Privacy Policy
How She Starts Over handles your personal data
Version 1.4 · Last updated 16 October 2026
1. Who is responsible for your data
The controller of your personal data is:
| Controller | Urte Pocs, sole trader (eenmanszaak) |
| Trading as | She Starts Over |
| Business address | Piet Mondriaansingel 91, 1112 WX Diemen, the Netherlands |
| Chamber of Commerce (KvK) | 93444028 |
| Email for privacy questions | urte@shestartsover.com |
| Website | https://www.shestartsover.co |
We are a small business and we are not required to appoint a Data Protection Officer. Urte Pocs handles privacy questions personally.
This policy explains what we do with personal data when you visit our website, apply to join, become a member, attend an event, or contact us. It applies alongside our Terms & Conditions.
2. What we collect, why, and on what legal basis
| What we collect | Why we use it | Legal basis |
|---|---|---|
| Name, email address, and the answers you give on our application form | To assess your application and get in touch about joining | Steps taken at your request before entering a contract (Art. 6(1)(b) GDPR) |
| Name, email address, membership type, start date, payment history | To give you access to the community, take payment, and keep your membership running | Performance of our contract with you (Art. 6(1)(b) GDPR) |
| Invoices, payment records and VAT data | To meet our bookkeeping and tax obligations | Legal obligation (Art. 6(1)(c) GDPR) |
| Your profile, posts, comments, messages and anything else you share inside the community | To operate the community and let members interact | Performance of our contract with you (Art. 6(1)(b) GDPR) |
| Booking details when you book a discovery call with us | To hold the call and follow up | Steps taken at your request before entering a contract (Art. 6(1)(b) GDPR) |
| Name and ticket details when you book an event | To run the event and admit you | Performance of our contract with you (Art. 6(1)(b) GDPR) |
| Email address for our newsletter and community updates | To send you news, invitations and offers | Your consent, or our legitimate interest in emailing existing members about similar services (Art. 6(1)(a) or 6(1)(f) GDPR) |
| Recordings of online sessions, and photos or video at in-person events | To create summaries, share sessions with members who could not attend, and, where we say so, to promote the community | Your consent (Art. 6(1)(a) GDPR) |
| Notes we keep about your membership, such as what you asked for or agreed with us | To administer your membership and give you a better experience | Our legitimate interest in running the membership properly (Art. 6(1)(f) GDPR) |
| Anonymous, aggregated website statistics: pages viewed, country, referring site, device type | To understand how the website is used and improve it | Our legitimate interest in improving the website (Art. 6(1)(f) GDPR) |
| Emails and messages you send us | To answer you and keep a record | Our legitimate interest in handling correspondence (Art. 6(1)(f) GDPR) |
We do not ask for special categories of data, such as health or beliefs. Members sometimes share sensitive personal circumstances inside the community, but they do so of their own choice and we do not collect or index it.
We use an AI assistant, Claude, made by Anthropic, to help us write and summarise, for example to tidy a note, draft a message or summarise a session. We give it only what the task needs and we never give it special categories of data. A person reads and decides everything. It does not make decisions about you.
Providing your name, email and payment details is necessary to become a member. Without them we cannot give you access. Everything else is optional.
3. Cookies and website tracking
Our website does not use tracking cookies and does not show a cookie banner, because it does not need one.
- Analytics. We use Umami, a privacy-focused analytics tool that does not use cookies, does not store anything on your device, and does not collect data that identifies you personally. It records page views and coarse information such as country, browser and referring site, in aggregate.
- Fonts. The fonts on our website are hosted on our own servers, so loading a page does not send your IP address to any font provider.
- Links to other sites. Our website links to services such as LinkedIn, Eventbrite, Typeform, Calendly and Heartbeat. Once you follow a link, that service’s own privacy policy applies, not ours.
Heartbeat, the platform hosting the community, does use cookies that are necessary for you to stay logged in. Heartbeat’s own privacy policy applies to your use of the platform.
4. Who we share your data with
We do not sell your personal data, and we do not share it with anyone for their own marketing purposes.
We use a small number of service providers who process personal data on our behalf, under their data processing terms. They may only act on our instructions.
| Provider | What it is used for |
|---|---|
| Heartbeat Chat, Inc. | Hosting the community, member accounts, discussions |
| Stripe | Processing membership payments |
| Brevo | Sending email to members and subscribers |
| Typeform | Our application and interest forms |
| Calendly | Booking discovery calls |
| Eventbrite | Ticketing for in-person events |
| Umami | Website analytics |
| Vercel | Hosting the website |
| Supabase | Our internal member administration tool |
| Anthropic | An AI assistant that helps us write and summarise notes, messages and posts, and where our private planning workspace is stored |
| Storing our working documents and calendar (Google Drive and Calendar) |
Several of these providers are based in, or process data in, the United States.
We may also share personal data with our accountant, and with a lawyer or authority where we are legally required to do so, or where it is necessary to establish or defend a legal claim.
Other members can see what you choose to share inside the community, including your profile and your posts. Our Terms & Conditions require members to treat what is shared inside the community as confidential, but we cannot control what another member does, so please share thoughtfully.
5. Transfers outside the European Economic Area
Some of the providers above are based in the United States or may process data there. When personal data leaves the European Economic Area, we rely on one or both of these safeguards:
- the provider’s certification under the EU-US Data Privacy Framework; or
- the European Commission’s standard contractual clauses, together with additional measures where needed.
You can ask us for a copy of the safeguard that applies to a particular provider by emailing urte@shestartsover.com.
6. How long we keep your data
| Data | How long we keep it |
|---|---|
| Invoices, payment and VAT records | 7 years, as Dutch tax law requires |
| Member account and membership records | For as long as you are a member, and up to 12 months after your membership ends |
| Your posts and contributions inside the community | Until you delete them, or until your account is removed |
| Applications that do not lead to membership | 6 months, then deleted |
| Newsletter subscription | Until you unsubscribe, and we keep a record of the unsubscribe so we do not email you again |
| Recordings of online sessions | Up to 12 months, unless we agree otherwise with the people in them. You can ask for your part to be removed sooner |
| Correspondence with us | Up to 12 months after the matter is closed |
When a retention period ends we delete the data or anonymise it so that it can no longer be linked to you.
7. Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you, and receive a copy;
- Rectification, meaning correction of anything inaccurate or incomplete;
- Erasure, meaning deletion of your data where there is no good reason for us to keep it;
- Restriction of processing in certain circumstances;
- Data portability, meaning a copy of the data you gave us in a common machine-readable format;
- Object to processing based on our legitimate interests, and to object at any time to direct marketing;
- Withdraw consent at any time where we rely on consent, without affecting anything done before you withdrew it;
- Not be subject to automated decision-making. We do not make any decision about you by automated means, and we do not profile you.
To exercise any of these rights, email urte@shestartsover.com. We will respond within one month. If your request is complex we may extend that by two further months, and we will tell you if that happens. Exercising your rights is free, and we will only charge or refuse where a request is clearly unfounded or excessive.
We may ask you to confirm your identity before we act, so that we do not give your data to someone else.
8. Complaints
If you are unhappy with how we handle your personal data, please tell us first at urte@shestartsover.com so that we can put it right.
You also have the right to complain to the Dutch Data Protection Authority:
Autoriteit Persoonsgegevens Postbus 93374, 2509 AJ Den Haag, the Netherlands autoriteitpersoonsgegevens.nl
If you live in another EU country, you may complain to the supervisory authority there instead.
9. How we protect your data
We take reasonable technical and organisational measures to protect your personal data, including:
- Access to member data limited to the people who need it to run the membership;
- Encrypted connections for the website, the community and our internal tools;
- Payment card details handled entirely by Stripe, so that we never see or store them;
- Service providers that process personal data on our behalf only under their data processing terms, as listed in section 4.
No online service can be completely secure. If a data breach occurs that is likely to create a risk to you, we will report it to the Dutch Data Protection Authority within 72 hours and, where the risk is high, tell you directly.
10. Children
She Starts Over is for adults. Our services are not intended for anyone under 18, and we do not knowingly collect data about children. If you believe a child has given us personal data, email us and we will delete it.
11. Changes to this policy
We may update this Privacy Policy when our services or our legal obligations change. The current version is always available on our website and carries a date, so you can see when it last changed.
If a change materially affects how we use your personal data, we will tell you by email before it takes effect.
She Starts Over is operated by Urte Pocs, sole trader, Diemen, the Netherlands. KvK 93444028. A PDF copy of this document is available on request at urte@shestartsover.com.