Privacy policy

Last updated: 30 October 2026

1. Controller

Imen Sellami, address and contact details as in the legal notice. You can reach me about data protection at mail@imensellami.com.

2. What data I process, and why

• Booking: name, email, billing address, appointment time and your answers in the booking form. Purpose: to schedule and deliver the Session. Legal basis: Art. 6 (1) (b) GDPR (contract).
• Payment: processed by Stripe. I receive confirmation of payment, never your full card details. Legal basis: Art. 6 (1) (b) GDPR.
• Questionnaire, photos and floor plan: information about your home and daily routine that you submit before the Session. Purpose: preparing my advice. Legal basis: Art. 6 (1) (b) GDPR. Please avoid photos that show people or documents with personal information.
• Video call: the Session takes place via Google Meet. I do not record the call.
• Contact form: name, email and your message, used only to answer your enquiry. Legal basis: Art. 6 (1) (b) and (f) GDPR. The form is provided by Tally and messages are deleted when no longer needed.
• Email: I send the summary, invoice and follow-up questions by email.
• Invoices and accounting: I keep invoices and booking records as required by German tax law. Legal basis: Art. 6 (1) (c) GDPR.
• Before/after images on Instagram: only with your separate, voluntary consent, which you can withdraw at any time. Legal basis: Art. 6 (1) (a) GDPR.

3. Service providers

I use the following providers, who process data on my behalf or as independent controllers:

• TidyCal (online booking): Sumo Group Inc. (AppSumo), Austin, Texas, USA
• Stripe (payment): Stripe Payments Europe, Ltd., Dublin, Ireland
• Google (Google Meet, Gmail, Google Calendar): Google Ireland Limited, Dublin, Ireland
• Tally (questionnaire, uploads and contact form): Tally BV, Ghent, Belgium
• Website hosting: Netlify, Inc., San Francisco, USA

Some of these providers may transfer data to the USA. Such transfers are based on the EU-US Data Privacy Framework or the EU Standard Contractual Clauses.

4. Instagram

I run an Instagram account. Meta Platforms Ireland Limited, Dublin, Ireland, and I are jointly responsible for some processing on that account (Art. 26 GDPR). Meta's privacy policy applies to how Meta processes your data.

5. How long I keep data

• Photos, floor plans and questionnaire answers: deleted 6 months after the Session, unless you consent to longer storage.
• Invoices and accounting records: for the periods required by German tax and commercial law.
• Email correspondence: as long as needed for the contract and any follow-up questions.

6. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). You can withdraw any consent at any time with effect for the future. You also have the right to lodge a complaint with a data protection supervisory authority. In Berlin, this is the Berliner Beauftragte für Datenschutz und Informationsfreiheit.

7. Is providing data required?

Name, email, billing address and the questionnaire are needed to book and deliver the Session. Without them, I cannot provide it.