Privacy Policy – ThinkZoe
Last updated: 12 October 2026
We care about protecting your personal data. This policy explains what personal data we collect when you visit www.thinkzoe.com, sign up for free resources, take a test or join a ThinkZoe program; why we collect it; who we share it with; and what rights you have.
1. Data controller
JAK, Jaka Oman s.p., Srednje Bitnje 55, 4209 Žabnica, Slovenia
- Company registration number: 6771807000
- VAT ID: SI34006907
- Email: jaka@thinkzoe.com
- Phone: +386 31 346 939
- Brand and website: ThinkZoe, www.thinkzoe.com
We are not required to appoint a Data Protection Officer. For any question about your personal data, write to jaka@thinkzoe.com.
2. What data we collect, why, and how long we keep it
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Free resources and newsletter | first name, email, date, time and IP address of sign-up, interest tags, email open and click data | consent (Art. 6(1)(a)) | until you unsubscribe; proof of consent for a further [2 years] |
| Flow Test | the activity you describe and its category (optional), your ratings of 18 statements, how often you experience flow (%), calculated scores; first name (optional) and email (required); language, time of submission and time the report was sent. The PDF report is emailed to you, and a copy goes to our inbox | sending the report you request (Art. 6(1)(b)) | [TO FILL IN: retention period – results are currently not deleted automatically] |
| Potential Test | your estimate of your untapped potential (%), type of work and working hours, your answers, calculated index, scores and profile; first name (optional) and email (required); your consent to receive the report and ThinkZoe content (checkboxes); language, time of submission and time the report was sent. The PDF report is emailed to you, and a copy goes to our inbox | consent (Art. 6(1)(a)) | until consent is withdrawn |
| Communication and booking a call (email, WhatsApp, Calendly, Google Meet) | name, email, phone, message content, call time | pre-contractual steps (Art. 6(1)(b)) or legitimate interest in answering enquiries (Art. 6(1)(f)) | [2 years] after last contact |
| Taking part in the ThinkZoe Flow Program | name, email, phone, billing details, Flow Index results (before/after), comments, notes and answers from 1:1 sessions, program progress; for the online program: user account (email, name, encrypted password, account creation and last sign-in time), completed lessons with completion time, and copies of emails we send you (login details, certificate) | performance of a contract (Art. 6(1)(b)) | program duration + [2 years] |
| Invoices and payments (Stripe, once introduced) | name, address, email, amount, date, payment method, last 4 card digits (we never receive the full card number) | performance of a contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) | invoices and accounting records: 10 years after the end of the year of issue (Slovenian VAT Act) |
| Website analytics (Google Analytics) | truncated IP address, random device identifier, pages visited, traffic source, device and browser type, events (e.g. test started) | consent (Art. 6(1)(a) GDPR and Slovenian Electronic Communications Act, ZEKom-2) | [14 months] |
| Website security and operation | IP address, browser, request time (server logs at Railway) | legitimate interest in security (Art. 6(1)(f)) | [TO FILL IN: log retention period at Railway] |
We do not intentionally collect special categories of personal data (e.g. health data). Please avoid sharing such data in tests, comments or sessions unless necessary.
3. Who we share data with
We do not sell your data. We share it only with service providers (processors) who help us run the website and our programs, and only to the extent they need. We have data processing agreements in place with all of them.
| Provider | Purpose | Location and transfer safeguards |
|---|---|---|
| Mailchimp (The Rocket Science Group LLC, Intuit Inc.) | sending free resources and newsletters; managing the subscriber list | USA; EU-U.S. Data Privacy Framework (DPF) and Standard Contractual Clauses |
| Google Ireland Ltd. / Google LLC | Google Analytics – website analytics | EU and USA; DPF and Standard Contractual Clauses |
| Railway Corporation | hosting of the website and of the PostgreSQL database (test results, online program accounts and progress) | USA; data location: [TO FILL IN: database region – Railway offers Amsterdam (NL), California, Virginia or Singapore]; Standard Contractual Clauses [TO FILL IN: confirm that a data processing agreement (DPA) with Railway is in place] |
| [TO FILL IN: email provider – Mailgun, Resend or SMTP] | sending test reports (PDF) and online program emails (login details, certificate) | [TO FILL IN: location and transfer safeguards] |
| Google Ireland Ltd. / Google LLC | Google Workspace – email inbox jaka@thinkzoe.com (incl. copies of test reports) | EU and USA; DPF and Standard Contractual Clauses |
| Google Ireland Ltd. / Google LLC | Google Meet – video calls (1:1 and group sessions) | EU and USA; DPF and Standard Contractual Clauses |
| Calendly LLC | scheduling calls and sessions | USA; DPF and Standard Contractual Clauses |
| WhatsApp Ireland Ltd. (Meta) | calls, messages and the program community | EU and USA; DPF and Standard Contractual Clauses |
| Stripe Payments Europe Ltd. (once introduced) | payment processing | Ireland (EU), with possible transfer to the USA; DPF and Standard Contractual Clauses |
| Uroš Šparovec s.p. (accounting service) | bookkeeping | Slovenia |
WhatsApp, Google Meet and Calendly: we use WhatsApp and Google Meet for calls and sessions, and Calendly for scheduling. When you book a slot, Calendly processes your name, email, chosen time and any answers you give in the booking form. We do not record calls without your explicit consent. Program participants may choose to join a WhatsApp group; your phone number is then visible to other group members. These providers also process data under their own privacy policies.
We may also disclose data to competent public authorities where required by law.
4. Transfers outside the EU
Some of our providers (Mailchimp, Google, Calendly, WhatsApp/Meta, Stripe) also process data in the USA. These transfers rely on the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework, under which these providers are certified, or on the European Commission's Standard Contractual Clauses.
Our website and database are hosted by Railway Corporation (USA). Any transfer of data outside the EU to Railway relies on the European Commission's Standard Contractual Clauses and a data processing agreement with Railway. [TO FILL IN: confirm the DPA with Railway and the database region]
5. Newsletter and free resources
- Signing up is voluntary and requires ticking the consent box.
- Every email contains an unsubscribe link. You can also unsubscribe by writing to jaka@thinkzoe.com.
- Mailchimp uses small tracking images and link tracking to record whether an email was opened and which links were clicked. We use this to improve our content. You can prevent this by turning off automatic image loading in your email app.
6. Your rights
Regarding your personal data, you have the right to:
- access – a copy of the data we hold about you,
- rectification of inaccurate data,
- erasure (“right to be forgotten”),
- restriction of processing,
- data portability,
- object to processing based on legitimate interest, and at any time to processing for direct marketing,
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
Send your request to jaka@thinkzoe.com. We will reply within one month at the latest. If you believe we are breaching data protection law, you can lodge a complaint with the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si, www.ip-rs.si, or with the supervisory authority in your EU country of residence.
7. Automated decision-making
Flow Test and Potential Test results are calculated automatically and are meant for your own reflection. We do not make decisions based on them that have legal or similarly significant effects on you.
8. Security
We use appropriate technical and organisational measures: encrypted connections (HTTPS), access to data limited to the controller, strong passwords and two-factor authentication on all tools, and carefully selected providers.
9. Children
Our services are not intended for anyone under 15, and we do not knowingly collect their personal data.
10. Changes to this policy
We may update this policy from time to time. The current version is always published on this page with its last-updated date. We will notify subscribers of significant changes by email.