Privacy policy

Who is responsible for your data

Jennifer Nunez, trading as Work Worth Doing, a sole trader registered in Portugal (NIF 303204036), based in Lisbon. I am the data controller for everything described here. You can reach me through the contact form.

What I collect

When you send a message. Your name, email address and whatever you write in the contact form.

When you apply. Your first and last name, email address, country code and WhatsApp number, your answers to three questions about what has brought you here, and how you found me.

When you book a call. After applying you are sent to my Google Calendar booking page, where you give your name and email so the call can be scheduled.

When you subscribe. The newsletter sign-up on this site is run by Substack. Your email address goes to Substack, not to this site, and is handled under Substack's privacy policy.

When we work together. Your contact details, the goals you share in your intake, session notes, recordings where we have agreed to them, messages between sessions, and billing records.

Why, and on what basis

To reply to your application and arrange a first conversation (your consent, and my legitimate interest in answering an enquiry). To deliver the coaching you have agreed to (performance of our agreement). To keep accounts and invoices (legal obligation). To keep my professional credential (legitimate interest, explained below). To understand how the site is used, through analytics cookies (your consent).

Who else sees it

I use a small number of services to run the practice. Each one only receives what it needs:

• Netlify hosts this site and receives application form submissions.
• Google Workspace for email, booking (Calendar) and video sessions (Meet).
• Notion for each client's private workspace of notes, recordings and resources.
• Voxer for messages between sessions.
• Substack for the newsletter.
• Luma for the events calendar and event registrations.
• Google Analytics for anonymous visit statistics, only if you accept cookies.
• Gemini, Google's AI assistant inside Google Workspace, to prepare session summaries, unless you tell me before our first session that you would rather I didn't.

Some of these companies are based outside the EU. Where your data leaves the EU, it is covered by the safeguards those providers offer under GDPR, such as standard contractual clauses.

I am working towards and maintaining an International Coaching Federation (ICF) credential. The ICF may ask to verify that a coaching relationship took place. If so, I share only your name, contact details and the dates we worked together, never notes or content. I may also discuss my work in supervision, always anonymously.

How long I keep it

If we do not go on to work together, I delete your application within twelve months. If we do, I keep session notes for as long as we work together and for twelve months after we finish, in case you come back to the work, then delete them. You can ask me to delete them sooner. Billing records are kept for as long as Portuguese tax law requires. Your name and dates may be kept for ICF credential verification.

Your rights

You can ask to see what I hold about you, correct it, delete it, take a copy of it, or object to how it is used. Send me a message through the contact form and I will reply within a month. If you are unhappy with my answer you can complain to the Portuguese data protection authority, the CNPD.

Cookies and analytics

With your permission, this site uses Google Analytics to count visits: which pages are read, roughly where visitors are from, what device they use, how they arrived, and how many go on to apply. It does not tell me who you are. Google Analytics sets cookies (named _ga) that last up to 13 months, and only after you press Accept. If you press Reject, nothing is loaded. You can change your mind at any time through Cookie settings in the footer. Your choice itself is remembered in your browser for a year.

No advertising or remarketing cookies are used. Fonts load from Google Fonts, so Google sees that request. The Substack sign-up box is loaded from Substack, the events calendar on the Events page is loaded from Luma, and essays may embed video from YouTube or Vimeo; these services may set their own cookies.

Confidentiality

What you share in coaching is confidential, under the ICF Code of Ethics. Coaching is not a legally privileged relationship in the way medicine or law is, so there are limits: I may have to disclose something if the law requires it, or if I believe there is a serious risk of harm to you or someone else. I will never name you as a client without your permission.

Changes

If this policy changes, the date at the top of this page will change with it.