Who is responsible for your data
This privacy policy explains how YBS Lifestyle Coaching handles your personal data. The controller (verwerkingsverantwoordelijke) under the General Data Protection Regulation (GDPR/AVG) is:
Arrfa Amsterdam (trading as YBS Lifestyle Coaching)
Emmy Afra Mols, sole trader (eenmanszaak)
Beatrixstraat 5A, 4486 AE Colijnsplaat, the Netherlands
Email: ybs.support@arfaamsterdam.com
KvK (Chamber of Commerce): 99976196 · VAT ID (btw-id): NL005422221B08
Questions about your data? Email ybs.support@arfaamsterdam.com.
What data we collect
- Contact details: name, email address, phone number and, if you contact us there, your Instagram or TikTok username.
- Booking details: the date and time of your consultation and the answers you give when booking through Acuity Scheduling.
- Intake form answers: your goals, routine, training, sleep and lifestyle. This includes health information: hormones and cycle, diet and eating habits, medication and mental health. This is special category data under the GDPR and we only process it with your explicit consent (see below).
- Your program and progress: your personalised program (PDF), check-in forms, call notes and messages during your coaching.
- Payment details: name, amount, date and the account you pay from (PayPal, Tikkie or bank transfer). We never see or store your card details or banking passwords.
- Messages: what you send us by email, WhatsApp, Instagram or TikTok.
- For clients aged 16 or 17: the name and contact details of a parent or guardian, and their permission.
- Website use: anonymous visit statistics, only if you accept analytics (see our cookie policy).
Why we use it and on what legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Booking your free consultation, creating your program, coaching and check-ins | Performing our agreement with you (art. 6(1)(b)) |
| Using your health information to personalise your program | Your explicit consent (art. 9(2)(a)), given with a separate tick box in the intake form. You can withdraw it at any time. |
| Payment requests, invoices and bookkeeping | Performing our agreement (art. 6(1)(b)) and our legal duty to keep financial records (art. 6(1)(c)) |
| Answering questions and messages before you become a client | Our legitimate interest in responding to you (art. 6(1)(f)) |
| Anonymous website statistics | Your consent (art. 6(1)(a)) via the cookie banner |
If you withdraw your consent for health information, we can no longer tailor your program to it. That may mean we cannot continue the coaching. Processing that happened before you withdrew stays lawful.
Minimum age and clients aged 16 or 17
We coach clients from 16 years old. For clients aged 16 or 17, we ask for the consent of both the client and a parent or guardian, and the parent or guardian agrees to the coaching agreement. A parent or guardian can contact us at any time about the data we hold.
Data outside the European Union
Some of these providers are based in, or store data in, countries outside the European Economic Area, such as the United States and Australia. Where that happens, we rely on the safeguards the GDPR requires: an adequacy decision (such as the EU-U.S. Data Privacy Framework, for providers certified under it) or the European Commission’s standard contractual clauses offered by the provider.
How long we keep your data
- Intake answers, health information, your program and check-ins: for the duration of your coaching and up to 2 years after it ends, so you can return without starting over. After that we delete them. You can ask us to delete them sooner.
- Financial records (payment requests, payments, invoices and your accepted offer): 7 years, because Dutch tax law requires us to keep our financial administration for that long.
- Messages and enquiries that did not lead to coaching: up to 6 months.
- Parental permission for clients aged 16 or 17: for as long as we keep the client’s file.
How we protect your data
We use strong passwords and two-step verification on our accounts, keep access to client files to ourselves, avoid sharing health information over channels we don’t need, and delete files we no longer need. If a data breach ever puts your rights at risk, we will report it to the Autoriteit Persoonsgegevens within 72 hours and tell you where the law requires.
Your rights
You have the right to access, correct or delete your data, to restrict or object to its use, to receive it in a portable format, and to withdraw any consent you gave. Email ybs.support@arfaamsterdam.com and we will respond within one month. We may ask you to confirm your identity first. Where the law requires us to keep financial records, we cannot delete those before the 7 years are over.
If you are unhappy with how we handle your data, please tell us. You also have the right to complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, or to the authority in the EU country where you live.
We do not make automated decisions or create profiles about you.
Changes to this policy
We may update this policy when our services or the law change. The date at the top shows the latest version. We will tell current clients about important changes.