- Controller
Controller: Karin Lerch, a self-employed professional established in Switzerland.
Business address: Via alla Chiesa 44, CH-6595 Riazzino
Privacy and rights contact: hello@karinsofree.com
Website: karinsofree.com
Effective date: 18 September 2026
Processing is carried out under the Swiss Federal Act on Data Protection and, where a processing activity falls within its territorial scope, the EU General Data Protection Regulation (GDPR), together with mandatory national privacy and electronic communications rules that apply. For individuals in the United States, applicable federal and state privacy and electronic marketing laws apply where their statutory scope and thresholds are met.
- What data I receive and where it comes from
General contact form on karinsofree.com
If you contact me spontaneously through the general website form, I receive the information you enter, currently your first name, last name, telephone number, email address and message. I use it to identify and respond to your enquiry, continue a conversation you initiated and, where relevant, take pre-contractual steps you request.
Campaign forms on Meta and GetResponse
For advertising campaigns I may use native Meta forms on Facebook and Instagram and forms managed through GetResponse. These forms normally request your name and email and, where the campaign requires it, may offer additional fields such as telephone number or city. The form itself states the purpose and whether each field is required or optional.
If you request a resource or information, I use the data needed to deliver it and respond to the request. Access to the requested resource is not conditional on accepting advertising. Marketing communications are activated only where you expressly choose that option.
Emails, consents and metrics
If you subscribe to my communications, I process your name, email address, sign-up source, date, evidence of consent, subscription status, unsubscribes and technical information needed to deliver messages. GetResponse can record email opens through an invisible pixel where consent has been given for that measurement. GetResponse can also record clicks on links through technical redirects in order to calculate interaction and campaign-performance metrics.
Consent for promotional communications may, with clear information, also cover open measurement. You can withdraw consent to receive marketing at any time and you can also ask me to disable only open measurement while keeping your subscription. To do so, write to hello@karinsofree.com. Click interaction data are used for campaign metrics and are not used to make solely automated decisions that produce legal or similarly significant effects.
Technical data and Meta Pixel
When you visit karinsofree.com, technical logs necessary for operation and security are generated, such as IP address, date, browser and request information. In addition, where you consent to advertising technologies, Meta Pixel is activated. This technology may transmit to Meta device and browser information, the page visited, IP address, technical identifiers and configured interaction events to measure campaigns, attribute conversions and create remarketing audiences.
Meta Customer List Custom Audiences
Where you have given specific consent to personalised advertising on Meta, I may use your email address and, if provided, your telephone number to create Customer List Custom Audiences. Before being sent to Meta, these identifiers are locally transformed using a cryptographic hash function. Hashing does not necessarily make the information anonymous. Meta uses the hashed identifiers for the matching process and, under its terms, deletes the hashed data after matching. You may withdraw this consent at any time; if you do, I will stop using your information for new audiences and apply the appropriate exclusion or removal from active audiences.
- Purposes and legal bases
| Purpose | Main data | Legal basis |
| Replying to enquiries from the general form, email or WhatsApp | Contact details and enquiry content | Legitimate interest in responding to requests initiated by the individual and, where relevant, pre-contractual steps requested by the individual. |
| Delivering requested resources or campaign information | Name, email and the fields shown in the form | The individual’s request; legitimate interest in responding and, where relevant, requested pre-contractual steps. |
| Sending marketing email sequences and newsletters | Name, email, consent status and evidence | Consent. |
| Measuring email opens through a tracking pixel | Contact identifier and open event | Informed consent linked to promotional communications, with granular withdrawal available. |
| Measuring clicks and email interaction | Contact identifier, link and click event | Legitimate interest in evaluating performance and improving communications, without significant automated decisions; you may object. |
| Meta Pixel: measurement, attribution and remarketing | Technical data, identifiers and browsing events | Prior consent to advertising technologies. |
| Meta Customer List Custom Audiences | Email and/or telephone number transformed by hashing | Specific consent to personalised advertising on Meta. |
| Managing consent, unsubscribes, security and claims | Minimum compliance and security records | Legal obligation and legitimate interest in demonstrating compliance, protecting the service and defending claims. |
- Providers and recipients
Baillyweb. Baillyweb provides hosting, technical infrastructure and professional email for karinsofree.com. The hosting location reported for this setup is Spain. Baillyweb may process technical and email data as a provider acting on Karin Lerch’s instructions.
GetResponse. I use GetResponse S.A., Grunwaldzka 413, 80-309 Gdańsk, Poland, to manage campaign forms, contacts, consents, automations, newsletters and email statistics. GetResponse acts as a processor for data handled on my instructions. Depending on the features and subprocessors used, data may be processed in the European Economic Area and in third countries, including Canada and the United States, under the safeguards provided by applicable law and GetResponse’s processing agreements.
Meta. When you use Facebook or Instagram, a native Meta lead form or Meta advertising tools, Meta processes certain information under its own policies and the terms applicable to each tool. For Customer List Custom Audiences involving data subject to the GDPR or originating from Switzerland, Karin Lerch acts as controller and Meta Platforms Ireland Limited acts as processor for the specific audience-creation matching process under Meta’s terms. For other functions, including Meta Pixel and Meta’s own Facebook and Instagram services, the parties’ roles may vary according to the operation and applicable terms.
WhatsApp. If you start a conversation through WhatsApp, the platform processes information under its own terms and privacy policy. The subsequent conversation with me is used to respond to your request. Messaging me on WhatsApp does not by itself authorise WhatsApp campaigns, SMS messages or unsolicited marketing calls.
I may also disclose information where required by law or where necessary for professional advice or the handling and defence of claims, subject to applicable safeguards.
- International transfers
I operate from Switzerland and use providers established in Switzerland, Spain, other EEA countries and third countries. Where an applicable adequacy decision exists, transfers may rely on that decision. Otherwise, standard contractual clauses, processing agreements or other recognised safeguards are used, together with additional measures where required. You may request further information about the safeguards used by contacting hello@karinsofree.com.
- Retention
- General enquiry without a subscription: up to 6 months after the conversation is closed, unless a specific legal obligation or claim requires otherwise.
- Requested resource without a subscription: the operational profile is deleted within 30 days after delivery, unless an enquiry remains open.
- Marketing subscription: until you withdraw consent or 24 months pass without an affirmative action from you, such as a reply, new request or confirmation. A send or estimated open alone does not renew the period.
- Unsubscribe: marketing stops and unnecessary profile data are removed within 30 days. Minimum suppression information is kept separately as needed to prevent further sends.
- Minimum consent and rights-handling evidence: 3 years after unsubscribe or closure, unless a specific obligation or claim requires a different period.
- Server/web technical logs: 7 days.
- Backups: maximum deletion or overwrite cycle of 30 days.
- Customer List Custom Audiences: Meta deletes hashed identifiers after the matching process under its terms; audiences are reviewed and updated when consent is withdrawn.
- Cookie and optional-technology preferences are retained for 12 months unless material processing conditions change or a new choice needs to be requested earlier.
- Your rights and choices
You may request access, correction and deletion and, where recognised by applicable law, restriction, portability or objection. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. You may object to direct marketing at any time.
If you want to keep receiving emails but do not want their opening to be measured by a tracking pixel, you can ask me to disable that specific measurement by writing to hello@karinsofree.com. To stop all marketing communications, use the unsubscribe link included in each email or write to the same address.
Requests are handled within the time limits set by applicable law. You may contact the Swiss Federal Data Protection and Information Commissioner (FDPIC) and, where the GDPR applies, the competent EU supervisory authority, including the Spanish AEPD or the Italian Garante per la protezione dei dati personali.
- Minors
Lead-generation forms and communications about the opportunity to become a RINGANA partner are intended only for people aged 18 or over. I do not intentionally request minors’ data through these forms.
- United States
Commercial emails directed to recipients in the United States include accurate sender identification, a valid physical postal address, contact information and a working unsubscribe mechanism. Although my general lead-generation model uses consent, U.S. obligations can vary by State and by the statutory thresholds that apply.
I do not sell personal information for money. The use of Meta Pixel or advertising audiences may qualify as “sharing”, “targeted advertising” or an equivalent category under certain U.S. state laws where those laws apply. In such cases, applicable opt-out rights will be respected, including a compatible Global Privacy Control signal where the relevant law recognises it.
- Security and changes
I apply reasonable technical and organisational measures to reduce the risk of unauthorised access, loss, alteration or misuse. Providers with access to personal data are selected and managed according to their function and applicable obligations. This policy may be updated when the website, campaigns, providers or law change. Material changes will be communicated appropriately and, where a new use requires consent, consent will be obtained before that processing begins.