Lodge a Complaint

Contact the Austrian Data Protection Authority (Datenschutzbehörde):

• Website: www.dsb.gv.at
• Email: dsb@dsb.gv.at
• Phone: +43 1 531 15-202525

To exercise any of these rights, please contact: hi@gabrielabirova.com

We will respond to your request within one month.

9. Confidentiality in Coaching Relationships

All information shared during mentoring and coaching sessions is treated with strict confidentiality. This includes:

• Session content and discussions
• Personal and professional challenges
• Career aspirations and development plans
• Any sensitive information disclosed

Exceptions to confidentiality:

• Where required by law
• Where there is risk of harm to yourself or others
• With your explicit written consent

Session recordings are only made with your explicit advance consent and are stored securely.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data:

• Encryption: SSL/TLS encryption for data transmission
• Access Controls: Limited access to personal data on a need-to-know basis
• Secure Storage: Encrypted databases and secure servers
• Regular Audits: Periodic security assessments
• Backup Systems: Regular, secure backups

Despite our safeguards, no internet transmission is completely secure. We cannot guarantee absolute security.

11. Children’s Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately.

12. Third-Party Links

Our website may contain links to external websites. We are not responsible for the privacy practices of these sites. Please review their privacy policies before providing any information.

13. Changes to This Privacy Policy

We may update this privacy policy periodically to reflect changes in our practices or legal requirements. The “Last Updated” date at the top indicates when changes were last made.

Significant changes will be communicated via:

• Prominent notice on our website
• Email notification to registered users
• Updated version posted with revision history

14. Contact & Data Protection Officer

For questions about this privacy policy or to exercise your rights:

Primary Contact:
Gabriela Birova
Email: hi@gabrielabirova.com

For Privacy-Specific Inquiries:
Email: hi@gabrielabirova.com
Subject Line: “Privacy Inquiry – GDPR”

We aim to respond to all inquiries within 5 business days and will resolve requests within the legally required timeframes.

Effective Date: October 26, 2025

By using our website and services, you acknowledge that you have read and understood this privacy policy.