Privacy notice

I take your privacy seriously — partly because the law requires it, and partly because people come to me with things they have not told anyone else. This page explains what I collect, why, and what you can do about it. If anything here is unclear, please just ask me.

Who I am

I am Susanna Wolf, and I run The EASe Way. The practice trades as The EAS Way B.V., registered with the Dutch Chamber of Commerce.

The EAS Way B.V. is the data controller for the information described here, which means the company decides what is collected and why. In practice that is me, since I am the only person in it. Your client agreement and intake form name the same company, so the paperwork and this page agree.

• Address: H. Bierlingstraat 5, 1432 PN Aalsmeer, The Netherlands
• Email: susanna.wolf@theeasway.com
• Chamber of Commerce (KvK): 99569868
• VAT number: NL869043766B01

What I collect, and why

If you send an enquiry through my website

I collect your name, email address and the topic you select, plus anything you choose to write in the message box. I use this only to reply to you and to arrange an introductory call. The legal basis is that you have asked me to take steps before we might enter into an agreement.

Please don’t include health details in that form. You don’t need to tell me anything about your health, weight, eating or medical history to book a call — we’ll talk it through when we speak. I’ve deliberately kept the form short for that reason.

If you book an introductory call

I collect your name, email address and the time you choose, together with any note you add. This is used to hold the appointment, send you the video link and remind you beforehand.

If you become a client

Once we work together I will keep notes about our sessions. This will include health information — for example your relationship with food, your weight or energy, your sleep, your mood, and things from your history that come up in an RTT® session.

This is treated as a special category of data under the GDPR and is handled more carefully than anything else I hold. I will ask for your explicit consent before collecting it, and I will explain what I am recording and why. If your work with me includes an RTT® recording, that recording is treated the same way as my session notes.

If you pay me

Payments run through Rabobank SmartPay, which lets you pay the way that suits you — and by PayPal if you prefer. I never see your card details. They go straight to the bank; what reaches me is your name, the amount and confirmation that it was paid.

If you sign up for emails

Only if you tick the box asking for it. I collect your name and email address, on the basis of your consent, and I keep a record of when you gave it. Every email I send has an unsubscribe link, and I act on it immediately.

Asking me a question is not the same as signing up for emails. If you enquire and we don’t end up working together, I will stop contacting you.

When you visit the website

I use privacy-friendly analytics that count visits without cookies and without tracking you across other websites. I cannot identify you from it. Because it sets no cookies and collects no personal data, there is no cookie banner on this site.

Who else sees your information

I use a small number of service providers to run the practice. They only process your information on my instructions, under a written agreement, and they cannot use it for their own purposes.

I have chosen providers inside the European Union wherever I can. I do not sell your information, and I do not share it for advertising.

Information that leaves the European Union

Three of these are American companies: Calendly, which runs the booking calendar, Cloudflare, which serves this website, and Zoom, which we use for sessions. Some of your information can therefore be handled outside the European Union — for Calendly, the name, email address and time you enter when booking; for Cloudflare, your IP address held briefly while a page is served to you; for Zoom, the session itself while it is happening.

Those transfers are covered by the European Commission’s standard contractual clauses, which is the safeguard the GDPR provides for exactly this situation.

If you would rather not use the booking system at all, just email me and we will arrange a time between ourselves. You do not have to use it to work with me.

I may share information without your consent only where I am legally obliged to, or where there is a serious and immediate risk to your safety or someone else’s. If that ever happened I would tell you unless I was prevented from doing so.

How long I keep things

On that first row I want to be straight with you rather than tidy. Dutch healthcare law requires practitioners to keep treatment records for twenty years. Whether it applies to coaching and RTT® work of this kind is a question I am putting to a Dutch adviser, and I would rather tell you that than guess at a shorter number and delete something I was obliged to keep.

So I am working to the twenty-year rule until I know otherwise. Before you share anything with me as a client, I will tell you which rule applies, where your notes are kept and for how long — and I will ask for your explicit consent then, not now.

Your rights

You can ask me to:

• show you what I hold about you
• correct anything that’s wrong
• delete it
• limit what I do with it
• send it to you or someone else in a portable format
• stop processing it, where I’m relying on my own legitimate interests
• withdraw consent you previously gave, at any time

Email me and I’ll respond within one month. There’s no charge.

Two honest caveats. Withdrawing consent doesn’t undo anything done before you withdrew it. And where the law requires me to keep certain records for a set period, I can’t delete those early even if you ask — I’ll tell you plainly if that applies to you.

If you’re unhappy

Please tell me first — most things are a misunderstanding and I’d rather fix it directly. You also have the right to complain to the Dutch data protection authority:

Autoriteit Persoonsgegevens
Postbus 93374, 2509 AJ Den Haag
autoriteitpersoonsgegevens.nl

Where your information is kept

Session notes, documents and recordings are kept in my Microsoft OneDrive. Nobody else has access to it.

Video sessions are recorded to my own computer and then moved into that account. Where I make a short audio recording for you to listen to at home, I record it on my phone and send it to you directly. I keep almost nothing on paper; the few handwritten notes that exist are in my own office, and I am moving those into the same place and destroying the originals.

No system is perfect. If something ever went wrong in a way that put you at risk, I would tell you, and I would report it to the Autoriteit Persoonsgegevens within 72 hours as the law requires.

Automated decisions

I don’t use automated decision-making or profiling. The quiz on my website is a simple guide to which service might suit you — it runs entirely in your own browser, nothing is stored or sent to me, and no decision is made about you.

Changes

If I change this notice I’ll update the date at the top. If the change is significant and I hold your details, I’ll tell you.