Privacy Policy

1. Who We Are

Keto platform and website ("Platform") collects, uses, stores, and protects your personal data.

Deloudi GmbH is incorporated under Swiss law and acts as the data controller for personal data collected through the Platform.

Contact for privacy matters:

info@12stepketo.com

This Policy applies to all users of the Platform, including visitors, email subscribers, paid members, course purchasers, and coaching clients. It covers our website, hosted on Wix, and any associated email communications.

2. Legal Framework

We process personal data in compliance with the Swiss Federal Act on Data Protection (nFADP) and, where applicable to users in the European Economic Area, the EU General Data Protection Regulation (GDPR).

Depending on the context, we rely on the following legal bases for processing:

Contract performance — to fulfil your purchase, provide membership access, or deliver coaching services
Legitimate interests — to operate and improve the Platform, send service-related communications, and maintain security
Consent — for marketing emails and non-essential cookies (where applicable)
Legal obligation — where required by Swiss or applicable EU law

3. What Personal Data We Collect

3.1 Data You Provide Directly

Account registration: name, email address, password (stored in hashed form)
Purchases: billing name, billing address, and payment method details (processed by our payment provider — we do not store card data)
Community participation: posts, comments, and messages you submit in the member community
Coaching: information you share during coaching intake or sessions
Contact forms and email enquiries: name, email, and any content you include
Email subscription: email address and, if provided, first name

3.2 Data Collected Automatically

Usage data: pages visited, time on site, clicks, and navigation paths — collected via Wix's built-in analytics and Google Analytics
Device and browser data: browser type, operating system, screen resolution, and IP address (anonymised where possible)
Cookies: see Section 6 for full details

3.3 Data We Do Not Collect
We do not intentionally collect sensitive personal data such as health records, clinical diagnoses, or information about past or present substance use. We ask that you do not share such information in community spaces or contact forms. Any personal disclosures made voluntarily in the community are your responsibility.

4. How We Use Your Data

We use your personal data for the following purposes:

Service delivery. Providing access to the Platform, including account management, digital product delivery, and membership features
Transactions. Processing payments and sending receipts, order confirmations, and access instructions
Email communications. Sending newsletters, programme updates, and promotional content where you have subscribed or where permitted under legitimate interests
Analytics and improvement. Monitoring usage patterns to improve content, fix issues, and optimise the Platform
Customer support. Responding to your questions, coaching enquiries, or support requests
Security and compliance. Preventing fraud, abuse, or violations of our Terms & Conditions
Legal obligations. Meeting our obligations under applicable Swiss and EU law

5. Third-Party Services & Data Sharing

We do not sell your personal data. We share data with the following categories of third-party service providers solely to operate the Platform:

5.1 Wix (Platform Hosting)
Our website is built and hosted on Wix.com. Wix processes data on our behalf as a data processor, including account data, usage data, and any data entered through Wix-powered forms. Wix is certified under relevant data protection frameworks. For details, see Wix's Privacy Policy at wix.com/about/privacy.
5.2 Google Analytics
We use Google Analytics to understand how visitors use the Platform. Google Analytics collects anonymised usage data via cookies. We have enabled IP anonymisation. Data is processed by Google LLC, which may transfer data to servers in the United States under Standard Contractual Clauses. You can opt out via the Google Analytics Opt-Out Browser Add-on at tools.google.com/dlpage/gaoptout.
5.3 Email Marketing Provider
We use a third-party email platform (such as Mailchimp or equivalent) to manage our mailing list and send communications. This provider processes your name and email address on our behalf. You can unsubscribe at any time via the link in any email. Subscriber data is stored on servers that may be outside Switzerland; transfers are covered by appropriate safeguards.
5.4 Payment Processor
Payments are processed by a third-party payment provider (such as Stripe or equivalent). We do not receive or store your full card details. The payment provider acts as an independent data controller for transaction data. Please review their privacy policy for details.
5.5 Other Disclosures
We may disclose personal data to:

Competent authorities if required by Swiss or applicable law
A successor entity in the event of a merger, acquisition, or sale of assets, subject to equivalent data protection obligations

6. Cookies

Our website uses cookies — small text files stored on your device — for the following purposes:

Essential cookies: required for the website to function (e.g. session management, login state). These cannot be disabled.
Analytics cookies: set by Wix and Google Analytics to collect anonymised usage statistics. These help us understand how visitors navigate the Platform.

We do not currently use advertising cookies, retargeting pixels, or social media tracking cookies.

You can control analytics cookies through your browser settings or the Google Analytics Opt-Out Add-on. Note that disabling cookies may affect some Platform functionality.

Where required by applicable law, we will request your consent before placing non-essential cookies.

7. International Data Transfers

Deloudi GmbH is based in Switzerland. Some of our third-party service providers (including Google) may process data in countries outside Switzerland and the EEA.

Where such transfers occur, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission or equivalent mechanisms recognized under the nFADP.

8. Data Retention

We retain personal data only for as long as necessary for the purposes described in this Policy, and in line with our legal obligations:

Account data: retained for the duration of your account, plus up to 3 years after account closure (for legal and dispute resolution purposes)
Purchase records: retained for 10 years in accordance with Swiss commercial record-keeping requirements
Marketing email data: retained until you unsubscribe, plus a short suppression period to honour opt-out requests
Analytics data: retained in aggregated, anonymised form; individual-level data subject to Google Analytics retention settings (default: 14 months)
Coaching notes: retained for the duration of the coaching relationship and up to 3 years thereafter

When data is no longer required, it is securely deleted or anonymised.

9. Your Rights

Depending on your location, you have the following rights regarding your personal data:

Access: request a copy of the personal data we hold about you
Rectification: request correction of inaccurate or incomplete data
Erasure: request deletion of your data, subject to legal retention obligations
Restriction: request that we limit how we use your data in certain circumstances
Portability: receive your data in a structured, machine-readable format (where processing is based on consent or contract)
Objection: object to processing based on legitimate interests, including for direct marketing
Withdraw consent: where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at [info@12stepketo.com]. We will respond within 30 days. We may need to verify your identity before fulfilling a request.

If you are not satisfied with our response, you have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) at fdpic.ch, or with the supervisory authority in your EU member state of residence.

10. Children's Privacy

The Platform is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us and we will delete it promptly.

11. Data Security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or misuse. These include:

Encrypted data transmission (HTTPS/TLS)
Access controls limiting who within our team can access personal data
Reliance on Wix's enterprise-grade hosting security
Use of reputable third-party providers with their own security certifications

No system is completely secure. In the event of a data breach that poses a risk to your rights, we will notify affected users and the relevant supervisory authority as required by law.

12. Community Content & Public Spaces

If you post content in the member community, that content is visible to other members. Please do not share sensitive personal information — including health details, information about substance use, or financial information — in community spaces. We are not responsible for how other members use information you share publicly within the Platform.

We may retain community content after account closure for the integrity of discussion threads, unless you request deletion.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by updating the "Last updated" date at the top of this page and, where appropriate, by email notification to registered users. We encourage you to review this Policy periodically.

14. Contact & Complaints

For any privacy-related questions, requests, or concerns:

Deloudi GmbH

Switzerland

[info@12stepketo.com]

For complaints unresolved by us, you may contact:

Swiss Federal Data Protection and Information Commissioner (FDPIC): fdpic.ch
Your national data protection authority if you are resident in an EU/EEA member state