1. Who is responsible for your data
The person responsible for processing personal data on this website (the “controller”) is:
Margaret (“Mags”) Treanor
Bruchstrasse 54
6003 Luzern
Switzerland
Email: info@magstreanor.com
I am a sole practitioner. There is no data protection officer, and none is required at this scale.
2. Which law applies
I process personal data under the revised Swiss Federal Act on Data Protection (revFADP / revDSG), in force since 1 September 2023.
Because I also offer coaching and programmes to people living in the European Union — in particular Ireland and Germany — the EU General Data Protection Regulation (GDPR) applies to that processing under Article 3(2) GDPR. Where the two differ, I apply whichever gives you stronger protection.
3. What I collect, why, and how long I keep it
3.1 When you contact me through the website
The contact form collects your name, email address and the content of your message. I use this only to answer you. Form entries are stored in the website database and also sent to my email inbox.
Legal basis: your request and steps taken at your request before entering a contract (Art. 6(1)(b) GDPR); legitimate interest in responding to enquiries (Art. 6(1)(f) GDPR); Art. 31 revFADP.
Retention: 24 months from our last contact, then deleted.
3.2 When you book a discovery call
Bookings run through Google Calendar Appointment Scheduling. Google collects your name, email address and chosen time slot, and adds the appointment to my calendar. Google acts as a processor and also as an independent controller for its own platform purposes.
Legal basis: pre-contractual steps at your request (Art. 6(1)(b) GDPR).
Retention: calendar entries are kept for 24 months.
3.3 When you subscribe to updates
If you sign up for my newsletter or Substack, I store your email address, the date of your consent and your subscription status. Every email contains an unsubscribe link, and you can withdraw consent at any time with effect for the future.
Legal basis: your consent (Art. 6(1)(a) GDPR; Art. 6(6) revFADP).
Retention: until you unsubscribe, plus a record of the unsubscribe so I do not contact you again by mistake.
3.4 When you become a coaching or programme client
For clients I process contact details, invoicing and payment details, the agreements between us, and my own working notes from our sessions. Session notes are brief and functional. I do not record coaching or cohort sessions.
Legal basis: performance of our contract (Art. 6(1)(b) GDPR); legal obligation for accounting records (Art. 6(1)(c) GDPR).
Retention: invoices, contracts and accounting records are kept for 10 years, as Swiss law requires (Art. 958f Swiss Code of Obligations). Coaching notes are deleted 24 months after our work ends.
3.5 When you pay for a programme
Payments for programmes are processed by Stripe Payments Europe, Ltd. (Dublin, Ireland). Stripe receives the payment data you enter — card details, name, billing address and the amount — and processes it as an independent controller under its own privacy policy. I never see or store your full card number. I receive only confirmation of payment, the last four digits, and the details needed to issue your invoice.
Legal basis: performance of our contract (Art. 6(1)(b) GDPR).
Retention: payment records are kept for 10 years with the accounting records.
3.6 When you simply visit the site
My hosting provider automatically records server log data: IP address, date and time, the page requested, browser type and operating system, and the referring page. This is technically necessary to deliver the site and to detect attacks and faults.
Legal basis: legitimate interest in a secure, functioning website (Art. 6(1)(f) GDPR).
Retention: short-term, at the hosting provider’s standard log rotation.
3.7 When you take the Next Decade Assessment
The Next Decade Assessment is a self-assessment that produces a profile across eight dimensions, a suggested starting route and a personal roadmap. It is a developmental tool. It is not a psychological test, not a validated psychometric instrument, and not a diagnosis of any kind.
When you take it, the following is processed: your context answers (your current situation, the direction that attracts you, your expected timing, how important paid work is to you, and how much capacity you have), your responses to the 32 statements, anything you write in the free-text box, the region and sector you may optionally give, and the results calculated from these — your eight dimension scores, your route, your three priority areas, the assessment version and the date you completed it.
Your answers stay in your own browser. In the current version they are stored locally on your own device and are not transmitted to me. You can erase them at any time using the delete button on the assessment’s data page, or by clearing your browser storage. If you ask to receive your result by email, your email address is submitted and handled as described in section 3.3.
I do not ask for your age or date of birth, and age is never used as a scoring factor. I do not ask for health data, religious or political views, trade-union membership or any other special category of personal data, and I ask you not to enter such details in the free-text box. What you write in that box is never sent to any AI system.
Automated processing, but no automated decisions. Your result is generated automatically from your answers by a fixed set of rules. This is profiling within the meaning of Art. 4(4) GDPR. However, no decision producing legal effects or similarly significant effects is taken about you on this basis (Art. 22 GDPR; Art. 21 revFADP). The result is a recommendation you are free to disregard. Nothing about your membership, the price you pay, or whether you are accepted onto a programme depends on it.
Legal basis: your consent (Art. 6(1)(a) GDPR; Art. 31(1) revFADP). You may withdraw it at any time by deleting your answers, which does not affect the lawfulness of processing before withdrawal.
Retention: in your browser until you clear it. I hold no copy unless you choose to send me one.
Optional: helping to improve the assessment. Separately from the consent needed to generate your result, you may agree that your de-identified responses are used to improve the assessment. This consent is never bundled with the first one, and refusing it has no effect on your result. De-identified data is no longer linked to you and may be kept indefinitely for this purpose.
Legal basis: your separate consent (Art. 6(1)(a) GDPR; Art. 31(1) revFADP).
If you link your result to a membership profile. Where you choose to connect your result to a Next Decade community account, only your route, your dimension scores, your focus areas, the assessment version and your re-assessment date are written to your member profile. Score fields are kept internal and are not displayed to other members. For employer programmes, individual responses are never disclosed to an employer; any reporting is aggregated.
The assessment application is hosted by Lovable Labs Sweden AB, Regeringsgatan 25, 111 53 Stockholm, Sweden. Its servers record technical log data as described in section 3.6.
4. Cookies and analytics
This site uses cookies. When you first arrive you are shown a consent banner (CookieYes), where you can accept or refuse each category. Only strictly necessary cookies are set before you choose. You can change or withdraw your choice at any time through the banner, or by clearing cookies in your browser.
| Category | What it does | Needs your consent |
|---|---|---|
| Strictly necessary | Keeps the site working: security, session handling, remembering your cookie choice. | No |
| Statistics | Jetpack Stats (Automattic Inc., USA) counts page views and referrers. Google Analytics is installed via the MonsterInsights plugin and may collect usage statistics. | Yes |
| Functional | Embedded content such as YouTube videos and the booking calendar, which set their own cookies once loaded. | Yes |
I use analytics to understand which pages are read, not to build profiles of individuals, and I do not use the data for advertising. There is no Facebook pixel, no LinkedIn insight tag and no advertising network on this site.
5. Third parties who process data for me
| Service | Purpose | Where |
|---|---|---|
| Hostinger | Website and email hosting | EU (Lithuania) and its data centres |
| Automattic (Jetpack Stats) | Website statistics | USA |
| Google Ireland / Google LLC | Fonts, Analytics, Calendar booking, YouTube embeds | EU and USA |
| Stripe Payments Europe, Ltd. | Payment processing for programmes | Ireland (EU) |
| WPForms | Contact form handling | Stored on my own hosting |
| Substack | Newsletter, if you subscribe there | USA |
| Lovable Labs Sweden AB | Hosting of the Next Decade Assessment application | Sweden (EU), with some sub-processing outside the EU |
| CircleCo, Inc. | The Next Decade community platform, if you join it | USA |
These providers act on my instructions under data processing agreements, except where they are independent controllers for their own platform purposes.
6. Transfers outside Switzerland and the EU
Some of the services above are operated by companies in the United States. Transfers there are covered by the Swiss–U.S. Data Privacy Framework (recognised by the Swiss Federal Council with effect from 15 September 2024) and the EU–U.S. Data Privacy Framework where the provider is certified, or otherwise by the Standard Contractual Clauses. You can ask me for a copy of the safeguards that apply.
7. Your rights
You can ask me, free of charge, to:
- tell you what data I hold about you and give you a copy;
- correct anything inaccurate;
- delete your data, where I am not legally required to keep it;
- restrict or object to processing;
- transfer your data to you or another provider in a machine-readable format;
- withdraw consent at any time, with effect for the future.
Write to info@magstreanor.com. I will respond within 30 days. I may ask you to confirm your identity first, so that I do not disclose your data to someone else.
8. Complaints
If you are not satisfied with how I have handled your data, you can complain to a supervisory authority:
- Switzerland: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern — www.edoeb.admin.ch
- Ireland: Data Protection Commission — www.dataprotection.ie
- Germany: the data protection authority of your federal state (Land)
9. Security
The site is served over an encrypted connection (HTTPS). Access to client files and the website administration is protected by strong, unique passwords and two-factor authentication where the provider offers it. No system is perfectly secure, and I cannot guarantee the security of information you send me by ordinary email — if something is particularly sensitive, tell me and we will find another way.
10. Children
My services are intended for adults. I do not knowingly collect data from anyone under 16.
11. Changes
I may update this policy as my services or tools change. The current version always appears on this page with its date. Material changes affecting existing clients will be notified by email.
12. Contact
Questions about this policy or your data: info@magstreanor.com