Who I am and what this covers
This website, zoegreenhalf.com, is run by me, Zoe Greenhalf. I'm a coach based in Rovereto (TN), Italy. This policy explains, in plain English, what personal data this site and my services use, why, and what you can do about it.
Under the EU General Data Protection Regulation (GDPR), I'm the "data controller" for this site. That means I'm the person responsible for your data here.
- Name: Zoe Greenhalf
- Location: Rovereto (TN), Italy
- Email: [email protected]
For any question about your data, or to use any of your rights below, email me and I'll reply within 30 days, usually much sooner.
The short version: this site collects very little. It has no contact forms, no sign-up boxes and no shop. The video and podcast players only load once you've agreed to them in the cookie banner.
When you visit the site
Just browsing involves a small amount of technical data, mostly so the site works and stays secure. Anything optional waits for your say-so in the cookie banner.
| What | Who provides it | What data | Why, and the legal basis |
|---|---|---|---|
| Hosting the site | My web hosting provider | IP address, browser type, pages visited and time of visit, in server logs | To run the site and keep it secure. Legitimate interest (GDPR Art. 6(1)(f)) |
| Your cookie choices | Complianz, a WordPress plugin running on this site | One small cookie remembering what you accepted or declined | To respect your choice. Legal obligation (Art. 6(1)(c)) |
| Fonts | Bunny Fonts (BunnyWay d.o.o., Slovenia, EU) | Your IP address, only to deliver the font files. No cookies, no tracking | So the site looks as designed. Legitimate interest (Art. 6(1)(f)) |
| YouTube video players | Google Ireland Ltd | Cookies and device data, set by YouTube when you play a video | Only loaded after you accept them in the cookie banner. Consent (Art. 6(1)(a)) |
| Spotify podcast player | Spotify AB, Sweden | Cookies and device data, set by Spotify when the player loads | Only loaded after you accept them in the cookie banner. Consent (Art. 6(1)(a)) |
| Visitor statistics | Google Analytics (Google Ireland Ltd) | Pseudonymised data about visits and which pages are read | Only runs if you accept statistics cookies. Consent (Art. 6(1)(a)) |
You can change your cookie choices at any time from the cookie banner's settings, or see the full list of cookies on the Cookie Policy page.
When you get in touch, sign up, book or take the quiz
The buttons on this site take you to other services, and you share your details there, not on this site. I then receive what you share and use it only for the reason you gave it to me.
| What you do | Where it happens | What I receive | Why, and the legal basis |
|---|---|---|---|
| Email me | Gmail (Google) | Your name, email address and whatever you write | To reply to you. Legitimate interest, or steps before a contract if you're asking about coaching (Art. 6(1)(b) and (f)) |
| Sign up to my newsletter | Substack | Your email address and, if you give it, your name | To send you my newsletter. Consent (Art. 6(1)(a)). Every email has an unsubscribe link |
| Book a call or session | BookMe (bookme.name) | Your name, email, chosen time and anything you add to the booking | To arrange and run the session. Contract (Art. 6(1)(b)) |
| Take the Rebel Archetype Quiz | Tally | Your answers and, if you give it, your email address | To send your result and, if you agree, follow-up emails. Consent (Art. 6(1)(a)) |
| Work with me as a coaching client | Email and my booking tools | Contact details, session notes and anything you choose to share | To deliver your coaching. Contract (Art. 6(1)(b)). Kept confidential |
Each of these services also has its own privacy policy, which explains what they do with your data on their side.
Who else handles your data
I never sell your data or share it for advertising. The only other companies involved are the ones named above, which help me run the site and my services: my web hosting provider, Google (Gmail and, with your consent, YouTube and Analytics), Substack, BookMe, Tally and Spotify.
Some of them, such as Substack and Google, are based in the United States, or may store data there. When data leaves the EU, those companies rely on the safeguards GDPR requires, such as the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
I don't use your data for any automated decision-making or profiling.
How long I keep it
| Data | Kept for |
|---|---|
| Server logs | As set by my web hosting provider, usually a few weeks |
| Emails with me | As long as our conversation needs, then deleted within 2 years |
| Newsletter sign-up | Until you unsubscribe |
| Quiz answers | Until you ask me to delete them, or 2 years, whichever comes first |
| Booking and client records | Invoices and accounting records for 10 years, as Italian law requires. Session notes for 2 years after our work together ends |
Your rights
Under GDPR you can ask me to:
- show you what data I hold about you, and give you a copy
- correct anything that's wrong
- delete your data, unless the law requires me to keep it
- limit how I use it, or stop using it altogether
- send your data to you or someone else in a usable format
Where you gave consent (for example to the newsletter or cookies), you can withdraw it at any time. That doesn't affect anything done before you withdrew.
To use any of these rights, email [email protected].
If you're unhappy with how I've handled your data, you can complain to the Italian data protection authority, the Garante per la protezione dei dati personali, or to the authority in the EU country where you live.
Changes to this policy
If anything changes, I'll update this page and the date below.
Last updated: October 2026