Privacy Policy
Last updated: 21 October 2026
1. Controller
The controller under the EU General Data Protection Regulation (GDPR) is Apex Vanguard Dynamics LLC, 30 N Gould St Ste R, Sheridan, WY 82801, USA. Postal address in the EU: Muhrengasse 53, 1100 Vienna, Austria. Email: hello@michellefernando.com.
Counselling under the name "Michelle Fernando" is provided by Michelle Fernando on behalf of the controller. She processes your data only for the purposes set out below and is bound by confidentiality.
2. EU representative (Art. 27 GDPR)
Because the controller is established outside the EU, it will appoint a representative in the EU. Until the appointment is published here, please send any data protection matter to hello@michellefernando.com or by post to Muhrengasse 53, 1100 Vienna, Austria.
3. What data we process, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Name, email, phone, appointment details | Booking, reminders, communication | Art. 6 (1) (b): contract |
| Information about your mental and emotional wellbeing, your circumstances and what you share in sessions | Providing counselling, assessing suitability and safety | Art. 9 (2) (a): your explicit consent; Art. 6 (1) (b) |
| Emergency contact and your location during an online session | Calling help in a serious emergency | Art. 9 (2) (c) and Art. 6 (1) (d): vital interests; Art. 6 (1) (b) |
| Anonymised case information | Clinical supervision and training, as required by the BACP Ethical Framework | Art. 9 (2) (a): explicit consent; anonymised wherever possible |
| Payment and invoice data | Payment, bookkeeping | Art. 6 (1) (b) and (c): contract and legal obligation (tax law) |
| Emails and messages you send | Answering your enquiry | Art. 6 (1) (b) or (f): legitimate interest in replying |
| Newsletter email address (only if you subscribe and confirm) | Sending the newsletter | Art. 6 (1) (a): consent, withdrawable through the link in every email |
| Technical data (IP address, browser, time of access) | Secure operation of the Website | Art. 6 (1) (f): legitimate interest in security and stability |
| Data needed to establish or defend legal claims | Handling complaints or disputes | Art. 6 (1) (f), Art. 9 (2) (f) |
You give your explicit consent to the processing of health-related data by ticking the consent box when you book, before your first session. The booking records when you gave it and which version of these texts applied. Without this consent we cannot provide counselling.
4. Supervision
The Counsellor discusses her work with a qualified clinical supervisor, without your name or details that would identify you. Supervisors are bound by confidentiality.
5. Disclosure in exceptional situations
We disclose personal data to third parties only where described in this policy, where you consent, where it is necessary to protect life or health (for example to emergency services), or where it is required by law or a court order. See section 7 of the Terms and Conditions.
6. Recipients and processors
We use the following service providers, bound by data processing agreements (Art. 28 GDPR) where they act as processors:
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Server for the Website and the booking system | Germany (company); server in Finland, EU |
| Cloudflare, Inc. | Network delivery and protection of the Website | USA (global network) |
| Add Rabbit LLC (Purelymail) | Email and the practice calendar | USA (servers at Amazon Web Services) |
| Microsoft Ireland Operations Ltd (Microsoft Teams, business account) | Online sessions | EU (EU Data Boundary) |
| Stripe | Card payments (independent controller for its own purposes) | USA / EU |
The booking system is our own software running on the server named above; it holds contact and appointment details and payment status, and no session notes. If the Counsellor keeps brief session notes, they are kept on paper only, locked away, never stored online or shared with any of the providers above, and destroyed after one year.
7. Transfers outside the EU
The controller is a US company, and some providers may process data in the USA or other non-EU countries. Such transfers are based on an adequacy decision (for the USA, the EU-US Data Privacy Framework, where the recipient is certified) or on the EU Standard Contractual Clauses (Art. 46 GDPR). You can request a copy of the safeguards at hello@michellefernando.com.
8. How long we keep data
| Data | Retention |
|---|---|
| Paper session notes | 1 year after counselling ends, then shredded |
| Invoices and payment records | 7 years (Austrian tax law, § 132 BAO) |
| Booking and email correspondence | Up to 3 years after the last contact |
| Website log files | Up to 14 days, unless needed to investigate a security incident |
| Enquiries that do not lead to counselling | Up to 6 months |
| Newsletter address | Until you unsubscribe |
Where data are needed to establish or defend legal claims, we keep them until those claims are time-barred.
9. Security
We protect your data with appropriate technical and organisational measures, including encrypted connections (TLS), encrypted backups, access restricted to the Counsellor, and two-factor authentication for the practice system. No transmission over the internet is completely secure; please use a private device and connection for sessions.
10. Cookies, storage and analytics
The Website sets no cookies for visitors and uses no analytics, advertising or tracking tools, so there is no cookie banner. Fonts are served from our own server, not from Google.
Your browser's own storage (localStorage) is used only on your device: to save your progress in a free self-test so you can resume it, and to remember that you closed a notice. This information is not sent to us. You can clear it in your browser at any time.
The only cookie is a strictly necessary login cookie for the Counsellor's practice system, which visitors never receive.
11. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). You may withdraw your consent at any time with effect for the future; this does not affect processing carried out before withdrawal. Withdrawing consent to health-data processing means counselling cannot continue. Contact: hello@michellefernando.com.
You also have the right to lodge a complaint with a supervisory authority. In Austria this is the Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, dsb.gv.at.
12. No automated decisions
We do not use automated decision-making or profiling. The free self-tests calculate a score in your browser; the result is not sent to us.
13. Minors
The service is for adults only. We do not knowingly collect data of persons under 18.
14. Changes
We may update this policy. The current version is always available on the Website; material changes will be communicated to active clients by email.