Skip to content
Legal

Privacy Policy

Last updated: 2026-05-18

1. Data Controller

The data controller responsible for this website is:

Iwana Johannsen, Trabalhadora Independente (self-employed professional registered in Portugal)
NIF: 323 138 241
Lisbon, Portugal
Email: iwana.johannsen@gmail.com

If you have any questions regarding this Privacy Policy or your personal data, you may contact me at the email address above.

2. General Information

This website provides information about mentoring services, writing, and educational content related to portfolio careers and the future of work. It also sells digital products (such as the Vision Workbook) via Lemon Squeezy acting as Merchant of Record - see Section 3(d) below.

Protecting your personal data is important. Personal data is processed in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Portuguese data protection laws.

3. Data collected through this website

a) Contact via Email

This website does not use a contact form. If you choose to contact me via email, your email address and any information you provide in your message will be processed in order to:

  • Respond to your inquiry
  • Communicate regarding potential services

Legal basis: Article 6(1)(b) GDPR, processing necessary for pre-contractual steps taken at your request. Article 6(1)(f) GDPR, legitimate interest in responding to inquiries.

Your data will not be shared with third parties unless required by law or necessary for the provision of agreed services.

b) Newsletter Subscription via Substack

This website includes a "Subscribe" button that links to my Substack newsletter. When you click this button, you are redirected to the Substack platform. Any data you provide there (such as your email address) is processed directly by Substack in accordance with their own Privacy Policy. I do not collect or process newsletter subscription data through this website. You can review Substack's Privacy Policy on their website.

c) Embedded Substack subscribe form (Afterwork newsletter page)

The Afterwork newsletter page (/#afterwork) contains an embedded Substack subscribe form (iframe). When this iframe loads, it may set cookies and collect technical data on Substack's behalf, even if you do not interact with it. This processing is carried out by Substack as an independent data controller. If you submit your email address through the embedded form, your data is processed by Substack directly. For details, see Substack's Privacy Policy.

d) Purchase of digital products via Lemon Squeezy

The Vision Workbook (and any future digital products) are sold through this website via Lemon Squeezy (Sold through Link, LLC, formerly Lemon Squeezy LLC), acting as Merchant of Record. When you click a checkout button (such as "Get the workbook"), a checkout overlay is loaded directly from Lemon Squeezy. Any data you provide there is collected and processed by Lemon Squeezy as an independent data controller, including:

  • Name
  • Email address
  • Billing address and country
  • Payment method details (processed by Lemon Squeezy's payment processors; full card details are not stored or visible to me)
  • IP address and basic technical data of the transaction

Lemon Squeezy uses this data in order to:

  • Process the payment
  • Issue the receipt and tax-compliant invoice
  • Calculate, collect and remit applicable EU VAT or sales tax
  • Deliver the digital product (PDF download link and Notion template link)
  • Provide secure access to the order page for re-download and support
  • Detect and prevent fraud

Because Lemon Squeezy acts as Merchant of Record, they are the seller of record on your receipt and your contractual counterparty for the transaction itself, while the underlying digital product is created and supplied by Iwana Johannsen. After a successful purchase, I receive limited buyer information from Lemon Squeezy (typically name, email address, country, and order details) in order to fulfill the product, respond to support requests, and meet legal record-keeping obligations.

Lemon Squeezy is based in the United States. Data transfers outside the EU/EEA take place on the basis of Standard Contractual Clauses. For details on how Lemon Squeezy processes your personal data, please see Lemon Squeezy's Privacy Policy.

Legal basis: Article 6(1)(b) GDPR, processing necessary for the performance of a contract to which the data subject is a party. Article 6(1)(c) GDPR, processing necessary for compliance with legal obligations (in particular, VAT remittance, invoicing, and accounting record-keeping).

e) Privacy-friendly traffic analytics via Cloudflare Web Analytics

This website uses Cloudflare Web Analytics to understand aggregate traffic patterns (such as which pages are most read and which sources refer visitors here). Cloudflare Web Analytics is designed to be privacy-friendly:

  • It does not use cookies.
  • It does not use fingerprinting or any persistent identifier.
  • It does not track individual users across pages or sessions.
  • Only aggregate, anonymised data is recorded (such as page URL, referrer, country, browser, and device type).

This processing is carried out by Cloudflare, Inc. (USA) as an independent data processor on this website's behalf. Cloudflare is based in the United States; data transfers outside the EU/EEA take place on the basis of Standard Contractual Clauses. For details, see Cloudflare's Privacy Policy.

Legal basis: Article 6(1)(f) GDPR, legitimate interest in understanding aggregate site usage to improve the website.

4. Website hosting and technical data

This website is hosted on Netlify, Inc. (USA). When you visit this website, Netlify automatically collects certain technical data in server logs, such as:

  • IP address
  • Browser type
  • Device information
  • Pages visited
  • Date and time of access

This data is used for security, hosting, and technical operation of the website (for example, to detect and mitigate abuse and to deliver the requested pages). Privacy-friendly aggregate analytics are provided via Cloudflare Web Analytics — see Section 3(e). No analytics tools that profile or track individual visitors are used.

Legal basis: Article 6(1)(f) GDPR, legitimate interest in ensuring secure and stable website operation.

Netlify is based in the United States. Data transfers outside the EU/EEA take place on the basis of Standard Contractual Clauses and Netlify's Data Processing Addendum. For more information, please refer to Netlify's Privacy Policy.

5. Cookies

This website does not set any first-party cookies of its own. No cookie-based analytics or advertising tools are used.

Third-party cookies may be set by embedded content from other services:

  • Substack - see Section 3(c) above (embedded Substack subscribe form on the Afterwork newsletter page).
  • Lemon Squeezy - see Section 3(d) above. When you click a checkout button, the Lemon Squeezy checkout overlay (loaded via lemon.js) may set technical cookies to manage the secure checkout session, remember your progress, and prevent fraud.

Those cookies are set by those third parties and are subject to their own privacy and cookie policies.

You can control cookies through your browser settings.

6. Data Retention

Personal data received via email will be stored only for as long as necessary to:

  • Respond to your inquiry
  • Fulfill any contractual obligations
  • Comply with legal or tax requirements

Personal data related to digital product purchases (such as buyer name, email, country, and order metadata) is retained by both Lemon Squeezy and Iwana Johannsen for as long as required to fulfill the product, provide customer support, and meet legal record-keeping obligations - in particular accounting and tax records under Portuguese and EU law, which typically must be kept for up to 10 years.

Data will be deleted or anonymised when it is no longer required for these purposes.

7. Your Rights under GDPR

Under the GDPR, you have the right to:

  • Access your personal data
  • Request correction of inaccurate data
  • Request deletion of your data
  • Restrict processing
  • Object to processing
  • Request data portability
  • Withdraw consent (where applicable)

To exercise these rights, please contact me at the email address listed above. You also have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD) if you believe your data protection rights have been violated.

8. Changes to this privacy policy

This Privacy Policy may be updated from time to time to reflect legal or operational changes. The latest version will always be available on this website.