Privacy Policy
Presence Flow, operating under the brand name Eliana Mallachi
Last updated: 27 October 2026
When you visit elianamallachi.com, book a session, buy a product or work with us, we receive personal data about you. This privacy policy explains what data we collect, why, on what legal basis, how long we keep it, who we share it with and what rights you have. If anything is unclear, contact us at eliana@elianamallachi.com.
1. Who is responsible for your data
Presence Flow is the controller for the processing of your personal data described in this policy.
Presence Flow
Zeezwaluwstraat 223, 2583 RN The Hague, the Netherlands
Chamber of Commerce number: 96295694
Email: eliana@elianamallachi.com
Presence Flow has not appointed a Data Protection Officer, as this is not required for our organisation. You can contact us directly with any privacy question.
2. When this policy applies
This policy applies to all personal data we process through our website elianamallachi.com, our booking and payment pages, email and other messages, and the services and digital products we provide.
3. Whose data we process
- visitors to our website
- prospective clients who contact us or book a call
- clients, both consumers and business clients, and contact persons at business clients
- people whose data a business client provides to us for an AI project (see section 15)
4. How we get your data
We receive your data directly from you when you:
- visit our website
- book a session or fill in a form
- buy a service or digital product and pay for it
- create an account to access a digital product
- contact us by email, phone, message or video call
- share information during a session
- provide data to us as a business client for an AI project
5. What data we process
- Contact details: name, email address, phone number and time zone
- Business details: company name, Chamber of Commerce number, VAT number and billing address
- Payment details: payment method, transactions and payment plan. Card details are handled by our payment provider; we do not store them.
- Booking details: dates and times of sessions
- Communication: the content of emails and messages
- Session data: coaching session notes, and call recordings and transcripts (see section 7)
- Information about your health or wellbeing that you choose to share during coaching and healing sessions (see section 6)
- Client data for AI projects: data a business client provides for building workflows or tools
- Testimonials and reviews, only with your permission
- Technical data: IP address, functional cookie data and website usage data
6. Sensitive information shared during coaching and healing sessions
During coaching and healing sessions, you may share information about your physical or mental health or your wellbeing. Under the GDPR, this is a special category of personal data. We only process this information with your explicit consent, which we ask for before your first session.
- You decide what you share.
- We only use this information to provide your sessions.
- We do not enter it into AI tools without your separate, explicit consent.
- You can withdraw your consent at any time. This does not affect processing that took place before you withdrew it.
7. What we use your data for and on what legal basis
| Purpose | Legal basis |
|---|---|
| Providing sessions, digital products and AI projects, and scheduling appointments | Performance of the agreement |
| Processing payments and payment plans | Performance of the agreement |
| Communicating with you about your booking, order or project | Performance of the agreement |
| Processing health information shared during coaching and healing sessions | Your explicit consent |
| Recording and transcribing calls, to review conversations and improve our services | Legitimate interest for discovery and sales calls; your explicit consent for coaching and healing sessions. You can object to recording at any time. |
| Publishing testimonials and reviews | Your consent |
| Sending a newsletter or marketing emails | Your consent. For existing clients, information about similar services is sent on the basis of our legitimate interest, always with the option to unsubscribe. |
| Securing and operating our website | Legitimate interest |
| Collecting unpaid invoices and handling disputes | Legitimate interest |
| Keeping financial records for the tax authorities | Legal obligation |
We do not use automated decision-making or profiling.
8. How long we keep your data
| Data | Retention period |
|---|---|
| Invoices, payment details and other financial records | 7 years (statutory retention duty) |
| Contact, booking and client details | Duration of the agreement, plus 2 years |
| Coaching session notes and health information | Up to 2 years after the last session, or until you withdraw your consent |
| Call recordings and transcripts | Up to 3 months if we do not start working together; otherwise up to 12 months |
| Client data for AI projects | Deleted or returned at the end of the project, unless agreed otherwise |
| Enquiries that do not lead to an agreement | 1 year |
| Newsletter subscription | Until you unsubscribe |
| Testimonials | Until you withdraw your permission |
We may keep data longer if needed to handle a complaint or legal dispute.
9. Who we share your data with
We do not sell your personal data and do not share it with third parties for their own marketing. We only share data where needed for the purposes above, with:
- Service providers that process data on our behalf, including providers for our website, booking and client management (GoHighLevel), email and file storage (Google Workspace), website security (Cloudflare), payments, video calls and call recording, and AI tools used in AI projects. We have data processing agreements with these providers.
- Our accountant or bookkeeper, for our financial administration
- The Dutch Tax Administration, when we are legally required to
- A debt collection agency or lawyer, only if an invoice remains unpaid or a dispute arises
10. Where we store your data
Some of our service providers are based in the United States or process data there. In those cases, we only transfer data on the basis of the EU-US Data Privacy Framework or the European Commission’s standard contractual clauses, so that your data receives a level of protection comparable to that in the EU.
We also work remotely, sometimes from outside the European Economic Area. In that case, we access your data only through secured accounts and do not store it locally on unsecured devices.
11. How we protect your data
We take appropriate technical and organisational measures to protect your data, including two-factor authentication on our accounts, secured connections, and access limited to what is necessary. No system is completely secure. If a data breach occurs that poses a risk to you, we will report it to the Dutch Data Protection Authority within 72 hours and inform you where required.
12. Your rights
You have the right to:
- access the personal data we hold about you
- correct data that is incorrect or incomplete
- have your data deleted, unless we are legally required to keep it, such as financial records for 7 years
- restrict the processing of your data
- object to processing based on our legitimate interest, and to direct marketing at any time
- data portability: receive your data in a common digital format or have it sent to another organisation
- withdraw your consent at any time, without affecting processing that took place before
- file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl). We would appreciate the chance to resolve your concern first.
13. How to make a request
Send your request to eliana@elianamallachi.com. We respond within one month. For complex or multiple requests, this period may be extended by up to two further months; we will let you know within the first month. We may ask you to verify your identity, so that we do not disclose your data to someone else.
14. Cookies
A cookie is a small text file stored on your device when you visit a website. Our website only uses functional cookies that are necessary for the website to work and to protect it, such as security cookies from Cloudflare and a session cookie. These cookies do not require your consent.
We do not use analytics, tracking or advertising cookies. If we start using them, we will ask for your consent first and update this policy.
15. Data we process for business clients in AI projects
When we build AI workflows or tools for a business client using data about that client’s own customers or contacts, we process that data on behalf of the client. In that case, the business client is the controller and we are the processor. We process that data only according to the client’s instructions and under a data processing agreement.
16. Minors
Our services are intended for adults. We do not knowingly collect personal data from anyone under 16. If you believe we have received data from a minor without consent from a parent or guardian, please contact us and we will delete it.
17. Changes to this policy
We may update this privacy policy. The date at the top shows when it was last changed. If we make significant changes, we will inform our clients.
18. Applicable rules
This privacy policy is based on the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Dutch GDPR Implementation Act (Uitvoeringswet AVG).
See also my Terms & Conditions.