Privacy Policy

This Privacy Policy explains how personal data is processed when you visit joanna-winter.com, use its creative tools, subscribe to emails, or contact Joanna Winter. Personal data means any information relating to an identified or identifiable person.

1. Controller

2. Website hosting and server logs

This website is hosted using ChatGPT Sites, a service provided by OpenAI, with technical infrastructure provided in part by Cloudflare. When you open a page, the hosting providers necessarily process connection data so that the website can be delivered securely. This data may include your IP address, the date and time of access, the requested page, the referring page, browser and device information, the operating system, the amount of data transferred, and the response status.

The purpose is to provide the website, maintain its stability and security, prevent misuse, and diagnose technical faults. The legal basis is Article 6(1)(f) GDPR. The legitimate interests are the secure and reliable operation of this website. Log data is retained only for as long as it is needed for these purposes or to meet legal obligations.

OpenAI Ireland Limited processes hosted data under the applicable agreement and may use subprocessors. Where data is transferred outside the European Economic Area, OpenAI states that it relies on an adequacy decision or agreements containing the European Commission's Standard Contractual Clauses. Further information is available in the ChatGPT Sites Data Processing Addendum and Cloudflare's Privacy Policy.

3. Free masterclass and email newsletter

The signup form is supplied by EmailOctopus. On pages containing that form, your browser connects to eomail5.com so that EmailOctopus can display and operate the form. If you subscribe, the required email address, an optional first name, the date and time of signup, technical connection data, consent records, and subsequent delivery events may be processed. EmailOctopus may also record events such as delivery, bounces, unsubscribes, opens, and link clicks.

The data is used to deliver the requested free masterclass, operate the related email sequence, send occasional emails from Joanna Winter, document consent, and maintain reliable delivery. The legal basis is your consent under Article 6(1)(a) GDPR. You may withdraw your consent at any time by using the unsubscribe link in any email or by writing to joanna@joanna-winter.com. Withdrawal does not affect processing carried out before the withdrawal.

EmailOctopus is operated by Three Hearts Digital Ltd, 86-90 Paul Street, London EC2A 4NE, United Kingdom. EmailOctopus acts as a processor for the mailing list. It states that contact lists are stored on Amazon Web Services servers in Ireland and may be made temporarily available to its email service providers when an email is sent. Processing may also take place outside the United Kingdom or the European Economic Area subject to appropriate safeguards. Further details are available in the EmailOctopus Privacy Policy.

Subscriber data is retained until you withdraw your consent, unsubscribe, or the mailing list is discontinued. Limited data may be retained after an unsubscribe when this is necessary to honour the opt-out, meet legal obligations, or establish, exercise, or defend legal claims.

4. BookFunnel delivery

The delivery email for the free masterclass contains a link to BookFunnel, a third-party ebook delivery service. No website visitor data is sent to BookFunnel merely because you visit joanna-winter.com. If you choose to open the BookFunnel link, BookFunnel receives the connection data required to provide its page and download. The legal basis for providing the link is Article 6(1)(b) GDPR because it is used to deliver the material you requested. BookFunnel processes data on its own pages under its Privacy Policy.

5. Contact by email

If you contact Joanna Winter by email, the email address you use, the content of your message, and any other information you provide will be processed in order to answer you. The legal basis is Article 6(1)(b) GDPR where the message concerns a contract or steps requested before entering into a contract. In other cases, the legal basis is Article 6(1)(f) GDPR, based on the legitimate interest in responding to enquiries. Correspondence is deleted when it is no longer needed, unless statutory retention duties or the defence of legal claims require longer storage.

6. Cookies and storage on your device

Reader-access cookies

The password-protected Prompt Grimoire and Keeper's Logbook use the cookies jw_gothic_reader and jw_coastal_reader. A cookie is set only after the correct book password has been entered. It contains a cryptographic verification value, not the password, and expires after 30 days. The cookie is technically necessary to remember access to the protected tool. Storage is therefore permitted under Section 25(2)(2) TDDDG, and the related processing is based on Article 6(1)(f) GDPR.

Local progress in the creative tools

The Gothic Mansion and Christmas Lighthouse save your choices, notes, and progress in your browser's local storage. This information remains on your device and is not transmitted to Joanna Winter. You can remove it by using the tool's reset function or clearing website data in your browser. This storage provides the progress-saving function you request when using the tool and is not used for tracking.

7. Analytics and advertising

This website does not currently use a separate web analytics service, behavioural advertising, or social media tracking pixels. The email processing described above remains unaffected by this statement.

8. International data transfers

Some service providers or their subprocessors may process personal data outside the European Economic Area. Where required, transfers are based on an adequacy decision by the European Commission or on appropriate safeguards such as the European Commission's Standard Contractual Clauses. You may request further information about the safeguards by using the contact details above.

9. Your rights

Subject to the conditions in applicable data protection law, you have the right to:

• request access to your personal data;
• request correction of inaccurate or incomplete data;
• request deletion or restriction of processing;
• receive data you provided in a portable format where the legal requirements are met;
• object to processing based on legitimate interests;
• object to direct marketing at any time; and
• withdraw consent at any time with effect for the future.

No decision producing legal or similarly significant effects is made about you solely by automated means. To exercise your rights, email joanna@joanna-winter.com.

10. Right to complain

You have the right to lodge a complaint with a data protection supervisory authority. The supervisory authority responsible for the controller is the State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia, Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.

11. Security

Appropriate technical and organisational measures are used to protect personal data. Data transmitted between your browser and this website is encrypted using HTTPS. No internet transmission can be guaranteed to be completely secure.

12. Changes to this policy

This policy may be updated when the website, its services, or legal requirements change. The current version is always published on this page.

Last updated: 2 August 2026.