Privacy & Data Policy

Who we are

Guidanceforge (“we”, “us”) is the data controller responsible for your personal data. Guidanceforge is a sole-trader business, operated by Daniel and based in Malta. We provide career coaching services in Malta and online worldwide. Our address is Tumbarellu, Ħal Għaxaq GXQ1210, Malta. For any privacy question, or to exercise your rights, contact info@guidanceforge.com.

What we collect

• When you book a session: your name, email address, optional phone number, chosen service and time, and any notes you add.
• When you request the free checklist: your email address.
• When you contact us by email, phone, or WhatsApp: whatever you choose to share.
• Automatically: a single strictly-necessary cookie to keep you signed in, and privacy-friendly, cookieless analytics (Plausible) that records only aggregate, anonymous usage. No cookies, no personal data, and no cross-site or advertising tracking.

Why we use it, and the legal basis

• To arrange, deliver, and follow up on your coaching sessions (performance of a contract).
• To send you the resource you requested and occasional career tips (your consent, which you can withdraw anytime).
• To respond to your enquiries (your consent when you message us, and our legitimate interest in helping prospective clients).
• To keep the service secure and improve it (legitimate interest).

Payments

Paid sessions are settled by Revolut after the session. We do not take card details on this website and do not store any payment-card information. Any payment data is handled directly by Revolut under its own terms and privacy policy.

Who we share it with

We do not sell your data. We share it only with service providers (“processors”) who help us run Guidanceforge, each acting on our instructions:

• Amazon Web Services (EU, Frankfurt region) for hosting, our database (DynamoDB), sign-in (Cognito), and transactional email (SES).
• Cloudflare, which sits in front of the site to route traffic, provide security, and deliver content through its global network.
• Plausible Analytics for privacy-friendly, cookieless usage statistics.
• Revolut for payment, handled directly by Revolut under its own terms.

Where your data is processed

Your data is stored in the European Union: our database, sign-in, and email run in Amazon Web Services' Frankfurt (eu-central-1) region, and Plausible is EU-hosted. Cloudflare, which routes and secures traffic to the site, operates a global network, so limited processing (for example TLS termination and security filtering at the network edge) may take place outside the European Economic Area. Where that happens it is covered by our processors' data-processing agreements and the European Commission's Standard Contractual Clauses, or an equivalent safeguard. We do not otherwise transfer your personal data outside the EEA.

How long we keep it

• Bookings tied to a paid session:kept for 10 years (the accounting-record period required under Maltese law), then anonymised. We're legally required to keep these for tax and accounting.
• Free discovery-call bookings, enquiries, and marketing contacts with no purchase: kept for up to 24 months from your last contact, then deleted.
• Contact-form and enquiry emails in our mailbox: kept for up to 12 months, then deleted.

You can ask us to delete your data sooner at any time (see Your rights), except where we're legally required to keep certain records. Marketing emails also stop as soon as you unsubscribe.

Your rights

Under the GDPR you can ask us to access, correct, or delete your data, restrict or object to its use, or receive a copy in a portable format, and you can withdraw consent at any time. Email info@guidanceforge.com and we will respond within one month. You also have the right to complain to the Maltese Information and Data Protection Commissioner (IDPC).

Automated decision-making

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects on you.

Cookies & analytics

We use exactly one cookie, gf_session, a strictly-necessary cookie that keeps you signed in to your account. It holds only a signed session token (no personal data in the cookie itself), is HttpOnly and Secure, and expires after 14 days or when you sign out. Because it's essential to a service you've asked for, ePrivacy rules don't require consent for it.

Cloudflare, our security and delivery network, may set its own strictly-necessary cookies (for example to identify trusted traffic or mitigate attacks). These are operational security cookies with no marketing use, and are exempt from consent on the same basis.

For analytics we use Plausible, a privacy-friendly, cookieless tool that measures aggregate traffic (pages, referrers, rough location) without cookies, without collecting personal data, and without cross-site or advertising tracking. Because we set no non-essential cookies and run no advertising trackers, no cookie-consent banner is required. You can block cookies in your browser, though you won't be able to sign in.

Changes

We may update this policy as the service evolves; material changes will be reflected here.

Last updated: July 2026.

← Back to booking