On-page notices

Who we are

Cool Steps is the practice of Beata Rybka, who is the data controller responsible for the personal data described in this policy.

Email: contact@coolsteps.ie
Phone: +353 86 225 9428
Address: Apt. 5, Bridge Street, Ballineen, Co. Cork, P47 KD40, Ireland

We have not appointed a Data Protection Officer, as this is not required for a practice of this size. All data protection matters are handled directly at the email address above.

What personal data we collect

From the enquiry form: your first name and surname, email address, phone number, and the content of any message you choose to write.

When you book a session: your first name and surname, email address, phone number, the date and time agreed, the format of the session, the amount paid, and a payment reference. We do not receive or store your card number, expiry date or security code; these go directly to our payment provider.

During and after a session: brief notes, where we make them, recording what was discussed and anything agreed.

Automatically, for security: your IP address and basic technical information about your browser and device, collected by Google reCAPTCHA to prevent automated submissions.

Only with your consent, to measure how the website is used: if you accept analytics cookies in the cookie banner, Google Analytics records which pages are visited and basic information about your browser and device. See the Cookie policy.

We do not use advertising or tracking pixels, and we do not build profiles of visitors.

Please do not send sensitive information through this website

The enquiry form and the checkout are for arranging and paying for a session. They are not secure channels for confidential information.

Please do not describe, in the message field or anywhere on this website:

health information about yourself, your child or anyone else, including diagnoses, treatment or medication
family circumstances, conflicts, court proceedings or care arrangements
any other details you would consider private or sensitive

A short note about what you would like to discuss and when you are available is enough. Everything else is best discussed in the session itself.

If you do send such information despite this notice, we use it only to respond to you, on the basis of your explicit consent given by choosing to send it (Article 9(2)(a) GDPR). We delete it once it is no longer needed and never use it for any other purpose.

Why we process your data, and on what legal basis

Purpose	Legal basis
Replying to your enquiry and arranging a session	Article 6(1)(b) GDPR: steps taken at your request before entering into a contract
Providing the session you have booked	Article 6(1)(b) GDPR: performance of a contract
Contacting you to agree the time and format of your session	Article 6(1)(b) GDPR: performance of a contract
Responding to general questions that do not lead to a booking	Article 6(1)(f) GDPR: our legitimate interest in replying to people who contact us
Processing your payment	Article 6(1)(b) GDPR: performance of a contract
Keeping session notes for continuity between sessions	Article 6(1)(f) GDPR: our legitimate interest in providing a consistent service
Keeping records of income and transactions	Article 6(1)(c) GDPR: legal obligation under Irish tax law
Protecting the website from spam and automated submissions	Article 6(1)(f) GDPR: our legitimate interest in protecting the site
Measuring how the website is used, only if you accept analytics cookies	Article 6(1)(a) GDPR: your consent, which you can withdraw at any time
Handling complaints and defending legal claims	Article 6(1)(f) GDPR: our legitimate interest

Providing your data is voluntary, but without your name, email address and phone number we cannot arrange or provide a session.

How long we keep your data

Data	Retention period
Enquiries that do not lead to a booking	12 months from our last contact with you
Booking and contact details	12 months from the session
Session notes	3 years from the session
Financial and transaction records	6 years, as required by Irish tax law

You can ask us to delete your data sooner at any time by emailing contact@coolsteps.ie. Where we are legally required to keep certain records, we will tell you which ones and why.

Who has access to your data

Your data is accessed by Beata Rybka only. We do not sell your data, share it for marketing purposes, or pass it to anyone else for their own commercial use.

For technical reasons your data passes through the systems of the following service providers, who act as our processors:

Provider	What they do
MyDevil.net (ADMIN.NET.PL S.C., Poland)	Website hosting and delivery of form submissions
Google Ireland Limited	Email service receiving your enquiry
Google Ireland Limited	reCAPTCHA security service
Google Ireland Limited	Google Analytics, measuring how the website is used, only with your consent
Stripe (Stripe Payments Europe, Limited, Ireland)	Processing your payment
WhatsApp Ireland Limited	Hosting online sessions

We may also disclose data to public authorities where we are required to do so by law.

Google reCAPTCHA

Our forms are protected by Google reCAPTCHA, which distinguishes genuine visitors from automated bots. As part of this service, Google collects and analyses information including your IP address, details of your browser and device, and how you interact with the page. This information is sent to Google and may be processed outside the European Economic Area, including in the United States.

See the Google Privacy Policy and Google Terms of Service.

Payment data

Payments are processed by Stripe. Your card details are entered directly into their secure systems. We never see, receive or store them. We receive only confirmation that payment succeeded, together with your name, email address and a transaction reference.

Your payment provider also processes your data as an independent controller for fraud prevention and its own regulatory obligations. See their privacy policy: stripe.com/privacy.

Online sessions

Where a session takes place online, it is held using WhatsApp. That provider processes technical connection data in accordance with its own privacy policy. We do not record sessions, and we ask that you do not record them either.

Transfers outside the European Economic Area

We use services provided by Google, which may involve transferring data to the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, which the European Commission has recognised as providing an adequate level of protection. Standard Contractual Clauses approved by the European Commission also apply.

Stripe may transfer payment data to the United States. Stripe, LLC complies with the EU-U.S. Data Privacy Framework.

WhatsApp transfers data outside the European Economic Area, including to the United States, as part of its global operations, as described in its privacy policy.

Your rights

You have the right to access your data and receive a copy, to rectify data that is inaccurate, to erase your data, to restrict processing, to data portability, to object to processing based on our legitimate interests, and to withdraw consent at any time where processing is based on consent.

To exercise any of these rights, email contact@coolsteps.ie. We will respond without undue delay and within one month. Exercising these rights is free of charge.

Complaints

If you believe we are handling your data unlawfully, you may complain to:

Data Protection Commission
21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland
www.dataprotection.ie

Security

We use measures appropriate to the size of our practice: an encrypted connection to the website (HTTPS), a strong password and two-factor authentication on our email account, access restricted to the controller alone, and routine deletion of data no longer needed. Payments are handled by a PCI-DSS compliant provider.

No method of transmitting information over the internet is completely secure. This is why we ask you not to send sensitive information through this website; see Please do not send sensitive information through this website.

Children

Sessions are arranged and paid for by adults. Where a child takes part in a session, they do so in the presence of a parent or legal guardian. This website is intended for adults, and we do not knowingly collect personal data from anyone under 16.

If, as a parent or guardian, you include information about your child, we process it on the same basis as your own data and only in order to provide the session. Please keep such information to the minimum necessary.

Changes

We may update this policy. The current version is always available at this address, with the date it was last updated shown at the top.

Contact

For any data protection matter: contact@coolsteps.ie

Contact form

Free intro chat