Privacy Policy
Deborah Smits
Last updated: June 2026
1. Introduction
Your privacy matters to me. This Privacy Policy explains what personal data I collect, why I collect it, how I use it, and what rights you have. I am committed to handling your data with care and in full compliance with the General Data Protection Regulation (GDPR) and the Dutch Implementation Act (UAVG).
Data controller:
Deborah Smits — Sole proprietorship (eenmanszaak), registered in the Netherlands
KVK: 99635887
VAT: NL005399946B81
Email: [email protected]
Website: deborahsmits.com
2. What Data I Collect and Why
2.1 When you sign up for a free product or newsletter
- Name and email address
- Purpose: To deliver the free product and to send you newsletters, updates, and offers
- Legal basis: Consent (Article 6(1)(a) GDPR)
2.2 When you purchase a product or service
- Name, email address, and billing details (processed via Mollie — I do not store payment card details)
- Purchase history and access data
- Purpose: To process your order, deliver your product, manage your account, and comply with legal obligations (tax records)
- Legal basis: Performance of a contract (Article 6(1)(b) GDPR) and legal obligation (Article 6(1)(c) GDPR)
2.3 When you visit the website
- IP address, browser type, pages visited, time spent on pages (via cookies and analytics tools)
- Purpose: To understand how the website is used and to improve user experience
- Legal basis: Legitimate interests (Article 6(1)(f) GDPR) or consent where required
2.4 When you contact me
- Name, email address, and any information you include in your message
- Purpose: To respond to your enquiry
- Legal basis: Legitimate interests (Article 6(1)(f) GDPR)
3. Newsletters and Marketing Emails
If you have subscribed to my newsletter — whether via a free product, a sign-up form, or at checkout — I will send you emails about my products, programmes, events, and offers.
You can unsubscribe at any time by clicking the unsubscribe link at the bottom of any email. After unsubscribing, your email address will be removed from the mailing list within a reasonable time.
I use Kajabi to manage and send email communications. Your data is stored on Kajabi's servers. See section 5 for more on third parties.
4. How Long I Keep Your Data
|
Type of data |
Retention period |
|
Newsletter subscribers |
Until you unsubscribe |
|
Customer purchase data |
7 years (Dutch tax law requirement) |
|
Contact enquiries |
Maximum 1 year after last contact |
|
Website analytics |
As set by the analytics tool (typically 14 months) |
5. Third Parties
I work with a number of trusted third-party services to run my business. Each processes your data only to the extent necessary for the service they provide.
|
Service |
Purpose |
Location |
|
Kajabi |
Website, programme delivery, email |
USA (Standard Contractual Clauses apply) |
|
Plug & Pay |
Checkout and sales funnels |
Netherlands |
|
Mollie |
Payment processing |
Netherlands (DNB regulated) |
|
Zapier |
Automation between platforms |
USA (Standard Contractual Clauses apply) |
|
Google Workspace |
Email communication |
USA (Standard Contractual Clauses apply) |
|
Google Analytics (if used) |
Website analytics |
USA (Standard Contractual Clauses apply) |
I do not sell your personal data to third parties. I do not share your data with third parties for their own marketing purposes.
Where data is transferred outside the European Economic Area (EEA), appropriate safeguards are in place, including Standard Contractual Clauses as approved by the European Commission.
6. Cookies
My website uses cookies — small text files stored on your device — for the following purposes:
Functional cookies — necessary for the website to work correctly (e.g. language preference, login session). No consent required.
Analytical cookies — to understand how visitors use the website (e.g. Google Analytics). These are placed only with your consent.
Marketing cookies — to show relevant offers or retargeting advertisements. These are placed only with your consent.
You can manage or withdraw your cookie consent at any time via the cookie banner on this website or through your browser settings.
7. Your Rights Under the GDPR
As a data subject, you have the following rights:
Right of access — You may request a copy of the personal data I hold about you.
Right to rectification — You may request that I correct inaccurate or incomplete data.
Right to erasure — You may request that I delete your personal data, subject to legal retention obligations.
Right to restriction — You may request that I restrict processing of your data in certain circumstances.
Right to data portability — You may request that I provide your data in a structured, machine-readable format.
Right to object — You may object to processing based on legitimate interests or for direct marketing purposes. If you object to direct marketing, I will stop immediately.
Right to withdraw consent — Where processing is based on your consent, you may withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.
To exercise any of these rights, please contact me at [email protected]. I will respond within 30 days. I may ask you to verify your identity before processing your request.
8. Complaints
If you have a concern about how I handle your personal data, please contact me first at [email protected] and I will do my best to resolve it.
You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens):
Website: autoriteitpersoonsgegevens.nl
Telephone: +31 (0)88 1805 250
9. Security
I take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. These include secure connections (HTTPS), access controls, and working only with reputable third-party providers.
10. Changes to This Privacy Policy
I may update this Privacy Policy from time to time to reflect changes in my practices or applicable law. The current version is always available on this page. The date at the top of this page indicates when it was last updated.
11. Contact
For any questions about this Privacy Policy or your personal data, please contact:
Deborah Smits
deborahsmits.com
12. Online Events via Zoom
For online women's circles and other live online events, I use Zoom as the video conferencing platform. When you participate in a Zoom session, Zoom processes certain personal data, including your name (as displayed in Zoom), email address, IP address, and device information. This data is processed by Zoom Video Communications, Inc., based in the USA. Standard Contractual Clauses apply for data transfers outside the EEA. For more information, see Zoom's Privacy Policy at zoom.us/privacy.
Camera use
Camera use is encouraged but never mandatory.
Recordings
Some sessions may be recorded — for example, to make a replay available to participants. If a session is recorded, you will be informed before the session begins. You will always have the option to turn your camera off before recording starts if you prefer not to appear on screen. Recordings are stored securely. They may be shared with participants of that specific session, or made available at a later date as a standalone product (free or paid) to a broader audience. You will always be informed of this intended use before the session begins, giving you the opportunity to keep your camera off if you prefer not to appear in a recording that will be shared more widely. Recordings are not used for marketing or promotional purposes without your explicit consent.
If you do not wish to be recorded under any circumstances, please let me know before the session and we will find a suitable arrangement.
