Privacy Policy
Last updated: May 2026
This policy explains what personal data this website collects, how it is used, who else sees it, how long it is kept, and what rights you have. It applies to your use of evinzorba.com and to communications you send through the contact form. Anything shared during therapy is covered by professional confidentiality (see section 4).
1. Data controller
Evin Zorba, NIP-registered psychologist (#235833), Rotterdam. Email: [email protected].
2. What I collect
Contact form
When you submit the contact form, I collect: your first and last name, email address, and your message. A phone number is optional. By sending the form, you agree that these details will be used solely to respond to your inquiry. This is disclosed clearly above the submit button. After you submit, you receive an automatic confirmation email so you have a record that your message arrived.
Legal basis: pre-contractual / contract necessity (GDPR Art. 6(1)(b)) for replying to your inquiry, plus my legitimate interest (Art. 6(1)(f)) in operating the practice. No further use of your data is made.
Cookies and tracking: only with your consent
By default, no analytics, advertising, or session-recording tools are loaded. Only your language preference is stored locally in your browser.
If you accept cookies in the consent banner, the following are activated:
- Google Analytics 4
- Microsoft Clarity
If you decline, none of the above is loaded — not even the Google tag itself, which is only fetched after you accept. You can change your choice at any time via the Cookie settings link in the footer of any page. Legal basis: your consent (GDPR Art. 6(1)(a)).
Therapy sessions
Anything you share during a session is covered by professional confidentiality (beroepsgeheim) under Dutch law and the NIP code of ethics. Session records are kept separately from website data and are not used for marketing or analytics. You will receive specific information about session record-keeping at intake.
3. How long I keep your data
- Contact-form inquiries that do not lead to therapy: deleted within 12 months.
- Inquiries that lead to therapy: retained per Dutch psychology-file rules (currently 20 years from the last contact, under the WGBO).
- Analytics data: typically up to 14 months (GA4 default).
4. Who else sees your data
The site is hosted on Cloudflare, which also keeps it secure. What you send through the contact form arrives in my Google Workspace inbox. Clarity, from Microsoft, shows me how the site is used so I can improve it. Each of these companies has its own privacy policy.
I do not sell your data and I do not share it for advertising outside the consent-gated services listed above.
5. Your rights (GDPR)
You have the right to:
- Access a copy of your personal data
- Correct inaccurate data
- Delete your data (subject to legal retention obligations for therapy records)
- Restrict or object to processing
- Receive your data in a portable format
- Withdraw consent at any time, for any processing that relies on it
To exercise these rights, email [email protected].
6. Changes to this policy
I may update this policy occasionally. The "Last updated" date at the top reflects the latest revision.
7. Questions or complaints
For questions, email [email protected]. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) at autoriteitpersoonsgegevens.nl.