This Privacy Notice explains how Johanna Farrimond, operating as a sole trader (Empresário em Nome Individual) in Portugal ("Practitioner", "I"), collects, processes and protects personal data through the written advisory service The Single Issue.
Data Controller: Johanna Farrimond (Empresário em Nome Individual)
Establishment: Rua Homens do Andor N2A, Loulé, Algarve 8100670, Portugal
Tax Identification (NIF): 298485427
Contact & Privacy queries (DSARs): privacy@johannafarrimond.com
Supervisory Authority: Comissão Nacional de Proteção de Dados (CNPD), Portugal
The Single Issue provides a written advisory brief analysing workplace relationship dynamics based solely on client-observed accounts.
Scope limitation. The Service evaluates working partnerships and professional interactions only. Where the counterpart is a family member or relative, the scope of the Service is strictly limited to the commercial or business partnership between the parties. Non-commercial family, marital, domestic, or estate disputes are strictly out of scope and will be declined.
Mandatory third-party pseudonymisation. Clients must use generic aliases (for example "Person A", "Peer X") and role titles in all intake forms and communications. Clients must never submit real names, personal contact details, or private background information regarding third parties.
Special category data prohibition. Clients must not submit special category data under Art. 9 GDPR (health or medical information, trade union membership, political opinions, religious beliefs). Any unsolicited special category data embedded in an intake submission is purged immediately upon initial review.
Unrecorded sessions guarantee. Live consultation sessions are not recorded by the Practitioner or the video platform, and recording by any party is strictly prohibited under the Terms of Service. The engagement is conducted via an ephemeral video stream.
No legal privilege. The Practitioner is not a lawyer. What the Client sends and what the Practitioner sends, including the Client’s written account and the Written Advisory Brief, is not protected by legal privilege and could be demanded in a dispute.
| Processing activity | Data categories processed | Lawful basis |
|---|---|---|
| Intake and case evaluation | Client name, email, alias-based interaction accounts | Art. 6(1)(b) GDPR, performance of a contract and pre-contractual steps |
| Live consultation session | Participant name, email, unrecorded live video stream, connection metadata | Art. 6(1)(b) GDPR, performance of a contract |
| Billing and invoicing | Client name, tax identification number (NIF), billing address, payment confirmation ID. Credit and debit card details are processed directly by Stripe and never enter my systems | Art. 6(1)(c) GDPR, legal obligation under Portuguese tax law (Código do IVA) |
| Third-party analysis | Alias-based workplace accounts provided by the client | Art. 6(1)(f) GDPR, legitimate interests of Practitioner and Client in conducting confidential workplace analysis |
| Second reads and legal archive | Final written briefs, graded appendices, decision notes | Art. 6(1)(f) GDPR, legitimate interests in managing second reads, dispute resolution and defence against claims |
I do not contact, interview or notify third-party counterparts referenced in client accounts. Pursuant to Article 14(5)(b) GDPR, individual notification is exempt because:
I share necessary personal data with third-party service providers acting as data processors under Article 28 GDPR.
Hostinger International Ltd (Lithuania, EU), website hosting and intake form submission infrastructure. All intake data remains within the European Economic Area.
MICCI (Denmark, EU), trading as PostStack, transactional email delivery of intake form submissions. Case content is processed and stored within the European Economic Area.
Hetzner Online GmbH (Germany, EU), infrastructure sub-processor engaged by MICCI, hosting application servers, databases, storage, mail relay, backups and logging in Helsinki, Finland. No intake data leaves the European Economic Area.
Google Ireland Limited (Ireland, EU), email communications, with Google LLC (USA) acting as sub-processor. International transfers to Google LLC in the US are safeguarded under Article 45 GDPR via Google's active certification under the EU-U.S. Data Privacy Framework.
Zoom Communications, Inc. (USA), facilitation of live, unrecorded consultation sessions. Connection metadata transfers to the US are safeguarded under Article 45 GDPR via Zoom's active certification under the EU-U.S. Data Privacy Framework.
TidyCal / Sumo Group Inc. (USA), consultation appointment scheduling. International transfers of scheduling metadata (name, email, appointment time) to the US are safeguarded under Article 46(2)(c) GDPR via standard contractual clauses.
Stripe Payments Europe, Ltd. (Ireland, EEA), payment processing and invoicing. Credit and debit card details are collected directly by Stripe. Transfers to parent entity Stripe, Inc. (USA) are safeguarded under Article 45 GDPR via Stripe's active certification under the EU-U.S. Data Privacy Framework.
Declined pre-payment case files. Non-sensitive administrative decline records are retained for 30 days post-decision, then deleted. Any unsolicited Art. 9 special category data within intake files is purged immediately upon review.
Abandonment prior to contract. If the account has not arrived within 30 days of the call, or payment has not followed within 30 days of the account, the case closes automatically and all submitted materials are permanently deleted.
Intake screening declines. Information submitted via the preliminary screening questions by individuals who do not proceed to an engagement is retained for 30 calendar days post-decision solely to confirm decline decisions, after which it is erased.
Intake forms and interaction accounts. Source interaction accounts and intake data are retained in encrypted local storage for the duration of the agreed observation window (including any applicable new window period), plus the 30-day claim window, plus a 15-day administrative buffer. In no event is data retained longer than 200 calendar days from the date of the video session, after which it is permanently erased.
Session video and audio stream. 0 days. Live stream only, with no recording or cloud storage.
Written advisory briefs and graded appendices. Retained in encrypted local storage for 3 years post-delivery under Art. 6(1)(f) GDPR for dispute resolution and legal defence, then permanently destroyed.
Tax and billing records. Retained for 10 years as required by Portuguese tax law (Art. 123.º CIVA).
You have the right under Arts. 15–22 GDPR to request access to, rectification of, or erasure of your personal data, and to restrict or object to processing.
Exercising rights: privacy@johannafarrimond.com
Third-party access requests. Access requests submitted by third parties will be restricted or redacted where granting access would adversely affect the rights, freedoms and confidential communications of the Client, pursuant to Art. 15(4) GDPR.
Right to lodge a complaint. You have the right to lodge a complaint directly with the Portuguese supervisory authority regarding the processing of your personal data:
Comissão Nacional de Proteção de Dados (CNPD)
Av. D. Carlos I, 134 – 1.º, 1200-651 Lisboa, Portugal
www.cnpd.pt
Supervisory authority
Comissão Nacional de Proteção de Dados (CNPD)
Av. D. Carlos I, 134 – 1.º, 1200-651 Lisboa, Portugal
www.cnpd.pt