Privacy Policy - Sofroflow

Sofroflow - Maria Będzińska · in force from 20 August 2026

1. Data controller

Maria Będzińska, Sofroflow, address: Junony 92, 80-299 Gdańsk, Poland. Contact: maria@sofroflow.com

This Policy covers all Sofroflow services - one-to-one sessions, group sessions, courses and workshops, online and in person - and use of the website www.sofroflow.com.

2. What data, and why

• Contact and organisational details - full name, email, telephone, and for sessions with minors the participant’s age and the parent’s details. Purpose: booking, contact, settlement of payment. Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• Messages sent through the website - name, email address and the content of messages sent through the contact form or sign-up forms. Purpose: replying and dealing with the request. Legal basis: steps taken before entering into a contract (Article 6(1)(b) GDPR) or legitimate interest in replying to correspondence (Article 6(1)(f) GDPR).
• Health information - provided by the participant or a parent, before or during the work together (for example by email), solely in order to deliver the exercises safely. It is not used for diagnostic purposes. Providing it is voluntary, but it may be necessary for safe participation. Legal basis: explicit consent, and for minors the consent of a parent (Article 9(2)(a) GDPR).
• Session notes - used solely to deliver sessions, stored securely, not disclosed to third parties. Legal basis: legitimate interest (Article 6(1)(f) GDPR).
• Notifications of new dates - if you leave your email address to hear about the next date of a course, meeting or event. Legal basis: consent (Article 6(1)(a) GDPR). You may withdraw it at any time: maria@sofroflow.com
• Payment records - the data necessary to settle payments. Legal basis: legal obligation (Article 6(1)(c) GDPR).

3. Who I share data with

I do not sell data and I do not share it for marketing purposes. I use tools supplied by:

• Google Ireland Limited - email, storage, forms
• Providers of online meeting platforms (for example Google Meet, Zoom, FaceTime) - online sessions
• trulyBalance Sàrl, Coppet, Switzerland - the beChill® app
• Provider of the online booking system - booking of free introductory conversations
• Website hosting and email-sending providers - running the website and delivering messages sent through its forms
• Accountancy office - bookkeeping and tax settlements

Each of these entities processes data solely to the extent necessary to provide its own service.

Switzerland is covered by a European Commission adequacy decision, so no additional safeguards are required for transfers there. For the remaining suppliers, transfers outside the EEA take place on the basis of the mechanisms provided for in the GDPR, such as the EU–US Data Privacy Framework or standard contractual clauses.

4. The website - cookies

The website uses only essential cookies - small files saved on your device that allow the website to work correctly, for example to remember the language you have chosen. They do not require consent. The website does not use analytics or advertising cookies.

You may block cookies in your browser settings - some website functions may then not work correctly.

5. Online sessions, confidentiality, supervision

Online meetings take place via video platforms such as Google Meet, Zoom or FaceTime. No platform, however, guarantees complete transmission security. I do not record or transcribe sessions without the participants’ prior consent; participants are prohibited from recording.

What participants share is confidential. Confidentiality is broken where I form a reasonable suspicion that the health, safety or welfare of a participant or of another person is at risk - in which case I inform the participant, and where the person is a minor, their parent or guardian. I also disclose data where an obligation to do so arises from provisions of law.

I take part in supervision conducted by a qualified sophrologist. The matters discussed contain no data permitting identification of a participant, and the person providing supervision is bound by confidentiality.

6. Minors

For participants under 18 years of age, consent is given by a parent or legal guardian. The parent is informed about the general course of the sessions and about the participant’s attendance; the extent of any further information is agreed at the outset - subject to section 5.

7. How long I keep data

I keep data for the period necessary to achieve the purpose concerned, and thereafter for the period required by tax and accounting legislation.

Session notes and health information are kept securely, separately from other data, until the limitation period for any claims has expired. They are erased after that time.

Messages sent through the website - for as long as needed to reply and deal with the matter. Email addresses left to receive notifications of new dates - until consent is withdrawn.

8. Your rights

You have the right to access your data and obtain a copy of it, to rectification, erasure, restriction of processing, data portability, to object, and to withdraw consent at any time - without affecting the lawfulness of processing carried out beforehand.

Write to maria@sofroflow.com - I respond no later than within one month. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.

9. Security and changes

I apply measures appropriate to the scale of the business: passwords, two-factor authentication, an encrypted connection to the website. Transmitting information electronically nevertheless carries a risk that cannot be entirely eliminated.

I may update this Policy - the version published at www.sofroflow.com is the one in force.

This is a translation of the Polish document “Polityka prywatności” provided for information. In the event of any discrepancy between this English version and the Polish original, the Polish version prevails.