Marzena Szybiak Coaching & Development
Last updated: 30 October 2026
1. Introduction
At Marzena Szybiak Coaching & Development, your privacy, trust and confidentiality matter.
This Privacy Policy explains how I collect, use, store and protect personal information when you visit my website, contact me, book a consultation, purchase coaching services or participate in a coaching programme.
It applies to visitors to www.marzenaszybiak.com, individuals making enquiries or booking consultations, clients purchasing coaching services online, individual coaching clients, participants in the W.W.W. (Who–Why–Where) Programme, international students receiving coaching, employers and professional contacts, and employees participating in employer-funded coaching.
This policy also explains how I handle written coaching notes, AI-assisted note-taking and online payments through Stripe.
Personal information is processed in accordance with the EU General Data Protection Regulation (GDPR), Malta’s Data Protection Act (Chapter 586) and other applicable data protection and electronic communications legislation.
2. Who Is Responsible for Your Information?
The data controller is:
Marzena Szybiak
Marzena Szybiak Coaching & Development
Dun Manwel Grima
Manikata MLH 5013
Malta
Email: info@marzenaszybiak.com
Website: https://marzenaszybiak.com
I determine the purposes and means of processing personal information in connection with my independent coaching services, except where another organisation independently determines the purposes and means of particular processing activities. For questions about your personal information or to exercise your rights, please contact me using the email address above.
3. What Personal Information Do I Collect?
The personal information collected depends on how you interact with my website and coaching services.
3.1 Website Visitors
When you visit the website, technical systems may process IP address and connection information, browser and device information, pages requested and access times, technical errors and security events, and necessary cookie and session information. Hosting systems may retain technical information to operate and protect the website. Website contact form submission records do not retain your IP address or browser identifier. This does not exclude separate processing of such information by hosting or security systems.
3.2 Contact Forms and Enquiries
When you contact me through the website, email or another communication channel, I may collect your name and surname, email address, telephone number, your message and information voluntarily provided, privacy acknowledgement and relevant correspondence. For employer enquiries, I may also collect your company name, professional contact details, job title, area of interest and approximate number of employees requiring support.
3.3 Consultation and Appointment Bookings
When you book a consultation or coaching session, I may process your name and contact details, selected consultation or service, appointment date and time, time zone, booking notes voluntarily provided, appointment confirmations and related correspondence, and privacy acknowledgement. Introductory consultations described as complimentary on this website are offered without a consultation fee.
3.4 Individual Coaching and W.W.W. Programme
During individual coaching, including the W.W.W. (Who–Why–Where) Programme, I may process information relating to personal and professional goals, career development and transitions, experiences of living or working abroad, confidence, motivation and decision-making, values, priorities and personal development, challenges discussed during coaching sessions, coaching exercises, reflections and questionnaires, agreed actions and progress, written session notes, and AI-generated transcripts or summaries where applicable.
I aim to collect only information that is relevant and necessary for the agreed coaching purposes. Clients are encouraged not to share information unrelated to their coaching objectives.
3.5 Corporate and Employer-Funded Coaching
Where coaching is arranged or funded by an employer, I may process participant name and professional contact details, employer or organisation name, coaching programme arrangements, appointment and scheduling information, agreed professional development objectives, and information needed to administer the programme. Confidential information shared during individual coaching sessions is handled separately from routine employer administration.
3.6 Payments and Financial Information
Where coaching services are purchased, I may process name and contact information, billing details where required, coaching service purchased, price, currency and applicable tax information, transaction reference and payment status, payment date, invoice details, and refund and payment dispute information. Payment information may also be processed by Stripe, as explained in Section 8.
4. Why Do I Process Personal Information?
Personal information is processed for the following purposes, using the applicable legal bases under Article 6 GDPR.
Responding to enquiries and arranging consultations: To respond to your requests, provide information about services and arrange appointments. Legal basis: Article 6(1)(b), where necessary to take steps requested before entering into a contract, or Article 6(1)(f), where legitimate interests appropriately apply to business communications.
Providing coaching services: To arrange sessions, deliver agreed coaching services and manage the coaching relationship. Legal basis: Article 6(1)(b), where processing is necessary for performance of the coaching contract.
Maintaining coaching notes: To document relevant objectives, agreed actions and information necessary to support coaching. Legal basis: Article 6(1)(b), where objectively necessary for delivering the agreed service, or another appropriate Article 6 basis for specific recordkeeping activities.
Optional AI-assisted recording and transcription: To process session audio and generate transcripts or summaries where AI-assisted note-taking is used. Where this optional processing relies on consent, the basis is Article 6(1)(a). Where special-category data is involved, an additional applicable condition under Article 9 is required.
Processing online payments: To process purchases, confirm transactions, administer refunds and fulfil coaching agreements. Legal basis: Article 6(1)(b), where necessary for performance of the contract.
Accounting and legal compliance: To issue invoices, maintain financial records and comply with applicable tax and accounting obligations. Legal basis: Article 6(1)(c).
Payment security and dispute management: To protect against misuse, manage payment disputes and establish or defend legal claims. Legal basis: Article 6(1)(f), where legitimate interests appropriately apply, or another applicable basis.
Website operation and security: To maintain functionality, protect forms and detect technical misuse. Legal basis: Article 6(1)(f), where applicable.
Professional and employer communications: To respond to corporate enquiries and administer business relationships. Legal basis: Article 6(1)(b) or Article 6(1)(f), depending on the activity.
Optional marketing: Where consent is required for marketing communications, it will be sought separately under Article 6(1)(a) and applicable electronic communications rules. Sending an enquiry, booking a consultation or purchasing a service does not automatically subscribe you to a marketing mailing list.
5. Coaching Confidentiality
Confidentiality is an important foundation of my coaching practice. As an ICF Professional Certified Coach (PCC), I aim to maintain professional relationships based on trust, respect and confidentiality. Information shared during coaching sessions is treated as confidential.
Individual coaching conversations, personal reflections, written notes and AI-generated summaries are not routinely disclosed to employers, family members or unrelated third parties. Where an employer pays for coaching, this does not automatically give the employer access to the participant’s confidential coaching records. Any reporting to an employer must be lawful, appropriate and consistent with the agreed coaching arrangements.
Confidentiality may be subject to applicable legal requirements and other lawful grounds for disclosure, including circumstances where information must be disclosed by law. Any disclosure will be assessed and limited to what is necessary. The coaching agreement may establish additional confidentiality arrangements.
6. Written Coaching Notes
I maintain written notes to support coaching sessions, document relevant goals and agreed actions, and follow up on progress. These notes may contain personal information voluntarily shared during coaching. Depending on the arrangements, notes may be created manually or with the assistance of an AI note-taking service.
Coaching records are treated as confidential. They are not routinely shared with employers or other third parties. Access to records is limited to persons who have a lawful and legitimate need to process the information. Records are retained according to the relevant retention schedule and securely deleted or destroyed when no longer necessary, subject to applicable legal obligations.
7. AI-Assisted Note-Taking and Transcription
I may offer AI-assisted note-taking during coaching sessions to support the preparation of summaries, record agreed actions and maintain continuity between sessions. Depending on the technology and settings, this may involve capturing and processing session audio, recording coaching conversations, converting spoken conversations into transcripts, generating summaries and structured notes, identifying coaching goals and agreed actions, and processing personal information mentioned during sessions.
Client Information and Consent
Before AI-assisted recording or transcription begins, clients will be informed about the technology, its purpose and the information it processes. Where consent is the legal basis, separate informed consent will be obtained before the relevant processing begins. Consent may be withdrawn at any time without affecting processing that was lawful before withdrawal.
The availability of coaching without AI-assisted recording or transcription will be explained before the session. Where consent is withdrawn, subsequent processing and the handling of existing recordings or transcripts will be assessed in accordance with the applicable legal basis and retention requirements.
Confidentiality and Accuracy
AI-generated notes and transcripts are treated as confidential coaching information. AI-generated summaries may contain errors or omissions. They support the coaching process and do not replace professional coaching judgement. They are not routinely shared with employers or used for unrelated marketing activities.
External AI Provider
AI-assisted note-taking may involve transmitting information to an external service provider. The provider’s role, contractual arrangements, security measures and any international transfers must be assessed before confidential coaching information is processed. Any required data processing agreement and international transfer safeguards must be in place.
8. Online Payments Through Stripe
Online payments for coaching sessions, programmes and related services are processed using Stripe, a third-party payment services provider. Stripe provides payment technology that enables customers to pay securely online.
When you make a payment, Stripe may process name and contact details, billing information, payment card or other payment method details, payment amount and currency, transaction date and reference, payment status, fraud prevention and authentication information, refund, dispute and chargeback information, and technical information associated with the payment.
Depending on the checkout integration, payment information may be collected directly by Stripe or through Stripe payment components integrated into the website. I may receive transaction information necessary to confirm purchases, deliver services, issue invoices, manage refunds and maintain financial records.
Full payment card details and card security codes are intended to be handled by Stripe’s secure payment systems rather than stored in my coaching records. The actual website integration must be configured accordingly.
Stripe may act as a data processor or an independent data controller depending on the processing activity. Stripe may also process payment information for its own legally permitted purposes, including payment security, fraud prevention and compliance with legal obligations. Stripe’s privacy information is available at stripe.com/privacy. Additional information is available at Stripe’s Privacy Center.
Payment Processing Purposes and Legal Bases
Payment processing and contract fulfilment: Article 6(1)(b) GDPR. Taxation, invoicing and accounting: Article 6(1)(c) GDPR. Payment disputes and appropriate fraud prevention activities: Article 6(1)(f), where applicable, or another relevant legal basis. Stripe determines its own applicable legal bases for processing where it acts as an independent controller.
Payment Security
Payment information is processed using Stripe’s payment services and security infrastructure. The website integration must be maintained securely and configured in accordance with applicable payment security and authentication requirements.
Refunds and Payment Disputes
Where a refund, payment dispute or chargeback occurs, relevant transaction information may be processed and shared with Stripe, payment institutions, banks or relevant professional advisers where necessary and lawful.
Financial Data Retention
Transaction and invoice records are retained for the periods required by applicable Maltese tax, accounting and other legal obligations. Stripe may independently retain payment information under its own applicable policies and legal requirements.
9. Sensitive Personal Information
Coaching conversations may involve sensitive personal experiences, including stress, wellbeing, health concerns or difficult personal situations. Some information may constitute special-category personal data under Article 9 GDPR. I aim to avoid collecting or recording such information unless it is necessary for a clearly identified and lawful purpose.
Where special-category personal information is processed, an appropriate Article 9 condition must apply in addition to the relevant Article 6 legal basis. Where explicit consent is the applicable condition, it will be obtained separately and appropriately documented. Clients are not required to disclose unnecessary sensitive information. Coaching is intended to support personal and professional development. It is not a substitute for medical treatment, psychological therapy, psychiatric care or clinical diagnosis.
10. Where Is Personal Information Stored?
Website enquiries and booking records are stored in the website’s WordPress database. Relevant enquiry and appointment information may also be delivered by email. The website and email hosting provider is LH.pl.
Appropriate technical and organisational safeguards must be implemented to protect information against unauthorised access, loss, misuse, alteration and disclosure. These include suitable access restrictions, secure account and device practices, appropriate storage safeguards and secure deletion procedures. Where a personal data breach occurs, the incident will be assessed and the relevant GDPR notification requirements followed.
11. Who May Receive Personal Information?
Depending on the services used, personal information may be processed by LH.pl, as website and email hosting provider; Stripe, for payment processing and related activities; authorised website maintenance and technical support providers; email and communication service providers; appointment scheduling services; video-conferencing platforms; AI note-taking and transcription providers; document storage services; accounting and professional advisers; banks and financial institutions where necessary; and public authorities where required by law.
Where service providers act as processors on my behalf, appropriate Article 28 GDPR arrangements must be in place. Some providers, including Stripe for certain purposes, may also act as independent controllers. Personal information is not sold. Confidential coaching records are not routinely shared with employers or unrelated third parties.
12. International Data Transfers
Some service providers may process information outside Malta or the European Economic Area. This may include providers involved in payments, online communications, AI note-taking or cloud storage. Where personal information is transferred outside the European Economic Area and Chapter V GDPR applies, an appropriate transfer mechanism must be used.
Depending on the provider and destination, this may include a European Commission adequacy decision, Standard Contractual Clauses or another valid transfer mechanism under GDPR. Information about applicable safeguards and how to obtain further details will be provided where required. Stripe publishes information about its international transfer arrangements in its Privacy Center.
13. How Long Is Personal Information Kept?
Personal information is retained for as long as needed for the purpose for which it was collected. The period depends on the type of information, the length of the coaching relationship, any follow-up or unresolved enquiry, applicable accounting and legal obligations, and the need to establish, exercise or defend legal claims.
Enquiries and correspondence are kept while the enquiry and any relevant follow-up remain active. Booking information is kept for appointment administration and any necessary follow-up. Coaching notes and any recordings, transcripts or summaries are retained in light of the coaching relationship, their agreed purpose, and applicable legal obligations. Payment and invoice records are kept in accordance with applicable tax and accounting requirements. Technical logs are retained according to the security and operational needs for which they were created.
When information is no longer needed, it is securely deleted, anonymised or, in the case of physical records, appropriately destroyed. You may contact me for further information about the retention of your personal data.
14. Your Data Protection Rights
Under GDPR, subject to applicable conditions and exceptions, you may have the right to access your personal information; rectify inaccurate or incomplete information; request erasure or restriction where the legal conditions apply; receive qualifying information in a structured, commonly used and machine-readable format; object to certain processing based on legitimate interests, including direct marketing; withdraw consent where it is the basis for processing; and exercise applicable rights concerning solely automated decisions producing legal or similarly significant effects.
To exercise your rights, contact info@marzenaszybiak.com. I may request information reasonably necessary to verify your identity. Requests will normally be answered within one month. An extension of up to two additional months may apply where permitted under GDPR, in which case you will be informed. Some rights are subject to exceptions, including relevant legal obligations and legitimate legal claims. Where Stripe acts as an independent controller, certain requests concerning its own processing may also need to be directed to Stripe.
15. Your Right to Complain
If you have concerns about how your personal information is handled, you may contact me directly. You also have the right to lodge a complaint with a competent data protection supervisory authority.
16. Is Providing Personal Information Mandatory?
Providing personal information through enquiry and booking forms is generally voluntary. Certain information, including your name and contact details, is necessary to respond to enquiries or arrange consultations. To purchase coaching services online, the information necessary to process your payment and administer the coaching agreement must be provided.
Where information is not supplied, I may be unable to process your request, complete your purchase or deliver the requested service. Some billing information may be required by law. You are not required to disclose unnecessary sensitive information during coaching. Where optional processing is based on consent, the relevant choice and any consequences of declining will be explained.
17. Cookies and Similar Technologies
The website uses cookies or similar technologies where necessary to support functionality, booking sessions, form security and, where applicable, WordPress sign-in. Payment-related services, including Stripe, may also use cookies or similar technologies for payment functionality, security, fraud prevention and authentication.
Whether a particular technology requires consent depends on its purpose and whether an applicable legal exemption applies. Strictly necessary technologies may be used without consent where the relevant exemption applies. Non-essential analytics, advertising and other tracking technologies will require appropriate information and consent where mandated by law.
Where consent is required, the relevant technologies must not be activated before valid consent has been obtained. Visitors must be able to manage or withdraw applicable cookie consent through an appropriate mechanism. You may also manage cookies using browser settings. Disabling necessary storage may interfere with certain website functions.
18. Information Received From Employers or Schools
Where an employer, school or other organisation arranges coaching for an individual, I may receive relevant professional contact information and programme administration details from that organisation. Such information is used to communicate with participants, arrange services and administer the coaching relationship.
Where personal information is not obtained directly from the participant, any additional information required under Article 14 GDPR will be provided within the applicable time limits, unless a lawful exception applies. The sponsoring organisation does not automatically receive access to confidential coaching conversations or session notes. The respective data protection responsibilities of each organisation depend on the actual processing arrangements.
19. Automated Decision-Making
AI-assisted note-taking is intended to support the preparation of coaching notes and summaries. It is not intended to replace professional coaching judgement. If any service involves solely automated decision-making producing legal or similarly significant effects, the additional information and safeguards required under Article 22 GDPR will apply.
20. Children and Young People
Coaching services advertised through this website are primarily intended for adults. Where coaching involving minors is proposed, appropriate arrangements regarding parental responsibility, confidentiality, consent where required and other data protection obligations must be established before the relevant processing begins.
21. Links to Other Websites
This website contains links to independently operated services, including LinkedIn, Facebook and Instagram. These services maintain their own privacy notices and data protection practices. When you access an external website, the relevant provider’s privacy notice applies to its processing of your information.
22. Changes to This Policy
This Privacy Policy may be updated to reflect changes in coaching services, website functionality, payment technology, AI tools, service providers or applicable legal requirements. The latest version will be published on this website with the relevant revision date. Where required by law, additional information will be provided before material changes to processing take effect.
23. Contact
For questions about this Privacy Policy, coaching confidentiality, online payments, AI-assisted note-taking or your personal information, please contact:
Marzena Szybiak
Marzena Szybiak Coaching & Development
ICF Professional Certified Coach (PCC)
Dun Manwel Grima
Manikata MLH 5013
Malta
Email: info@marzenaszybiak.com
Website: https://marzenaszybiak.com
Be yourself. Anywhere.