1. Controller
The controller responsible for processing personal data within the meaning of Swiss data protection law is:

Mind-Craft
Owner: Nebojsa Pavlovic
Buechbühlstrasse 6a
8956 Killwangen, Switzerland
Email: info@mind-craft.ch
Phone: +41 79 944 21 47

Data protection inquiries can be sent to the contact details above.

2. Subject of this privacy policy
This privacy policy explains which personal data Mind-Craft processes in connection with the website, contact inquiries, bookings and the delivery of mental coaching.

Personal data is any information relating to an identified or identifiable natural person. This can also include sensitive personal data, such as information about physical or mental health.

3. Legal basis and processing principles
Mind-Craft processes personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and the associated Data Protection Ordinance.

In particular, personal data is processed in accordance with the following principles:

• lawfully and in good faith,

• transparently and traceably,

• only for specified and recognisable purposes,

• proportionately and limited to what is necessary,

• accurately, and

• only for as long as is necessary for the respective purpose.
   

4. What personal data we process
Depending on how the website is used and the type of collaboration, Mind-Craft may process the following data in particular:

Contact and master data

• First and last name

• Address

• Date of birth or age

• Phone number

• Email address

• Preferred method of contact and communication
   

Contract and booking data

• Booked services and appointments

• Contents of quotes and agreements

• Invoicing and payment information

• Appointment changes and cancellations

• Information on previous collaboration
   

Coaching data

• Personal goals and starting point

• Information on routines and behaviors

• Professional, private or athletic challenges

• Coaching notes and progress information

• Results of reflections and progress reviews

• Individually agreed activity and training plans

• Also included under coaching data:

 

• Roadmaps, development plans and coaching documentation

• ​Entries from self-monitoring tools, reflections or progress reports

• Information from regular progress reviews and check-ups
   

Health and safety data
Where necessary for the safe delivery of coaching or of physically and mentally demanding activities, the following information in particular may be processed:

• physical or mental limitations

• injuries and relevant pre-existing conditions

• current symptoms

• pregnancy

• relevant medication or treatments

• information on physical capacity

• medical clearances or confirmations of fitness to participate

• emergency contact information

Health data is sensitive personal data and is processed with particular care.

Technical data
When you visit the website, technical information may be collected, for example:

• IP address

• date and time of access

• pages and files accessed

• browser and operating system used

• device type

• referrer URL

• technical error and log data
   

5. Purposes of data processing
Mind-Craft processes personal data in particular for the following purposes:

• handling contact inquiries

• conducting initial consultations

• preparing quotes and agreements

• planning, delivering and documenting coaching

• creating individual activity and training plans

• assessing whether exercises and "grinds" can be carried out safely

• appointment management and communication

• invoicing, accounting and payment processing

• quality assurance and further development of the services

• fulfilling legal and regulatory obligations

• asserting, exercising or defending legal claims

• ensuring the functionality and security of the website

• sending information or advertising, where permitted or where consent has been given
   

As a rule, personal data is not used for purposes that are incompatible with the original purpose for which it was collected.

6. Contacting us
If a person contacts Mind-Craft by email, phone, contact form or via social networks, the information provided is used to process the inquiry and for any follow-up questions.

Communication via unencrypted email or standard messaging apps may involve security risks. Particularly confidential health information should therefore, where possible, be sent via a secure communication channel agreed in advance.

7. Booking and contract processing
When a booking is made, Mind-Craft processes the personal data required to initiate, perform and process the contract.
This includes, in particular, contact, appointment, contract, invoicing and payment data. Without the necessary information, it may not be possible to process a booking or carry out the coaching.

8. Processing of health data
For certain services, in particular mental and resilience training as well as physically or mentally demanding activities, personal health-related data may be required.

Mind-Craft only processes such data insofar as this is necessary to assess the requirements for participation, adapt the activities and ensure the safety of the person concerned.

Where consent is required for processing, it will be obtained explicitly and in relation to the specific purpose of processing. Consent given can generally be withdrawn at any time with effect for the future. The lawfulness of processing already carried out remains unaffected.

Consent under data protection law does not replace a medical assessment or a personal decision about taking part in an activity.

9. Emergency contacts
For certain training sessions, Mind-Craft may collect the contact details of an emergency contact person.

The client is responsible for informing that person that their contact details have been passed on to Mind-Craft.
The data is used exclusively for emergencies and directly related purposes.

10. Website and server logs
When the website is accessed, the hosting provider may automatically collect technical data in server logs.

This processing serves in particular to:

• provide the website,

• ensure its stability and security,

• detect technical errors,

• prevent misuse and attacks, and

• evaluate the use of the website in aggregated form.
   

The website is hosted by WIX. WIX may also process personal data outside Switzerland in the course of providing its services.

11. Cookies and similar technologies
The website may use cookies and similar technologies. Cookies are small files that are stored on your device.
Technically necessary cookies may be used so that the website can be provided securely and function properly. Optional cookies, in particular for statistics, marketing or external media, are only used where this is permitted under data protection law and, where applicable, consent has been given.

Where necessary, the cookie categories used, their purposes and storage periods are explained in the cookie banner or the cookie settings.

Cookies can be restricted or deleted via your browser settings. This may affect certain functions of the website.

12. Web analytics
Mind-Craft uses Google Analytics to evaluate the use of the website and improve its services.
In particular, IP address, device information, browser data, pages visited, time spent on the site and interactions may be processed. Where possible, the data is truncated, pseudonymized or anonymized.

Analysis only takes place to the extent permitted by law and, where required, after consent has been given via the cookie banner.

13. Appointment booking
Mind-Craft uses the Wix Bookings service for online appointment booking.
When a booking is made, the contact, appointment and message data entered are transmitted to the provider. 

Confidential health information should not be entered in a standard comment field of the booking system.


14. Newsletter and electronic advertising
Mind-Craft only sends newsletters, information, offers or other electronic communications if corresponding consent has been given or sending is otherwise legally permitted.
 
For registration and sending, the following may be processed in particular: name, email address, time of registration and technical proof data.
 
Emails are currently sent via Mind-Craft's own email infrastructure. In future, specialized third-party providers may also be used to manage subscriptions, send newsletters or analyze open and click rates. Possible providers include, in particular:

• Mailchimp

• Brevo (formerly Sendinblue)

• MailerLite

• ActiveCampaign

• ConvertKit

• Kit

• comparable newsletter and email marketing services
   

If such services are used, the personal data required for this purpose may be transmitted to the respective provider and processed by it on behalf of Mind-Craft.
 
Consent can be withdrawn at any time via the unsubscribe link in the newsletter or by notifying Mind-Craft.

15. Social networks and external content
Mind-Craft may operate profiles on social networks or embed external content in the website.
When such content is accessed, data may be transmitted to the respective providers. This can happen even if the visitor does not have an account with the provider concerned.
 
The following may be used:

• Instagram / Meta

• LinkedIn

• YouTube / Vimeo

• Google Maps

• Patreon
   

Information on the nature and scope of processing can be found in the privacy policies of the respective providers.
Where necessary, external content is only loaded after consent has been given.

16. Photo, video and audio recordings
If photo, video or audio recordings are made during coaching sessions, training or events, this is generally only done with the consent of the person concerned.
 
Consent given can be withdrawn at any time with effect for the future.
 
The recordings are used exclusively for the agreed purpose.
 

17. Disclosure of personal data to third parties
Mind-Craft may disclose personal data to third parties insofar as this is necessary for the purposes stated, required by law or otherwise permitted.
 
Possible recipients include, in particular:

• hosting and IT service providers

• providers of scheduling, communication or booking systems

• payment service providers and banks

• accounting and fiduciary service providers

• insurance companies

• external trainers or other professionals consulted

• legal and advisory services

• authorities and courts
   

As a rule, external professionals only receive health or coaching data if this is necessary and legally permissible and has been approved by the client. If necessary, explicit consent is obtained in advance.
Service providers may, as a rule, only process personal data to the agreed extent and for the specified purposes.
Mind-Craft does not sell personal data.

Services from Microsoft, in particular Microsoft 365, Outlook, Teams and OneDrive, as well as Miro, may be used for communication, document management, data backup and collaboration. Personal data may be processed or stored as part of the respective service.
 
18. Disclosure abroad
Individual service providers may be located outside Switzerland or process personal data abroad.
If the recipient is located in a country without adequate statutory data protection, Mind-Craft ensures appropriate protection within the scope of the legal requirements. This can be achieved in particular through recognized standard data protection clauses, additional safeguards or a statutory exception.
 
With certain foreign providers, it cannot be ruled out that authorities in the country concerned may gain access to personal data under the laws applicable there.
 
19. Retention period
Mind-Craft only retains personal data for as long as is necessary for the respective processing purposes or as required by statutory retention obligations.
 
The following criteria apply in particular:

• duration of the contractual relationship

• need for coaching documentation

• statutory bookkeeping and retention obligations

• limitation periods

• asserting or defending legal claims

• legitimate interests in security and evidence
   

Data that is no longer required is deleted or anonymized, unless there is a legal or contractual obligation to retain it further.
Health and coaching data is not kept for longer than is necessary for the specific purpose and legitimate evidentiary interests.

20. Data security
Mind-Craft takes appropriate technical and organizational measures to protect personal data against loss, misuse, unauthorized access, alteration and unlawful disclosure.

These measures may include in particular:

• access restrictions

• secure passwords and multi-factor authentication

• encrypted data transmission

• protected storage and backup systems

• regular updates of the systems used

• limiting access to the persons who need it

• secure deletion or destruction of documents
   

However, completely risk-free data transmission or storage cannot be guaranteed.

21. Rights of data subjects
Within the scope of applicable data protection law, data subjects have in particular the right to:

• request information about the personal data processed about them,

• have incorrect or incomplete data corrected,

• request the release or transfer of certain data,

• object to data processing,

• withdraw consent given with effect for the future,

• request deletion or restriction of processing, unless legal obligations or overriding interests prevent this.
   

To exercise these rights, a request can be sent to the contact address given in section 1.
Mind-Craft may request suitable proof of identity. The exercise of certain rights may be restricted or excluded due to statutory exceptions.
Data subjects may also contact the Federal Data Protection and Information Commissioner (FDPIC).
 
22. Automated individual decisions
As a rule, Mind-Craft does not make any exclusively automated decisions that have significant legal or similar effects on a person.
 
Should such procedures be used in future, the persons concerned will be informed in accordance with the legal requirements.
 
23. Changes to this privacy policy
Mind-Craft may amend this privacy policy if its data processing, the services used or the legal requirements change.
 
The version published on the website applies. The date stated at the beginning of the privacy policy indicates when it was last revised.


Zurich, October 2026