Privacy Policy

1. Who is responsible

The controller of your personal data is K1 Bridge, [address to be added], email coaching@k1bridge.com ("we", "us"). We have not appointed a data protection officer, as this is not required for our size. For any privacy question, write to coaching@k1bridge.com.

2. Which data we process and why

• Contact & communication — name, email, message content when you write to us. Purpose: answering you. Legal basis: steps prior to a contract / legitimate interest (Art. 6(1)(b) and (f) GDPR).
• Free guide sign-up — email address, language, time of consent. Purpose: sending you the guide and occasional emails you agreed to. Legal basis: your consent (Art. 6(1)(a)). You can withdraw it at any time.
• Booking a discovery call or session — name, email, the answers you give, date and time. Purpose: scheduling and preparing the conversation. Legal basis: steps prior to a contract / contract (Art. 6(1)(b)).
• Client account — email, name, language, purchased programs, login times. Purpose: giving you access to your client portal. Legal basis: contract (Art. 6(1)(b)).
• Payments & invoicing — name, email, billing details, amount, payment status. Card details are entered directly at our payment provider and never reach us. Purpose: processing payments and keeping accounting records. Legal basis: contract and legal obligation (Art. 6(1)(b) and (c)).
• Coaching content — what you share in sessions, notes and exercises. Purpose: delivering the coaching. Legal basis: contract (Art. 6(1)(b)); where this includes health-related information you choose to share, your explicit consent (Art. 9(2)(a)).
• Technical data — IP address, browser, time of access in server logs. Purpose: security and preventing abuse. Legal basis: legitimate interest (Art. 6(1)(f)). Logs are deleted after 30 days.

3. Who receives your data (processors)

We only share data with service providers who need it to deliver our service and who are bound by data processing agreements:

• Hosting of this website and our database — [hosting provider].
• Email delivery — Resend, Inc. (servers in the EU, Ireland).
• Payments — Stripe Payments Europe Ltd. (Ireland); if you choose PayPal: PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg).
• Appointment scheduling — Calendly LLC (USA).
• Video sessions — Zoom Communications, Inc. (USA).
• Email inbox — Google Ireland Ltd. (Gmail), for notifications.

4. Transfers outside the EU

Calendly and Zoom are based in the USA. Transfers are based on the EU–US Data Privacy Framework and/or the EU Standard Contractual Clauses (Art. 45 and 46 GDPR).

5. How long we keep data

• Guide sign-ups: until you withdraw consent or unsubscribe.
• Discovery-call requests without a contract: 12 months.
• Client account and coaching notes: for the duration of the coaching and 3 years afterwards (limitation period), unless you ask us to delete them earlier.
• Invoices and accounting records: 10 years, as required by Czech tax law.

6. Your rights

You have the right to access your data, to correct it, to have it deleted, to restrict processing, to data portability and to object to processing based on legitimate interest. You can withdraw any consent at any time with effect for the future. In your client portal you can download your data and delete your account yourself. You may also lodge a complaint with a supervisory authority — in the Czech Republic the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, www.uoou.gov.cz), or the authority in your own EU country.

7. Cookies

We only use strictly necessary cookies by default. External content such as the booking calendar is loaded only after you allow it. Details are in our Cookie Policy.

8. Security

Our website uses encrypted connections (HTTPS). Access to client data is protected by secure login, and we never sell or rent your personal data.

9. Changes

We may update this policy when our services or the law change. The current version is always available on this page.