Privacy Policy

1. Data Controller

Matzau Erhvervspsykologer ApS is the data controller for the personal data we process about you.

Matzau Erhvervspsykologer ApS
Company Reg. No. DK-30597206
Vesterbrogade 60A
1620 Copenhagen V
Denmark
Contact: Majken Lorelei Matzau
Phone: +45 70 23 09 77
Email: info@loreleimatzau.com
Website: loreleimatzau.com

2. When do we process personal data?

We process personal data when you, for example:

• contact us by email, phone, or through a contact form
• receive executive coaching, advisory services, therapy, or psychological treatment
• purchase or receive a service
• receive an invoice
• subscribe to our newsletter
• visit loreleimatzau.com
• interact with us on social media
• work with us as a company or business partner.

We only process information that is relevant and necessary for the specific purpose.

3. What information do we process?

Depending on your relationship with us, we may process:

• name
• address
• email address
• phone number
• company and place of work
• information about appointments and scheduling
• correspondence with us
• invoicing and payment information
• information about services purchased or received
• information you provide about your personal, professional, or health situation
• health data in connection with psychological treatment
• Danish personal identification numbers (CPR numbers) in specific circumstances
• technical information about your use of loreleimatzau.com, including information collected through cookies and similar technologies where applicable.

4. Executive coaching, advisory services, therapy and psychological treatment

When you receive executive coaching, advisory services, therapy, or psychological treatment from Matzau Erhvervspsykologer, we process personal data relevant to your engagement or course of treatment.

This may include contact details, information about appointments and correspondence, and information you provide about your personal, professional, or health situation.

In connection with psychological treatment, we may process health data and other sensitive personal data where necessary for the treatment.

Majken Lorelei Matzau is an authorised psychologist in Denmark and, when providing healthcare services, is subject to applicable professional confidentiality requirements.

5. Health data

Health data is a special category of personal data under data protection law.

Where health data is processed because it is necessary to provide psychological or other healthcare services, processing takes place on the relevant legal basis under applicable data protection law, including GDPR Article 9(2)(h) where the conditions are met.

In other situations, sensitive personal data may be processed on another relevant legal basis, for example explicit consent or where processing is necessary for the establishment, exercise, or defence of legal claims.

6. Danish personal identification numbers

We may process Danish personal identification numbers (CPR numbers) in specific circumstances where this is necessary and permitted under applicable Danish law, for example in connection with psychological healthcare services or where a CPR number is required for invoicing an insurance company.

Where a CPR number is required in connection with insurance invoicing, it is typically provided by the client and may form part of the relevant invoicing and accounting records.

CPR numbers are processed only where there is a lawful basis under the specific Danish rules governing their processing.

7. Where does the information come from?

As a general rule, we receive information directly from you.

If your employer has referred you to a program or pays for a service, we may also receive general contact or administrative information from your employer.

Where relevant, we may also receive information from an insurance company or another partner if this is necessary to administer or provide the agreed service.

8. Contact forms

If you contact us through a contact form on loreleimatzau.com, we process the information you provide, such as your name, email address, phone number and message.

We use Resend to process and deliver contact form submissions. Information submitted through the contact form is stored by Resend for 30 days and is then deleted from Resend.

The information we receive through the contact form may subsequently form part of our correspondence with you and will be retained in accordance with the retention periods described in section 17 below.

9. Invoicing and accounting

In connection with invoicing, we may process:

• name and address
• company and company address
• date of the service
• type and scope of the service
• price
• name of the psychologist who provided the service
• CPR number where necessary, for example in connection with invoicing an insurance company.

An invoice may in some cases contain information that directly or indirectly indicates the nature of the service you received.

We use e-conomic for invoicing and accounting.

Our external bookkeeper and auditor may have access to the information necessary for bookkeeping, accounting, and auditing.

10. Employers

If your employer pays for your program, this does not in itself give your employer access to information about the content of your sessions or treatment.

If information about your program or treatment is to be shared with your employer, this will only take place where there is a lawful basis for doing so, including your prior and explicit consent where consent is required.

11. Referral to other psychologists

By agreement with you, relevant information may be shared with an independent psychologist if that psychologist is to take over or provide part of your program or treatment.

The psychologist in question will then be an independent data controller for their own processing of your personal data.

12. Newsletter

If you subscribe to our newsletter, we process your email address and any other information you provide when subscribing.

We use Mailchimp to administer and send our newsletters.

Processing is based on your consent. You may withdraw your consent at any time by using the unsubscribe link in our newsletters.

Once you unsubscribe, you will no longer receive newsletters or other marketing based on that consent.

After you unsubscribe, we may retain the information necessary to document that we previously held valid marketing consent for up to two years after the consent was last used. The information is then deleted unless there is another lawful basis for continued retention.

13. Website and cookies

When you visit loreleimatzau.com, we may process technical information about your visit through cookies and similar technologies.

We use necessary cookies to operate the website and remember your cookie preferences.

With your consent, we use Google Analytics (GA4) to understand how visitors use the website, for example which pages are visited and how visitors arrive at the site.

Google Analytics is implemented using Google Consent Mode. Analytics cookies are only set after you have actively consented to statistics cookies. If you decline or have not yet made a choice, no analytics cookies are set.

You can accept, decline, change, or withdraw your consent to statistics cookies at any time through the Cookie Settings link in the footer.

Further information about the cookies used on loreleimatzau.com and their duration is available in our Cookie Policy.

14. Social media

Matzau Erhvervspsykologer and Majken Lorelei Matzau maintain a presence on platforms including:

• LinkedIn
• Facebook
• Instagram
• YouTube
• Spotify.

If you interact with us through social media, for example by following our profiles, commenting on content, or sending us a message, we may process the information you make available in that context.

The individual platforms also process personal data under their own privacy policies and may in some cases act as independent or joint data controllers for their processing.

15. Systems, suppliers and other recipients

We use external suppliers and service providers for areas including communication, scheduling, accounting, newsletters, website operation, hosting, analytics and contact forms.

These include:

• Google Workspace / Gmail
• Google Calendar
• RMail
• e-conomic
• Mailchimp
• Google Analytics
• Resend, for processing and delivering contact form submissions
• Vercel
• Simply.com
• our external bookkeeper and auditor
• our website development and IT suppliers.

Access to personal data is limited to employees, advisers, collaborators and suppliers who have a relevant work-related need for access.

Where a supplier processes personal data on our behalf, we enter into the required data processing arrangements.

Some recipients may process personal data as independent or joint data controllers, depending on the nature of the processing.

16. Transfers outside the EU/EEA

Some of our suppliers are international companies, and personal data may therefore in some cases be processed in, or made accessible from, countries outside the EU/EEA, including the United States.

Where personal data is transferred outside the EU/EEA, the transfer takes place on a valid transfer basis under applicable data protection law, for example:

• an adequacy decision from the European Commission
• the European Commission’s Standard Contractual Clauses
• another valid legal transfer mechanism.

We also work with clients outside the EU/EEA, including in the United States, and may communicate with them as part of a client or treatment relationship.

17. How long do we retain personal data?

We do not retain personal data longer than necessary unless we are required or otherwise lawfully entitled to retain it for a longer period.

Inquiries that do not lead to a client relationship

Personal data from inquiries by phone, email, or contact form that do not lead to a client or customer relationship is retained for a maximum of one year and is then deleted.

Information submitted through the website’s contact form is also stored by Resend for 30 days as described in section 8.

General client and customer information

Administrative personal data and correspondence relating to a client or customer relationship is generally retained for a maximum of five years after the relationship ends, unless there is a specific and lawful reason for longer retention.

Information relating to psychological treatment

Information that is subject to specific statutory retention requirements is retained for the period required by applicable law. It is then deleted unless there is another lawful basis for continued retention.

Invoices and accounting

Accounting records are retained for the period required by Danish bookkeeping legislation.

Newsletter

Information about active subscribers is processed for as long as the person remains subscribed.

After unsubscribing, necessary documentation of the previous marketing consent may be retained for up to two years after the consent was last used, unless another lawful basis applies.

Cookie consent

Information about your cookie preferences may be stored for up to 12 months, after which you may be asked to make a new choice.

Legal claims

Personal data may in specific cases be retained for longer where necessary for the establishment, exercise, or defence of legal claims.

18. Legal basis for processing

Depending on the purpose, we process general personal data on the basis of, among other provisions:

• GDPR Article 6(1)(b), where processing is necessary to enter into or perform a contract with you
• GDPR Article 6(1)(c), where processing is necessary to comply with a legal obligation
• GDPR Article 6(1)(f), where processing is necessary for our legitimate interests, such as general administration and business operations
• GDPR Article 6(1)(a), where processing is based on your consent, for example newsletters and non-essential cookies.

For the processing of health data in connection with healthcare services, the relevant basis under GDPR Article 9 also applies, including Article 9(2)(h) where the conditions are met.

Other legal bases may apply in specific circumstances, for example explicit consent or processing that is necessary for the establishment, exercise, or defence of legal claims.

Danish CPR numbers are processed in accordance with section 11 of the Danish Data Protection Act.

19. Security

We apply appropriate technical and organisational security measures to protect personal data against loss, misuse, unauthorised access and other unlawful processing.

This includes access restrictions and two-factor authentication on relevant systems.

CPR numbers, health data and other information requiring particular protection are handled using appropriate security measures.

20. Your rights

Under data protection law, you have a number of rights.

Depending on the circumstances, you may have the right to:

• access the personal data we process about you
• have inaccurate data corrected
• have personal data erased
• restrict processing
• object to processing
• data portability
• withdraw consent.

These rights are not absolute. For example, we may be required by other legislation to retain certain information.

To exercise your rights, please contact:
Majken Lorelei Matzau
info@loreleimatzau.com

21. Automated decision-making

We do not use automated decision-making based solely on automated processing that produces legal effects or similarly significantly affects you.

22. Complaints

If you are dissatisfied with our processing of your personal data, you are welcome to contact us.

You also have the right to lodge a complaint with the Danish Data Protection Agency:

Datatilsynet
Carl Jacobsens Vej 35
2500 Valby
Denmark
www.datatilsynet.dk

If you are located in another EU/EEA country, you may also have the right to contact the competent supervisory authority in your country of residence.

23. Changes to this Privacy Policy

We may update this Privacy Policy if our processing of personal data changes or if changes in applicable law make an update necessary.

The current version will always be available at loreleimatzau.com.