Privacy Policy

 1. Introduction and Scope

This Privacy Policy explains the nature, scope and purposes of the collection and use of personal data by Ezgi Karaboya Coaching.

This Privacy Policy applies to the website ezgikaraboya.com and the online services and communication channels associated with it.

The protection of your personal data is taken very seriously. Personal data are processed confidentially and in accordance with Swiss data protection law (FADP) and the European Union's General Data Protection Regulation (GDPR), where applicable.

The website can generally be used without providing personal data. Where personal data are collected through the website, this is done on a voluntary basis. Such data are not sold and are only shared with service providers where this is necessary for the stated purposes or where there is a legal obligation to do so.

Separate, supplementary or additional privacy policies, as well as other legal documents such as terms and conditions, may apply to individual or additional services.

2. Data Controller

The data controller responsible for the processing of personal data on this website is:

Ezgi Karaboya Coaching
Sole proprietorship
Owner: Ezgi Karaboya
Bern, Switzerland


Email: ezgi@ezgikaraboya.com
Website: ezgikaraboya.com

If you have any questions about data protection or wish to exercise your rights, you can contact the above email address.

 

3. Legal Basis for Processing

Personal data are processed in accordance with Swiss data protection law, in particular the revised Federal Act on Data Protection (FADP) of 25 September 2020 and the Data Protection Ordinance (DPO).

Where the European Union's General Data Protection Regulation (GDPR) applies, the processing of personal data is based on consent (Art. 6(1)(a) GDPR), for example in relation to the newsletter and non-essential cookies; the initiation or performance of a contract (Art. 6(1)(b) GDPR), for example in relation to contact enquiries, appointment bookings and coaching; legal obligations (Art. 6(1)(c) GDPR), for example statutory retention requirements; and legitimate interests (Art. 6(1)(f) GDPR), for example the secure operation of the website and the prevention of misuse.

 

4. Website Operation and Hosting

The website is created and hosted using Squarespace. When visiting the website, technical information may be collected in server log files, including the IP address, date and time of access, pages visited, browser type, operating system, device information, referring URL, as well as information used for error diagnosis and system security. This information is processed primarily to provide, maintain the stability and ensure the security of the website, and to identify and resolve technical issues.

Squarespace also provides integrated website analytics. These may collect information about website traffic, visitor interactions, traffic sources and usage patterns. The information collected depends on the website configuration and cookie settings.

(Squarespace Ireland Limited (Ireland), Squarespace Privacy Policy)

 

5. Cookies and Consent Management

The website uses cookies and similar technologies to ensure functionality and provide an optimal user experience. Some of these are technically necessary cookies and are essential for the operation of the website. Other cookies enable enhanced functionality and personalisation or are used to analyse and measure website usage.

The Squarespace Cookie Banner is used as the consent management platform for managing cookie consent.

The cookie banner allows you to set your preferences for cookies and similar technologies. Before explicit consent is given, only technically necessary cookies are loaded, to the extent possible given the technical capabilities and limitations of Squarespace and any third-party services.

Cookie settings can be changed using the available cookie settings. Cookies can also be managed through your browser settings. Disabling cookies may affect the functionality of the website.

Further information about the cookies used by Squarespace can be found in Squarespace's Cookie Policy.

6. Contact Forms

When you use a contact form on the website, the information you provide (name, email address, organisation, where applicable, and message) is processed and stored in order to respond to your enquiry. The contact forms are provided through Squarespace.

(Squarespace Ireland Limited (Ireland), Squarespace Privacy Policy)

 

Google reCAPTCHA v3 is used to protect against spam and automated misuse. In this context, Google may process technical information such as your IP address, browser information, usage behaviour and cookies.

(Google LLC (USA), Google Privacy Policy)

 

7. Newsletter

When you subscribe to the newsletter, your email address, name and any additional information requested in the subscription form are processed in order to send news, updates and relevant content.

The newsletter subscription is managed through Squarespace.

You can unsubscribe at any time using the unsubscribe link included in each newsletter or by emailing ezgi@ezgikaraboya.com.

(Squarespace Ireland Limited (Ireland), Squarespace Privacy Policy)

 

8. Online Appointment Booking

Calendly is used as an external appointment booking service. When booking an appointment through Calendly, information such as your name, email address, selected appointment time and any comments or other information you provide, as well as technical information relating to the use of the service, may be processed.

This information is used to arrange and organise appointments. As Calendly is connected to Zoom, the data required to create the meeting invitation are automatically transferred to Zoom so that a Zoom meeting link can be generated.

Calendly's own Privacy Notice applies to the processing of data by Calendly.

(Calendly, LLC (USA), Calendly Privacy Notice)

 

9. Video Conferencing and Office Software

Zoom is used for video conferencing. Depending on how you participate in a session, Zoom may process account and contact information, session details, technical information and other data required to provide the service.

(Zoom Communications, Inc. (USA), Zoom Privacy Statement)

 

Microsoft 365, in particular Outlook and OneDrive, is used for business emails and for storing and managing business records and personal data.

(Microsoft Ireland Operations Limited (Ireland); Swiss representative: Microsoft (Schweiz) GmbH, Microsoft Privacy Statement)

 

10. External Links

The website also contains links to external services and profiles, including LinkedIn, Instagram and pages providing information about qualifications and certifications, such as Credly.

When you follow an external link, a connection to the respective provider is established. The provider may then process technical and other personal data in accordance with its own Privacy Policy.

 

11. International Data Transfers

In the course of processing personal data, data may also be transferred to recipients outside Switzerland and the European Economic Area (EEA). This applies in particular to services whose providers or sub-processors are based in other countries, including the USA.

The USA is not generally considered a country with an adequate level of data protection. However, adequacy decisions have been adopted by Switzerland and the European Commission for providers certified under the Swiss-U.S. and EU-U.S. Data Privacy Frameworks, respectively.

Where a provider is not certified, or where additional safeguards are required, the transfer is based on appropriate safeguards, in particular Standard Contractual Clauses (SCCs) provided by the respective provider in its contractual terms.

In the case of data transfers to the USA, it cannot be ruled out that US authorities may gain access to transferred data under certain legal conditions.

 

12. Data Retention Periods

Personal data are retained for as long as necessary for the purposes for which they were collected, unless a longer retention period is required or permitted by law.

CONTACT ENQUIRIES AND NEWSLETTER DATA

Contact details and correspondence are retained for as long as necessary for the purposes for which they were collected. This also includes maintaining relevant professional contacts, following up on enquiries and informing contacts about relevant news and updates, where permitted. The data are deleted as soon as they are no longer required, unless there is a legal obligation to retain them.

SERVER LOG FILES

Technical server logs are retained by the hosting provider for as long as necessary to ensure the security, stability and proper functioning of the website, in accordance with the provider's retention practices.

ACCOUNTING RECORDS, INVOICES, CONTRACTS AND BUSINESS CORRESPONDENCE

These documents are retained in accordance with the applicable statutory retention requirements for as long as required by law or necessary for the relevant business purpose. Under Swiss law, certain accounting records and supporting documents are generally subject to a retention period of ten years.

13. Data Security

Appropriate technical and organisational security measures (TOMs) are taken to protect personal data against unauthorised access, loss, misuse or destruction. The specific measures implemented are based on the current state of technology and are regularly reviewed and updated. These include the use of security features provided by the service providers used and appropriate access restrictions for business information.

Despite all precautions, the complete security of data transmitted over the internet cannot be guaranteed.

 

14. Rights of Data Subjects

Under the applicable data protection laws, you have, in particular, the following rights:

  • The right to access your personal data

  • The right to have inaccurate personal data rectified

  • The right to have your personal data erased or the processing of your personal data restricted, where the statutory requirements are met

  • The right to receive or transfer your personal data, where the statutory requirements are met

  • The right to object to the processing of your personal data, where the statutory requirements are met

  • The right to withdraw consent with effect for the future. The lawfulness of processing carried out before the withdrawal remains unaffected.

Requests to exercise these rights can be sent to ezgi@ezgikaraboya.com. Proof of identity may be requested in order to ensure that the request is made by the person entitled to exercise the relevant rights.

You also have the right to lodge a complaint with the data protection supervisory authority in Switzerland or, where applicable, with the competent data protection supervisory authority in your country.

COMPETENT SUPERVISORY AUTHORITY IN SWITZERLAND

Federal Data Protection and Information Commissioner (FDPIC)
www.edoeb.admin.ch

COMPETENT SUPERVISORY AUTHORITY IN THE UNITED KINGDOM

Information Commissioner's Office (ICO)
www.ico.org.uk

COMPETENT SUPERVISORY AUTHORITY IN THE EUROPEAN ECONOMIC AREA (EEA)

The data protection supervisory authority of the respective country of residence or the European Data Protection Board (EDPB).

 

15. Changes to this Privacy Policy

This Privacy Policy may be amended and updated from time to time to reflect changes in data processing practices, new legal requirements or other developments. The version published on this website at any given time shall apply.

If you have any questions about this Privacy Policy, you can contact ezgi@ezgikaraboya.com.

 

Last updated: October 2026