Privacy policy

Who is responsible for your data

The controller of the data collected through this website is:

Ines Rogomentić, medical doctor and psychotherapist [business address or "Dublin, Ireland"] Email for data enquiries: [data@domain]

This website has no telephone number and no social media accounts. The only way to reach me through the site is the contact form.

What data I collect and why

Contact form

When you send me a message through the form, I collect your name, email address and the text of your message. I use them only to reply to you and arrange a first conversation.

Legal basis: steps taken at your request before entering into a contract (Article 6(1)(b) GDPR). If you choose to include information about your health or mental state in your message, that information is special category data and is processed on the basis of your explicit consent (Article 9(2)(a) GDPR), which you give by ticking the box below the form. You can withdraw consent at any time by emailing the address above; this does not affect processing carried out before withdrawal.

After sending, you receive an automatic confirmation at the email address you entered. It contains only your name and a note that I will reply within [two working days]; it does not contain the text of your message.

Protection against misuse of the form

To prevent automated spam, the form uses Cloudflare Turnstile. It processes technical data about your device and connection (IP address, browser information) at the moment of sending. That data does not reach me and is not part of your message.

Legal basis: my legitimate interest in keeping the site and form secure (Article 6(1)(f) GDPR).

Technical data about your visit

The site runs on Cloudflare infrastructure. Like any website, loading a page involves processing your IP address and basic browser data to deliver the page and protect against attacks. For visitor statistics I use Cloudflare Web Analytics, which sets no cookies and does not track individual visitors; I see only aggregate figures (number of visits, country, device type).

Legal basis: my legitimate interest in running the site reliably and knowing whether people find it (Article 6(1)(f) GDPR).

Cookies

The site sets no cookies and uses no tracking tools. That is why there is no cookie banner.

Who else has access to the data

I do not sell or share data for marketing. The following service providers (processors) assist me, under data processing agreements:

• Cloudflare, Inc. – website hosting, delivery of form messages to my email, protection against misuse (Turnstile) and cookieless statistics. Data is processed in the European Union wherever possible; Cloudflare is bound by the EU Standard Contractual Clauses for any transfer outside the EU.
• Resend, Inc. (United States) – sending the automatic confirmation to your email. Resend processes your name and email address, not the content of your message. Data is held on servers in the United States for 30 days, under the EU Standard Contractual Clauses.
• [My email provider, e.g. Google Workspace / Gmail] – your message arrives in my mailbox with this provider.

I may disclose data to authorities only where the law requires it or where there is an immediate risk to someone's life or safety.

How long I keep data

• Contact form messages that do not lead to working together are deleted from my mailbox no later than [six months] after the last exchange.
• If we begin psychotherapy, before the first session you receive a separate information form describing what records I keep during our work, how they are stored and for how long. Clinical records are kept for [seven years] after the end of our work, in line with the guidelines of [IACP – Irish Association for Counselling and Psychotherapy].
• Resend deletes the record of the confirmation email after 30 days. Cloudflare technical logs are kept briefly and in aggregate.

Your rights

You have the right to:

• request access to the data I hold about you and receive a copy,
• request correction of inaccurate data,
• request erasure, except where law or professional rules oblige me to keep the data,
• request restriction of processing or object to processing based on legitimate interest,
• receive the data you gave me in a common electronic format,
• withdraw consent at any time,
• lodge a complaint with a supervisory authority.

Send requests to [data@domain]. I will respond within one month at the latest. To make sure I release data only to the right person, I may ask you to confirm your identity.

Supervisory authority in Ireland: Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland, www.dataprotection.ie

If you are in Serbia

If you contact me from Serbia, the Serbian Law on Personal Data Protection (ZZPL) applies alongside the GDPR. Your rights under the ZZPL correspond to those listed above. Your data is processed in Ireland, a member state of the European Union, which the ZZPL treats as providing an adequate level of protection, so no separate consent is needed for the transfer.

You may also lodge a complaint with the Commissioner for Information of Public Importance and Personal Data Protection, Bulevar kralja Aleksandra 15, 11120 Belgrade, www.poverenik.rs.

Automated decision-making

I make no automated decisions about you and do no profiling.

Minors

The site and contact form are intended for adults. [If you work with people under 18, state the conditions here, e.g. parental or guardian consent.]

Changes to this policy

If I change how I process data, I will update this text and the date and version at the top. The version in force when you sent your message is recorded together with your consent.