Privacy Policy

Last updated: September 6, 2026

This Privacy Policy explains how The Library Within (hereinafter referred to as “we,” “us,” or “our”) process your personal data and your rights under the GDPR and applicable Dutch law.

1. Who We Are

  • Controller: The Library Within, a private counselling and coaching practice owned by Adina Ciocoiu.
  • Registration: Registered at the Chamber of Commerce (KVK) in the Netherlands under number 91508428 (KOR).
  • Contact: For privacy-related questions, contact us at adina@thelibrarywithin.com 
  • Data Protection Officer (DPO): We have not appointed a Data Protection Officer because we are not legally required to do so; privacy questions can be sent to the contact details above.

2. Types of Data We Collect

Because our services may involve health-related or counselling-related information, we apply additional safeguards to this data. We retain personal data only for as long as necessary for the purposes described in this policy, unless a longer retention period is required by law.

Category Examples Legal Basis (GDPR) Retention Period
Personal Data Name, email, phone, address Contractual necessity, consent Until deletion request or 2 years after last contact
Special Category Data

Special category data, including counselling notes and health information, is processed only where necessary for providing our services and on an applicable GDPR lawful basis, including Article 9(2)(h) or another valid basis under Dutch law where relevant

 Article 9(2)(h) (healthcare) 10 years (Dutch healthcare law)
Payment Data Bank details, invoices Legal obligation (tax compliance) 7 years
Usage Data IP address, browser type Legitimate interest (security) 1 year
Cookies Essential cookies only Legitimate interest (functionality) Session duration

Note: We currently use only essential cookies and no non-essential tracking technologies. If this changes, we will ask for your consent before placing any non-essential cookies.

3. How We Use Your Data

We use your data only for specified, explicit, and legitimate purposes, and we do not process it further in a way that is incompatible with those purposes

  • Providing Counselling Services: To deliver sessions, manage appointments, and maintain records (legal basis: contractual necessity, legal obligation).
  • Communication: To send appointment reminders, updates, or responses to your inquiries (legal basis: contractual necessity, consent).
  • Payment Processing: To handle invoices and payments (legal basis: legal obligation).
  • Security and Improvement: To ensure the security of our systems and improve our services (legal basis: legitimate interest).

4. Confidentiality of Counselling Sessions

  • Counselling sessions and notes are treated as confidential and are handled under our service agreement and applicable professional confidentiality obligations.
  • We will only disclose your information if you have given consent, where disclosure is required by law, where it is necessary to protect vital interests, or where another lawful basis applies.

5. Data Sharing and Third Parties

Where any service provider processes personal data on our behalf, we use a data processing agreement and require appropriate confidentiality and security measures.

Recipient Purpose Data Shared Safeguards
Payment and accounting providers we use to process invoices and payments Process payments Name, email, payment details GDPR-compliant contracts (SCCs)
Email and communication providers we use to send and receive messages securely. Secure communication Name, email Encrypted transmission
Legal Authorities Compliance with law As required by legal request Only when legally obligated

Snelstart 

As a payment and accounting provider we use SnelStart. They handle customer data confidentially and securely in accordance with applicable privacy laws, focusing on transparency. As customer, I remain responsible for the personal data within my own administration, while SnelStart acts as a processor who uses these records solely for the agreed-upon accounting tasks. They cannot use the data from your books to contact clients themselves. Communication data, including emails and chat messages, is also processed to support the service.

Their privacy policy can be found at https://www.snelstart.nl/algemene-voorwaarden [in Dutch]

Embloom 

We use Embloom with encrypted client file management that can only be access by us, with a unique login. We are required by law to retain client data  between 5 and up to 20 years.

Their general privacy policy can be read at https://www.embloom.nl/privacyverklaring/

Jitsi

We use Jisti for online consultations. Their private policy can be read at https://jitsi.org/meet-jit-si-privacy/

A self administrated Google workspace

We use a self administrated, licensed Google workspace for email communication. Google may access and use this data to operate and improve their services. This involves automatically scanning your emails and documents for spam detection, malware protection, and performance optimization. They do not use customer data for advertising, do not sell it to third parties, and do not display ads within Workspace services.

Please reach out to us for a copy of this agreement.

MailPoet newsletter & emails

If you subscribe to our newsletter, create an account, or use our services, we may send you service-related or subscription-related emails. We will only send you emails which you have signed up to receive, or which pertain to the services we provided to you.

To send you emails, we use the name and email address you provide us. Our site also logs the IP address you used when you signed up for the service to prevent abuse of the system.

This website can send emails through the MailPoet Sending Service. This service allows us to track opens and clicks on our emails. We use this information to improve the content of our newsletters.

No identifiable information is otherwise tracked outside this website except for the email address.

Their privacy policy can be found here https://automattic.com/privacy/

Forminator Forms

When you submit a form, we may collect the information you enter, your IP address, and technical metadata for spam prevention, security, and response handling. When visitors or users submit a form we retain the data for 30 days.

Their privacy policy can be found here https://forminator.gg/policies/privacy

ALTCHA

We use ALTCHA for spam protection. ALTCHA is operated entirely on our own servers. No data is transferred to ALTCHA or other third parties for verification purposes. ALTCHA does not use tracking cookies, fingerprinting techniques, or external services. The processing is based on our legitimate interest in securing our website, preventing abuse, and ensuring the availability of our services. 

Their privacy policy can be found here: https://altcha.org/privacy-policy/ 

Note: We use Standard Contractual Clauses (SCCs) for any data transfers outside the EU/EEA.

6. Data Security

  • Encryption: All electronic records are encrypted.
  • Access Control: Only authorized personnel (e.g., your counsellor) can access your data.
  • Data Breaches: In the event of a breach, we will notify you and the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, AP) within 72 hours if the breach poses a risk to your rights.

7. Your GDPR Rights

You have the following rights under GDPR. To exercise them, contact us at adina@thelibrarywithin.com. We will respond within 30 days (extendable to 60 days for complex requests).

 
Right Description
Right to Access Request a copy of the personal data we hold about you.
Right to Rectification Request correction of inaccurate or incomplete data.
Right to Erasure Request deletion of your data, unless we have a legal obligation to retain it.
Right to Restrict Processing Request that we limit how we process your data.
Right to Object Object to processing based on legitimate interests (e.g., direct marketing).
Right to Data Portability Request your data in a structured, machine-readable format (applies to automated data only).
Right to Withdraw Consent Withdraw consent for processing (e.g., newsletters). Note: This does not affect past processing.

Verification: We may ask for a copy of your ID to verify your identity before processing requests.

8. International Data Transfers

  • Your data is primarily processed within the EU/EEA.
  • If we transfer personal data outside the EEA, we rely on an adequate transfer mechanism such as Standard Contractual Clauses and, where relevant, supplementary safeguards

9. Children’s Privacy

Our services are not intended for children, and we do not knowingly collect personal data from minors without appropriate consent where required.

10. Automated Decision-Making

  • We do not use automated decision-making or profiling based on your personal data.

11. Links to Other Websites

  • Our website may contain links to third-party sites. We are not responsible for their privacy practices. We encourage you to review their policies.

12. Changes to This Policy

  • We may update this policy periodically. We will notify you of significant changes via email or a notice on our website.
  • The “Last updated” date at the top will reflect the most recent version.

13. Contact Us

For questions or requests regarding your data or this policy:

14. Supervisory Authority

If a situation has come up and it cannot be solved between ourselves, you  have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).