andQFIVE Coaching GmbH, Hoher Markt 4/20, A-1010 Vienna, Austria. Email: hello@mocaia.com. We have not appointed a data protection officer; please send all data protection requests to this address.

• Website visitors
• Coachees (people being coached), including private clients
• HR contacts and other representatives of corporate clients
• Coaches and coach applicants (see also the coach calendar privacy policy)
• Holders of a Mocaia ID account

• Account data (name, email, sign-in provider) to provide your Mocaia ID and sign you in — performance of contract, Art. 6(1)(b) GDPR.
• Contact data (email, mobile number) and booking data (date, time, coach, service, location, time zone, optional focus note) to arrange Discovery Calls and coaching sessions and send confirmations and reminders — Art. 6(1)(b) GDPR.
• Data of corporate client contacts (name, role, email, company) to manage coaching engagements — Art. 6(1)(b) and our legitimate interest in running the engagement, Art. 6(1)(f) GDPR.
• Feedback you give about coaching — Art. 6(1)(b) GDPR; optional comments shared with HR only with your consent, Art. 6(1)(a) GDPR.
• Technical log data (IP address, browser, time of access) to operate and secure the website — Art. 6(1)(f) GDPR.
• Records of emails we send and their delivery status — Art. 6(1)(f) GDPR.

Coaching content stays between coachee and coach. Focus notes are visible only to you and your coach. HR contacts of a corporate client see organisational information (for example that sessions took place), not session content.

The BENE Scan runs on bene-scan.com and uses an anonymous code ("Your ID Code"). Mocaia stores only whether the scan has been completed. Scan results are not stored on mocaia.com and are not shown to HR or in dashboards.

Where a processor or its sub-processors transfer data outside the EEA, this is based on EU standard contractual clauses or an adequacy decision (e.g. the EU-US Data Privacy Framework).

• Your coach (independent contractor), for the sessions you book with them
• Lovable (hosting, database and email sending), with data stored in the EU (AWS eu-west-1, Ireland)
• Google Ireland Ltd. and Microsoft Ireland Operations Ltd., where a coach connects their calendar (only busy/free times and the bookings we create)
• Sign-in providers you choose for Mocaia ID (e.g. Google, Microsoft)

We keep account and booking data for as long as your account or the coaching engagement exists, and afterwards only as long as statutory retention duties (e.g. seven years under Austrian tax law for business records) or the defence of legal claims require. Technical logs are deleted after a short period.

We use only technically necessary cookies and browser storage, for example to keep you signed in and to return you to the right page after sign-in. We do not use tracking or advertising cookies, so no consent banner is needed. Legal basis: §165(3) TKG 2021 and Art. 6(1)(f) GDPR.

You have the right of access, rectification, erasure, restriction, data portability and objection, and you may withdraw any consent at any time with effect for the future. Contact hello@mocaia.com. You may lodge a complaint with the Austrian Data Protection Authority (Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at).

Coaches who connect Google Calendar or Microsoft Outlook should also read the separate coach calendar privacy policy at mocaia.com/policies/coach-privacy.