Privacy statement

This statement explains which personal data Unlocked Within collects through this website, why we do so and what your rights are. We follow the General Data Protection Regulation (GDPR, in Dutch: AVG) and the Dutch rules that go with it.

Who is responsible

Unlocked Within is responsible for the personal data processed through this website (the controller). For anything about your data, email maryam@unlockedwithin.com.

Practitioner

Maryam Abdi

Email

maryam@unlockedwithin.com

What we collect and why

Booking an appointment

Your name, email address, phone number (if you give it), the session and time you choose, your preferred language, your time zone and anything you write in your message. We use this to plan, confirm and hold your appointment, and to contact you about it.

Legal basis: Taking steps at your request before an agreement, and carrying out that agreement (GDPR art. 6(1)(b)).

Sending a message

Your name, email address, phone number (if you give it), the subject and your message. We use this only to answer you.

Legal basis: Your consent, which you give with the checkbox on the form (GDPR art. 6(1)(a)).

Information about your health

In a message you may share something about your health or wellbeing, such as panic attacks or emotional difficulties. This is special category data. We use it only to answer your request and to prepare your session, and only with your explicit consent. You can withdraw your consent at any time by emailing maryam@unlockedwithin.com; this does not affect what happened before.

Legal basis: Your explicit consent, which you give with the checkbox on the form (GDPR art. 9(2)(a)).

Keeping the website secure

To protect the forms against abuse, we count attempts per visitor using a one-way coded (hashed) version of your IP address, which we delete within an hour. Our hosting provider also keeps standard server logs to keep the website secure and running.

Legal basis: Our legitimate interest in a secure website (GDPR art. 6(1)(f)).

Who we share it with

We never sell your data and do not use it for marketing. We work with these service providers, who process data on our behalf. Where the law requires it, we have a data processing agreement with them.

• Our web hosting provider (Strato AG) stores the website and its database.
• Our email provider (Strato AG) sends and stores the emails about your request and your appointment.
• Vimeo and YouTube: the video on this website only loads when you press play. From that moment the video service receives your IP address and may place its own cookies.

Outside the European Union

Some of these providers may process data outside the European Union, for example in the United States. That only happens under the EU–U.S. Data Privacy Framework or the European Commission’s standard contractual clauses.

How long we keep it

• Messages are deleted automatically 12 months after we receive them.
• Your details on a booking are erased automatically 24 months after the appointment, including from Maryam’s calendar. Only the date, time and type of session remain, without your details.
• Invoices are not made by this website. If you pay for a session, the invoice is kept for 7 years, because Dutch tax law requires it.
• Technical logs of the website are deleted after 6 months.

Cookies

This website only uses functional cookies. They are needed for the website to work, so under the Dutch Telecommunications Act they do not need your consent:

• uw_session: keeps the forms secure and, for Maryam, the admin area signed in. Deleted when you close your browser.
• uw_locale: remembers the language you chose. Kept for one year.

We do not use analytics, tracking or advertising cookies. The video services can place their own cookies, but only after you press play.

Security

The website only works over an encrypted connection (HTTPS). Bookings and messages can only be seen after signing in with a password, and the connection to Google is stored encrypted.

Your rights

You have the right to:

• see the personal data we hold about you (access);
• have incorrect data corrected (rectification);
• have your data deleted (erasure);
• have the use of your data restricted;
• object to the use of your data;
• receive your data in a form you can pass on (data portability);
• withdraw your consent at any time.

Send your request to maryam@unlockedwithin.com. We answer within one month and may first ask you to confirm who you are. We do not make decisions about you by automated means, and we do not create profiles.

Under 16

Are you younger than 16? Then a parent or guardian needs to book or get in touch on your behalf.

Complaints

Not happy with how we handle your data? Please tell us first, so we can put it right. You also have the right to file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.

Changes

We may update this statement when the website or the law changes. The date at the top shows the current version.