PRIVACY POLICY
Version 1.0 — last updated 08.09.2026.
1. WHO IS RESPONSIBLE FOR YOUR DATA
Anette Simonsen is the data controller for the personal data described in this policy.
Business name: Anette Simonsen
Organisation number: [ORG.NR] (registered sole proprietorship / enkeltpersonforetak, Norway)
Registered address: [ADDRESS]
Email: anette_s@hotmail.no
Website: [DOMAIN]
If you have any questions about how your data is handled, email me at anette_s@hotmail.no. I answer these personally.
2. WHAT THIS POLICY COVERS
This policy explains what personal data I collect when you visit www-anettesimonsen.no, contact me about the mentorship, book a connection call, sign up for emails, or work with me as a client — and what I do with it.
I am a one-person business. Nobody else reads your notes or listens to your voice messages.
3. WHAT PERSONAL DATA I COLLECT
When you visit the website
Technical data such as IP address, browser type, device type, pages visited and time spent. Only collected if you consent to analytics cookies. See the Cookie Policy.
When you contact me or book a connection call
Name, email address, time zone, and anything you choose to write in your message.
When you sign up for emails
Name and email address, plus whether you open emails and click links.
When you become a client
Contact details (name, email, phone, country)
Billing information (name, address and country — payment card details go directly to my payment provider and I never see or store them)
Intake form responses
Notes I take during and after our sessions
Voice messages and written messages you send me between sessions
Any information you choose to share with me during our work together
Special categories of data
Our work will likely touch on your wellbeing, stress, energy, emotions and how you feel in your body. Under GDPR Article 9 this counts as health data and receives extra protection. I only process it on the basis of your explicit consent, which I ask for separately during onboarding. You can withdraw that consent at any time.
Please do not send me medical records, diagnoses, medication details or clinical documentation. This is not a health service and I have no need for that information.
4. WHY I PROCESS YOUR DATA, AND ON WHAT LEGAL BASIS
Responding to enquiries and holding connection calls
Data: contact details, your message
Legal basis: GDPR Article 6(1)(b), steps taken prior to entering a contract
Delivering the mentorship
Data: contact details, intake responses, session notes, messages
Legal basis: GDPR Article 6(1)(b), performance of a contract
Processing information about your health and wellbeing
Data: whatever you share about how you feel physically and emotionally
Legal basis: GDPR Article 6(1)(a) and Article 9(2)(a), explicit consent
Taking payment and issuing invoices
Data: billing information, transaction records
Legal basis: GDPR Article 6(1)(b) and Article 6(1)(c), legal obligation
Bookkeeping and tax
Data: invoices and transaction records
Legal basis: GDPR Article 6(1)(c), Norwegian Bookkeeping Act
Sending newsletters and offers
Data: name, email, engagement data
Legal basis: GDPR Article 6(1)(a), consent
Website analytics
Data: technical and usage data
Legal basis: GDPR Article 6(1)(a), consent
Establishing or defending legal claims
Data: relevant records
Legal basis: GDPR Article 6(1)(f), legitimate interests
Where consent is the basis, you can withdraw it at any time. Withdrawing consent does not affect processing that already took place.
5. WHO I SHARE YOUR DATA WITH
I do not sell your data and I do not share it for anyone else's marketing.
I use the following service providers, who process data on my instructions:
Squarespace — website hosting and forms — [COUNTRY]
Zoom — video sessions — USA
Hotmail.com — newsletters and client emails — [COUNTRY]
Whatsapp — voice message support — [COUNTRY]
Fiken — invoicing and bookkeeping — Norway
[ANALYTICS TOOL, if you use one] — website statistics — [COUNTRY]
The following handle your payment as independent controllers, meaning they decide themselves how they use payment data under financial regulation:
Stripe / Vipps
I may also disclose data where I am legally required to do so.
6. TRANSFERS OUTSIDE THE EEA
Some of my providers are based in the United States. Where that is the case, transfers are made under the EU-US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
I live and work in Costa Rica. This means your data is accessed by me from outside the EEA. Costa Rica has not been declared an adequate country by the European Commission. I protect your data through the security measures described in section 8, and by keeping the amount of data I hold to a minimum.
You can request a copy of the safeguards in place by emailing me.
7. HOW LONG I KEEP YOUR DATA
Enquiries that do not lead to a booking: 6 months
Session notes and client records: 2 years after the mentorship ends, then deleted
Voice and written messages: deleted within 6 months of the mentorship ending
Invoices and accounting records: 5 years after the end of the financial year, as required by the Norwegian Bookkeeping Act
Consent records: for as long as the related data is held, plus 3 years
Newsletter data: until you unsubscribe
8. HOW I PROTECT YOUR DATA
Full-disk encryption on all devices
Two-factor authentication on every account that holds client data
A password manager, with no shared or reused passwords
Session notes stored in [NAMED TOOL], not in email or loose on my desktop
Zoom AI features, transcription and cloud recording switched off by default
No client data on public or shared computers, and a VPN on public networks
Sessions are not recorded unless you ask for it and give separate written consent.
9. YOUR RIGHTS
You have the right to:
Access — get a copy of the data I hold about you
Rectification — have inaccurate data corrected
Erasure — have your data deleted, subject to my legal retention obligations
Restriction — ask me to pause processing while a dispute is resolved
Portability — receive your data in a machine-readable format
Object — object to processing based on legitimate interests
Withdraw consent — at any time, without giving a reason
To exercise any of these, email [EMAIL]. I will respond within one month. There is no charge.
10. COMPLAINTS
If you think I have handled your data incorrectly, please tell me first. I would rather fix it directly.
You also have the right to complain to the Norwegian Data Protection Authority:
Datatilsynet
Postboks 458 Sentrum, 0105 Oslo, Norway
If you live elsewhere in the EEA, you may complain to the supervisory authority in your own country.
11. CHILDREN
This service is for adults. I do not knowingly collect data from anyone under 18.
12. CHANGES TO THIS POLICY
If I change this policy I will update the version number and date at the top. If the change is significant and you are an active client, I will tell you by email.
Questions? anette_s@hotmail.no