Data Processing Terms

These terms apply to all personal data submitted via this website — specifically the sample training week form, the contact form, and the Calendly discovery call booking. For coaching clients, the coaching agreement supersedes these terms where it is more specific.

• Data Controller: Ziad Darwich. Decides what data is collected and why.
• Data Processors: third-party tools listed in Section 6, acting on the controller's instructions under signed DPAs or equivalent terms.
• Data Subject: you — the visitor submitting the form or booking the call.

• Identification: name (contact form, booking).
• Contact: email address (all forms), optional time zone (booking).
• Content: the message you type into the contact form and any answers you provide on the Calendly intake.
• Technical: language preference, timestamp, IP-derived country (analytics only, anonymised).

• Deliver the requested sample training week PDF — consent.
• Respond to enquiries and assess fit for coaching — consent and legitimate interest.
• Schedule and prepare discovery calls — steps prior to entering a contract.
• Send follow-up emails about coaching (until you unsubscribe) — consent, with a one-click unsubscribe in every email.
• Prevent spam and abuse of forms — legitimate interest.

Each processor we engage commits to: (a) processing personal data only on documented instructions from the controller; (b) maintaining confidentiality; (c) implementing appropriate technical and organisational security measures (Article 32 GDPR); (d) assisting the controller with data subject requests and breach notifications; (e) deleting or returning all personal data at the end of the service; and (f) submitting to audits or providing equivalent third-party attestations.

• FormSubmit (US) — form submission relay.
• Calendly, LLC (US) — meeting scheduling.
• Google LLC — Workspace (email) and Google Analytics 4 (consent-gated).
• Lovable (EU) and Cloudflare, Inc. (US) — hosting and CDN.

Some subprocessors are located outside the EEA, UK, and Switzerland. Transfers are governed by the EU Standard Contractual Clauses (Commission Decision 2021/914), the UK International Data Transfer Addendum, and any equivalent mechanism required by Swiss law. Supplementary measures (encryption in transit, minimisation, access controls) are in place to maintain an essentially equivalent level of protection.

• TLS 1.2+ encryption for all data in transit.
• Access to inboxes and processor dashboards is protected by strong, unique passwords and multi-factor authentication.
• Principle of least privilege — only the controller has access to raw submissions.
• No storage of submitted data on local devices outside the listed processors.
• Quarterly review of processors and access permissions.

Submissions are retained for up to 24 months from your last interaction, then deleted from inboxes and processor logs (within the processors' own deletion windows, typically 30–90 days). Clients who proceed to coaching are governed by the coaching agreement's retention terms.

In the event of a personal data breach affecting your data, the controller will notify the competent supervisory authority within 72 hours of becoming aware of it where required, and notify you directly without undue delay where the breach is likely to result in a high risk to your rights and freedoms.

You may exercise your GDPR rights (access, rectification, erasure, restriction, portability, objection, withdrawal of consent) at any time by emailing contact@ziaddarwich.com. Requests are honoured within 30 days. You also have the right to lodge a complaint with your local data protection authority.

These terms may evolve as our tools change. The current version is always the one published at this URL with the latest "Last updated" date above.