Who's writing

Privacy statement

Last updated: 26 October 2026

Who I am

Unmasking Work is the coaching practice of Agata Strojek, registered with the Dutch Chamber of Commerce under KvK number 42189154, at Kraijenhoffstraat 137A, 1018 RG Amsterdam. I'm responsible for how your personal data is handled. You can reach me at unmasking.work@gmail.com.

My approach to your data

I collect only what I need to coach you well and run my business. I don't ask for medical or diagnostic information, and I keep health details out of my session notes unless they matter for your coaching, and then I note them only briefly. Because my coaching is ADHD-informed, booking a call with me, being my client, anything health-related you choose to share in writing (for example in your intake answers or messages), and anything health-related you say in a session I transcribe with your consent may still reveal something about your health. I process that only to arrange our call and for your coaching, with your explicit consent (GDPR Art. 9(2)(a)): you give it in the booking form and again when you accept my coaching agreement. I won't copy it into other records, and I don't write down anything health-related from a discovery call. If you withdraw your consent, our coaching ends and I delete your coaching file within one month. I keep only the agreement emails and payment records that tax law requires, or that I need for a legal claim.

What I collect and why

Purpose

Data

Legal basis

How long I keep it

Handling your enquiry or discovery call

Name, email, message, what you’d like help with

Steps before a contract (Art. 6(1)(b)), plus your explicit consent in the booking form (Art. 9(2)(a))

3 months if you don’t become a client

Delivering coaching

Contact details, role and work context, intake answers, coaching goals, session notes on actions and progress, messages between sessions

Contract (Art. 6(1)(b)), plus your explicit consent for information that may reveal something about your health (Art. 9(2)(a))

Up to 12 months after our last session

Invoicing and bookkeeping

Name, address, billing details, invoices, payments

Legal obligation (Art. 6(1)(c)), as part of my financial records, where these could reveal something about health, to be able to show what we agreed in a dispute (Art. 9(2)(f))

7 years (Dutch tax law)

Employer-sponsored coaching

Your name, session dates and attendance, invoicing details

Legitimate interest (Art. 6(1)(f)): carrying out and invoicing my contract with your employer

7 years for invoicing records

Newsletter (if you sign up)

Email address, name if you give it, when and where you signed up, whether emails are opened and links clicked

Your consent (Art. 6(1)(a)). After you unsubscribe: legitimate interest in respecting your choice (Art. 6(1)(f))

Until you unsubscribe. After that, I keep only your email address marked as unsubscribed, so you're never added again by mistake. Ask, and I'll delete it completely

Occasional updates to existing clients

Name, email

Legitimate interest (Art. 6(1)(f)): keeping clients informed about related services

Until you object. You can opt out when you first give your email and through the unsubscribe link in every message

Session recordings for mentor coaching and ICF (only with your separate consent)

Audio recording, transcript, signed consent form; any health information you choose to mention

Your explicit consent (Art. 6(1)(a) and 9(2)(a)); for transfers outside the EU, Art. 49(1)(a)

Deleted once I've received feedback or my final ICF result, at the latest 6 months after the recording. Your consent email: 2 years after the last recording is deleted

Coaching log for ICF credentialing (only if you agree)

Name, contact details, session dates and hours

Legitimate interest (Art. 6(1)(f)): showing ICF the coaching hours required for my credential

Until I no longer need these hours for an ICF credential application or audit, and at most 5 years after our coaching ends. Removed sooner if you withdraw consent

Keeping our signed agreement

Coaching agreement, consumer information, confirmation email

Legal obligation (Art. 6(1)(c)), where these could reveal something about health, to be able to show what we agreed in a dispute (Art. 9(2)(f))

7 years (Dutch tax law)

Handling complaints or disputes

Your message, our correspondence, relevant records

Legitimate interest: resolving complaints and defending legal claims (Art. 6(1)(f), and Art. 9(2)(f) where they could reveal something about health); legal obligation for privacy requests (Art. 6(1)(c))

5 years after it's closed

AI-assisted session notes and my own training (only with your separate consent)

Transcript of our online session, which may include health information you mention; the AI-drafted summary; your consent email

Your explicit consent (Art. 6(1)(a) and 9(2)(a)), given separately for session notes and for my training

Transcripts: deleted at the latest 30 days after the session. The summary, once I've checked it, becomes part of my session notes (up to 12 months after our last session). Your consent email: 2 years after the last transcript is deleted

Testimonials (only with your permission)

The text you approve, shown with your name, initials, job title or industry, as you choose; your approval email

Your explicit consent (Art. 6(1)(a), and Art. 9(2)(a) where a testimonial could suggest health information)

Published until you ask me to remove it; I take it down within 14 days. Your approval email: 2 years after removal

Handling complaints or privacy requests

Your message, our correspondence, relevant records

Legitimate interest: resolving complaints and defending legal claims (Art. 6(1)(f), and Art. 9(2)(f) where they could reveal something about health); legal obligation for privacy requests (Art. 6(1)(c))

5 years after it's closed

If you don’t provide the details needed for our contract or invoicing, I can’t provide coaching.

If your employer pays for coaching
The content of our sessions stays confidential. I share with your employer only what’s needed for invoicing (such as session dates and attendance) and anything else you explicitly agree to.
If your employer arranged your coaching, I received your name and work contact details from them.

Who I share data with


I never sell your data. I share it only with:

  • the service providers I use to run my practice: Google (email, video calls, file storage and, only if you agree, transcription and AI note-taking with Gemini), Calendly (scheduling), WhatsApp (messages between sessions, only if you choose to use it) and Kit (newsletter)

  • for sessions you've agreed to have recorded: the transcription tool named in my recording request, my mentor coach and training provider, and, if I submit a recording for my credential, the International Coaching Federation (ICF), all bound by confidentiality

  • my accountant and the Dutch Tax Authority, as required by law

  • website and LinkedIn visitors, only for testimonials you've approved, in the form you chose

  • others only if the law requires it, or to protect someone's life or safety in an emergency


Transfers outside the EU
Google (including Gemini), Calendly, WhatsApp and Kit may process data in the United States. Where that happens, these providers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses. Ask me if you'd like details. ICF is based in the United States; sending it a recorded session relies on your explicit consent.


WhatsApp
WhatsApp messages are end-to-end encrypted. Please don't share health details or other sensitive information by WhatsApp. I delete our chats with the rest of your file, and you can always choose to use email only.


Session recordings
Recording a session (audio or video) is separate from AI-assisted notes. I only record sessions with your separate, explicit consent, which you give by replying "Yes" to my recording request email. I use recordings for my coach training (feedback and assessment by my mentor coach and training provider) and for my ICF credential. That email explains exactly who receives the recording, which transcription tool I use, and when everything is deleted. No reply means no recording. I check with you again before each recorded session, you can ask me to stop recording at any moment, and saying no has no effect on your coaching.

How I protect your data
I use password-protected and encrypted devices, two-factor authentication on my accounts, and reputable providers. Apart from the people described above, only I have access to client information.

Technology and AI
With your separate, explicit consent, I use transcription and Gemini in Google Workspace in our online sessions for two things. You can agree to session notes only, to both, or to neither:

  • Session notes: the session is transcribed and Gemini drafts a summary of your goals, actions and progress. I check and correct every summary myself, and only the checked summary becomes my session note.

  • My own training: I review the same transcripts, sometimes asking Gemini for feedback on how I coached, to improve my coaching skills. This stays with me, and any learning notes I keep afterwards don't identify you.


Google processes this as my service provider under its Google Workspace business terms and doesn't use our content to train its AI models. Transcripts are deleted at the latest 30 days after the session. You'll see an on-screen indicator while transcription or note-taking is on, and you can ask me to switch it off at any moment. Saying no, or withdrawing your consent later, has no effect on your coaching: I'll take notes without AI. I never use AI on discovery calls.


I don't use tools that recognise emotions from your voice, face or video, and AI never makes decisions about you. Recordings for mentor coaching and ICF are described under Session recordings; my recording request names the transcription tool. If I ever want to use AI with your information in any other way, I'll explain it to you first and ask for your agreement.

Your rights
You have the right to:
• see the personal data I hold about you
• have it corrected or deleted
• restrict or object to its use
• receive it in a portable format
• withdraw consent at any time, where I rely on consent. For the newsletter, use the unsubscribe link in every email

Your right to object. Where I rely on legitimate interest (see the table above), you can object at any time to my use of your data for reasons relating to your situation. For client updates and other direct marketing, I’ll stop as soon as you object, no reasons needed.
Email unmasking.work@gmail.com to use any of these rights. I'll respond within one month. If you're unhappy with how I handle your data, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl, or to the data protection authority in the EU country where you live.

Cookies
My website uses only functional cookies needed for it to work.

Automated decisions

No decisions about you are made by automated means (GDPR Art. 22). Where I use AI for session notes, it only drafts a summary that I check and correct myself..

Changes
I may update this statement. The latest version is always on my website.

Newsletter
Written by one of us.

No spam, unsubscribe anytime.