Privacy Notice
What we collect, why we collect it, who else sees it, and what you can ask us to do about it.
Last updated: 24 August 2026
1. Who we are, and what this covers
JANORÀ by Laura Curatolo, Hofacherstrasse 4, 8154 Oberglatt, Zurich, Switzerland, a registered sole proprietorship in Switzerland, is the controller of the information described here. Any question or request: info@janorastudio.ch.
This covers personal information handled through janorastudio.com - visiting the site, joining a waitlist, downloading a free resource, buying, and studying a course.
2. The law that applies
We sell worldwide, other than to the United States and Canada, to which we do not sell. Wherever you are, we apply the standard set out in this notice to your information, and where your own country gives you rights beyond it, those rights are yours as well.
We are established in Switzerland, so the revised Federal Act on Data Protection (revFADP) applies to everything we do, and we apply that standard to everyone wherever they are. Where the data protection law of your own country also applies to your information, we meet that as well, and where the two differ we apply whichever gives you the stronger protection.
Our courses are sold business to business. Data protection is different from our contract terms: these rules protect you as an individual, not as a business, and apply in full whether you bought as a sole trader, through a company, or not at all.
3. What we collect
- You give us: your name and email when you join a waitlist, request a resource or write to us; billing details when you buy; your professional background where you choose to tell us; and anything you write to us
- Created when you use the site: pages visited and how you arrived; whether our emails were opened; course progress and documents downloaded; and technical information such as IP address, browser and device
We collect from you directly. We do not buy lists. We do not collect health information about you, and your full card number is never seen or stored by us - payments are handled by the providers in section 7.
Without a name and email we cannot send you a resource, give you course access or issue a certificate. Everything else is optional.
Please do not send us anything that identifies a client - no names, dates of birth, contact details or recognisable clinical photographs. Where a course document asks you to work through a case, do it in your own records. Anonymise anything you do send; anything identifiable that reaches us is deleted. Your clients’ information is yours to protect, and nothing here transfers that to us.
4. Why we use it, and our legal basis
| What we do | Legal basis |
|---|---|
| Deliver a course, resource or download you asked for | Performance of a contract |
| Take payment and keep the record of it | Contract, and legal obligation |
| Send the emails attached to a waitlist or free resource | Consent, withdrawable at any time |
| Tell existing customers about related education | Legitimate interests, with an unsubscribe link every time |
| Keep the site working, secure and free of abuse | Legitimate interests |
| Understand how the site and our emails are used | Consent, through cookie settings |
| Keep records of consent, complaints and orders | Legal obligation, and legitimate interests |
Under Swiss law we process your information in good faith, only for the purposes described here, and only so far as is proportionate to them.
5. Cookies
Essential cookies make the site, checkout and course login work and are always on. Analytics and advertising cookies are set only if you accept them, and you can change your mind at any time through the cookie settings. Refusing them restricts nothing. Full detail is in our Cookie Notice.
6. Live sessions, and using your words
Live sessions are usually recorded so people who could not attend can watch. We say so before recording starts; with your camera and microphone off you will not appear, and chat questions may be recorded - email a question instead if you would rather it was not.
We publish your name, business name or words only with your clear permission for that specific use. A message of thanks or a review left elsewhere is not permission. Change your mind and we remove it from anywhere we control.
7. Who else handles it
They act on our instructions and may not use your information for their own purposes, except where they are independent controllers of payment information as financial regulation requires.
| Provider | What they do | Where |
|---|---|---|
| systeme.io | Website, email, checkout, course platform | European Union |
| Stripe | Card payments | United States and Ireland |
| PayPal | PayPal payments | United States and Luxembourg |
| Analytics, where accepted | United States and Ireland | |
| Meta | Advertising measurement, where accepted | United States and Ireland |
We also work with a small number of independent specialists - at present a marketing consultant. Where their work requires access they act only on our instructions under a written agreement requiring confidentiality. We will tell you who they are if you ask.
If you or a professional body ask us to confirm a certificate is genuine, we confirm the name, programme and date, and nothing further. We share information where legally required, and would share it with an adviser or insurer if that were necessary to deal with a claim. We do not sell your information.
8. Where it goes, and how we protect it
Switzerland, the UK and the EEA each recognise the others as adequate, so transfers between them need no further safeguard. Where a provider processes in the United States, the transfer is covered by the European Commission’s Standard Contractual Clauses with the Swiss and UK addenda, or by the provider’s certification under an approved framework, with encryption in transit and at rest.
If you are somewhere else in the world - the Middle East, Asia, Africa, Latin America or Oceania - nothing about your information is handled differently. It goes to the same providers, in the same places, under the same safeguards, and the standard in this notice applies to it wherever you are.
We keep the number of people and systems that touch your information as small as the work allows. The site and every checkout page run encrypted; accounts use strong unique passwords and two-factor authentication where offered. Access is limited to Laura Curatolo and, where a piece of work needs it, a small number of trusted specialists under written agreement, each with their own login and only the access that work requires, removed when it ends. No system is perfectly secure: if something happens that is likely to put you at serious risk we will tell you promptly and notify the Federal Data Protection and Information Commissioner and any other authority we must.
9. How long we keep it
| Information | Kept for |
|---|---|
| Waitlist and free-resource sign-ups | Until you unsubscribe, or after three years of no engagement |
| Course enrolment and access records | As long as you hold access |
| Sales, invoices and payment records | Ten years, as Swiss accounting law requires |
| Certificates issued | Ten years, so we can verify one |
| Emails you send us | Two years after the matter is closed |
| Complaints and orders | Ten years |
| Cookie consent records | Twelve months, then we ask again |
10. Your rights
Wherever you are, you can ask us to tell you what we hold and give you a copy, correct anything wrong, delete what we no longer have a reason to keep, stop or limit a particular use, send your information to you or another provider in a portable format, or stop marketing to you at any time without giving a reason. Where we rely on consent you can withdraw it at any time, which does not affect what we did before.
Write to info@janorastudio.ch. We answer within thirty days and will tell you if we need longer and why. There is no charge, and asking never affects your access to anything you bought.
If you are unhappy with how we handled it, please tell us first - most things are quicker to fix directly. You can also complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), or the relevant authority where you live or work.
11. Representation outside Switzerland
We are established in Switzerland rather than in the United Kingdom or the European Union. Where the UK GDPR or the EU GDPR requires a controller outside those territories to designate a written representative there, we designate one and publish their name and contact details in this section, so that you can raise a data protection matter locally rather than having to contact Switzerland. We keep our assessment of that question in writing and review it as our activity grows.
Whether or not a representative is in place, you can raise a data protection matter with us directly at info@janorastudio.ch at any time, and you may complain to your own supervisory authority as set out in section 10.
12. Other points
We do not make decisions about you by automated means alone, and we do not profile you in any way producing legal or similarly significant effects.
Our courses are for qualified professionals and are not directed at children. We do not knowingly collect information from anyone under eighteen; tell us if you believe a child has given us information and we will delete it.
At checkout you are asked for your business or trading name, and your VAT number if you are registered. We collect these because we sell business to business, and we record them against your order.
Once you follow a link to another organisation you are on their site under their terms, and we have no control over what they do with your information.
If we change how we handle your information we will update this page and change the date at the top. Where a change matters to you we will tell you by email rather than relying on you noticing.