Privacy Policy

Paulina Toktas | www.paulinatoktascoaching.com Last updated: September 18, 2026

1. Overview

This Privacy Policy explains how I collect, use, store, and protect your personal data when you visit www.paulinatoktascoaching.com (the "Site") or engage with any of my services.

I am Paulina Toktas, a self-employed practitioner based in Malta, trading as Paulina Toktas Coaching. I am the Data Controller of your personal data as defined under the General Data Protection Regulation (GDPR) and applicable Maltese data protection law.

Throughout this policy, "I", "me", and "my" refer to Paulina Toktas. "You" and "your" refer to any visitor to the Site, subscriber, client, or programme participant.

This policy applies to all visitors, subscribers, clients, and participants. Please read it carefully. If you do not agree with how your data is handled, please do not use the Site or engage my services.

Minimum age: My services are for adults only. I do not knowingly collect personal data from anyone under the age of 18. If you believe a minor has provided me with personal data, please contact me and I will delete it.

2. The Data I Collect

2.1 Information you give me directly

Contact details: your name and email address, provided when you subscribe to Morning Pages, complete a contact form, or purchase a service.
Booking details: your name, email, time zone, and scheduling preferences when you book a session.
Communication: any information you share with me by email, contact form, social media message, or within the Telegram group.

2.2 Session information and sensitive personal data

This is the most important section of this policy, so I want to be completely clear about it.

During coaching, hypnosis, Reiki, or intuitive sessions, you may share information about your physical health, mental and emotional wellbeing, medical history, medication, relationships, family history, spiritual or religious beliefs, or other deeply personal matters.

Under GDPR, some of this constitutes special category data, which carries a higher standard of protection. Specifically, this includes data concerning your health, and data revealing your religious or philosophical beliefs.

How I handle it:

Legal basis: I process special category data on the basis of your explicit consent, given when you book a session or enrol in a programme and confirm your agreement to this policy and my Terms and Conditions.
Purpose: solely to deliver the service you have engaged me for, to prepare for and follow up on sessions, and to maintain continuity in our work together.
I do not use any information shared in session for marketing, advertising, audience targeting, testimonials, case studies, content creation, or any purpose other than serving you directly.
I do not share it with any third party, except where legally required or where there is a genuine and serious risk of harm to you or another person, as set out in my Terms and Conditions.
Storage: any notes I keep are stored securely and access-restricted. They are kept to the minimum necessary.
Withdrawal: you may withdraw your consent, and request deletion of your session notes and recordings, at any time by contacting me. Withdrawal does not affect processing carried out before your request.

2.3 Session recordings

Certain services include a recording that is provided to you afterwards, for example the Mirror Reading.

Where a session is recorded, it is recorded for your benefit and shared with you following the session. By booking a service that includes a recording, you consent to the session being recorded. Recordings are stored securely and retained only as long as necessary to deliver the service and allow you reasonable access.

You may request deletion of your recording at any time. If you do not wish to be recorded, please let me know before the session begins.

2.4 Purchase and payment data

When you buy a service, I receive your name, email address, billing information, and a record of your transaction.

I do not collect, process, or store your payment card details. Payments are handled directly by Kajabi Payments, who process card data as an independent processor under their own security standards and privacy policy. I never see or hold your full card number.

Legal basis: performance of a contract, and compliance with legal obligations relating to tax and accounting.

2.5 Usage data

When you visit the Site, certain technical information may be collected automatically, including your IP address, browser type, device and operating system, approximate geographic location, pages viewed, navigation paths, and how long you spend on the Site.

This is collected through analytics and tracking tools, including Google Analytics and the Meta (Facebook) Pixel. These tools require your consent before loading, which you provide or decline through the cookie banner on the Site.

Legal basis: your consent for non-essential cookies and tracking, and my legitimate interest in understanding and improving the Site.

2.6 Marketing data

If you subscribe to Morning Pages or opt in to receive emails from me, I process your name, email address, and engagement information such as whether an email was opened or a link clicked.

Legal basis: your consent, or my legitimate interest in communicating with existing clients about services related to those they have already purchased.

You can unsubscribe at any time using the link in any email, or by emailing me directly. Unsubscribing from marketing does not affect emails necessary to deliver a service you have purchased.

3. How I Use Your Data

I use your personal data to:

Deliver the services, sessions, and programmes you have purchased
Communicate with you about your booking, session, or programme
Send Morning Pages and other marketing communications where you have consented
Process payments and maintain financial records as legally required
Understand and improve how the Site performs
Deliver and measure advertising, where you have consented to tracking
Meet my legal, tax, and regulatory obligations

I do not sell, rent, or trade your personal data. Ever.

4. Marketing and Advertising

Where you have consented, I may send you emails about my services, offers, and content.

Legal basis: your consent, or my legitimate interest in contacting existing clients about services similar to those they have already received.

You may opt out at any time through the unsubscribe link in any email, or by emailing paulina.toktas@gmail.com.

I may also run advertising through platforms including Meta (Facebook and Instagram). Where you have accepted tracking cookies, data about your interaction with the Site may be used to show you relevant advertising and to measure how that advertising performs. You can withdraw consent at any time by adjusting your cookie preferences on the Site.

Nothing shared with me in a session is ever used for advertising, targeting, or marketing purposes.

5. Who I Share Your Data With

I share your data only with service providers who help me run my business. Each one is required to handle your data securely and in line with applicable data protection law.

Provider	Purpose
Kajabi	Website hosting, course delivery, email marketing, payment processing
Telegram	Group community support for Roots of Remembering
Google Analytics	Website usage analytics
Meta (Facebook / Instagram)	Advertising and advertising measurement
Scheduling platform	Session booking and calendar management
Accountant / bookkeeper	Financial records and tax compliance

I may also disclose your data where I am legally required to do so, where necessary to establish or defend a legal claim, or where there is a genuine and serious risk of harm to you or another person.

If my business is ever sold or transferred, client data may form part of that transfer. If this results in a material change to how your data is handled, I will notify you and, where required, seek your consent.

5.1 Telegram, please read this before joining

The Roots of Remembering group community is hosted on Telegram, a third-party messaging platform.

Please be aware:

Telegram operates under its own privacy policy and terms, which are outside my control.
Other participants may be able to see your Telegram username and display name.
Depending on your own Telegram privacy settings, other participants may be able to see your phone number. I strongly recommend reviewing your Telegram privacy settings before joining the group.
Messages you post in the group are visible to all participants and remain in the group history.
While all participants agree to maintain confidentiality, I cannot technically guarantee or control the behaviour of other members.

Participation in the Telegram group is voluntary. If you would prefer not to use Telegram, please contact me and we will find an alternative way for you to receive support during the programme.

6. Data Security

I take the security of your data seriously, particularly given the sensitive nature of what clients share with me.

Measures in place include:

Secure, password-protected storage with strong, unique credentials managed through password management software
Access restricted strictly to what is necessary, with no employees or contractors given access to session notes or recordings unless genuinely required to deliver a service
Use of established service providers who maintain their own security standards and data protection commitments
Session notes and recordings stored separately from marketing and general contact data

No method of transmitting or storing data over the internet is completely secure. While I take reasonable steps to protect your information, I cannot guarantee absolute security of data transmitted to or from the Site. Any transmission is at your own risk.

If you become aware of any security concern or unauthorised use of your information, please contact me immediately at paulina.toktas@gmail.com.

7. Data Breaches

I have procedures in place to identify, assess, and respond to any personal data breach.

In the event of a breach, I will:

Identify and contain the breach, and assess its scope and severity
Notify the Information and Data Protection Commissioner (IDPC) in Malta within 72 hours of becoming aware of the breach, where the breach is likely to result in a risk to your rights and freedoms
Notify you directly and without undue delay where the breach is likely to result in a high risk to your rights and freedoms
Keep a record of the breach, its effects, and the action taken

Given the sensitivity of session data, any breach involving client session notes or recordings will be treated as high risk by default.

8. How Long I Keep Your Data

I keep your data only for as long as necessary for the purpose it was collected, or to meet a legal obligation.

Type of data	Retention period
Session notes and session recordings	Kept for the duration of our working relationship and for a reasonable period afterwards to allow for continuity should you return. Deleted on request at any time.
Client contact and booking records	Retained while you are an active client and for a reasonable period afterwards
Financial and transaction records	Retained for the period required under Maltese tax and accounting law
Marketing and subscriber data	Retained while you remain subscribed, and deleted within a reasonable period after you unsubscribe
Website analytics data	Retained according to the settings of the analytics provider
General correspondence	Retained only as long as needed to resolve the matter, unless required for a legal purpose

Once data is no longer needed, it is securely deleted or destroyed.

Please note: financial records must be retained for a legally mandated period, so if you request deletion of your data, I may be required to keep transaction records even after deleting everything else. I will always tell you if this applies.

9. International Transfers

Some of my service providers are based outside the European Economic Area (EEA), including in the United States.

Where your personal data is transferred outside the EEA, I take steps to ensure it remains protected to the standard required by GDPR. Transfers are made on the basis of appropriate safeguards, which may include:

A European Commission adequacy decision covering the receiving country or framework
Standard Contractual Clauses approved by the European Commission
Other lawful transfer mechanisms permitted under Chapter V of the GDPR

You may request further information about how and where your data is processed, and the safeguards applied to any transfer, by contacting me.

10. Cookies and Tracking

The Site uses cookies and similar tracking technologies. Cookies are small files placed on your device when you visit a website.

Types used:

Essential cookies, necessary for the Site to function, including security and basic navigation. These do not require consent.
Analytics cookies, used to understand how visitors use the Site, including Google Analytics.
Advertising and tracking cookies, including the Meta Pixel, used to deliver relevant advertising and measure its effectiveness.

Both session cookies (which expire when you close your browser) and persistent cookies (which remain until deleted or expired) may be used.

Your consent: non-essential cookies, including all analytics and advertising cookies, are only placed on your device after you have given consent through the cookie banner on the Site. You may withdraw or change your preferences at any time through the cookie settings on the Site, or by clearing cookies in your browser.

Disabling cookies may affect how parts of the Site function. The Site does not currently respond to browser Do Not Track signals.

11. Third-Party Links

The Site may contain links to third-party websites, platforms, or resources. This Privacy Policy applies only to data collected through my Site and services.

Once you follow a link to an external site, that site's own privacy policy governs how your data is handled. I am not responsible for the privacy practices or content of third-party sites, and I encourage you to review their policies before sharing any personal data.

12. Your Rights

Under GDPR you have the following rights regarding your personal data:

Access, to request a copy of the personal data I hold about you
Rectification, to have inaccurate or incomplete data corrected
Erasure, to request deletion of your data, subject to any legal obligation requiring me to retain it
Restriction, to request that I limit how your data is processed
Objection, to object to processing based on legitimate interests, and to object to direct marketing at any time
Portability, to receive your data in a structured, commonly used, machine-readable format, or have it transferred to another controller
Withdraw consent, where processing is based on consent, including for session notes, recordings, and marketing. Withdrawal does not affect processing carried out before your request.
Information, to be told how and where your data is processed

To exercise any of these rights, email paulina.toktas@gmail.com. I will respond within one month, as required by GDPR. There is no charge for exercising your rights.

Right to complain: if you believe your data has been handled unlawfully, you have the right to lodge a complaint with Malta's supervisory authority:

Information and Data Protection Commissioner (IDPC) Floor 2, Airways House, High Street, Sliema SLM 1549, Malta idpc.info@idpc.org.mt www.idpc.org.mt

You may also lodge a complaint with the supervisory authority in your own country of residence if you are located elsewhere in the EU.

13. Changes to This Policy

I may update this Privacy Policy from time to time to reflect changes in my services, technology, or legal requirements. The revised version will be posted on this page with an updated date at the top.

If I make a material change to how your personal data is handled, I will notify you by email or through a prominent notice on the Site. Please review this page periodically.

14. Contact

For any questions, concerns, or requests relating to this Privacy Policy or your personal data:

Paulina Toktas paulina.toktas@gmail.com www.paulinatoktascoaching.com Contact form available on the Site