Privacy Policy

01 Who We Are

ECHO Neural Performance ("ECHO", "we", "us", "our") is a professional coaching and neural performance service operated by Nuno Romao, based in the Republic of South Africa. We operate the website at echomethod.coach.

Under the Protection of Personal Information Act 4 of 2013 ("POPIA"), we are the Responsible Party in respect of personal information processed through this website and our services. Under the EU General Data Protection Regulation ("GDPR"), where applicable, we act as the Data Controller.

02 Information We Collect

We only collect personal information that you voluntarily provide to us. We do not run advertising networks, sell data, or use third-party tracking pixels.

• Contact enquiries — name, email address, job title, organisation name, and any details you include in your message when you submit the Get Started form.
• Neural Audit responses — your answers to the self-assessment questionnaire. These are not linked to your identity unless you choose to follow up by email.
• Email correspondence — any personal information you include when you email us directly.
• Technical data — basic server logs collected automatically by our hosting provider (Vercel Inc.), including IP address, browser type, referring URL, and pages visited. We do not use this data to identify individuals.

We do not collect payment card information, government identification numbers, or biometric data. We do not knowingly collect information from children under the age of 18.

03 Why We Collect It — Purpose and Legal Basis

We process personal information only for specific, legitimate, and clearly defined purposes:

• To respond to enquiries — when you contact us, we use your information to reply. Legal basis: contractual necessity / legitimate interest.
• To deliver our services — if you become a coaching client, we process your information to deliver and manage the engagement. Legal basis: contract performance.
• To improve our website — aggregated, anonymised technical data helps us understand how the site is used. Legal basis: legitimate interest.
• To comply with legal obligations — where required by South African law or applicable international law. Legal basis: legal obligation.

We will never use your personal information for purposes incompatible with those stated here without your prior consent.

04 How We Store and Protect Your Information

Contact form submissions are delivered to a secure, password-protected email account operated by Nuno Romao. We use FormSubmit (formsubmit.co) as a form relay service; submissions pass through their servers before reaching our inbox. FormSubmit's privacy policy is available at formsubmit.co.

Our website is hosted by Vercel Inc. (San Francisco, USA), a SOC 2 Type II compliant infrastructure provider. All data in transit is encrypted via TLS. Vercel's privacy policy is available at vercel.com/legal/privacy-policy.

We take reasonable technical and organisational measures to prevent loss, unauthorised access, disclosure, or modification of your personal information. However, no transmission over the internet is completely secure, and we cannot guarantee absolute security.

Personal information is retained only for as long as necessary to fulfil the purpose for which it was collected, or as required by law. Enquiry records are retained for up to 3 years. Active client records are retained for 5 years after the end of an engagement.

05 Sharing Your Information

We do not sell, rent, or trade your personal information. We share it only in the following limited circumstances:

• Service providers — FormSubmit (form delivery) and Vercel (web hosting) are the only third-party processors who handle personal data on our behalf. Both are bound by their own privacy commitments.
• Legal requirements — where disclosure is required by South African law, a court order, or a lawful request from a regulatory authority.
• Business transfer — in the unlikely event of a merger, acquisition, or sale of assets, personal data may be transferred as part of that transaction, subject to equivalent protections.

Any service provider we use is required to process personal information only on our instructions and in a manner consistent with this policy.

06 Cookies and Tracking

This website does not use marketing cookies, tracking pixels, or behavioural advertising technology. We do not use Google Analytics, Meta Pixel, or any equivalent service.

Our hosting provider (Vercel) may set technically necessary cookies to manage sessions and route traffic. These cookies contain no personally identifiable information and are not used to track you across other websites.

If we introduce any cookies requiring consent in the future, we will update this policy and implement an appropriate consent mechanism before doing so.

07 International Data Transfers

As a South Africa-based operator using US-based infrastructure (Vercel) and form delivery services, your data may be processed outside South Africa. Where this occurs, we take steps to ensure it is protected to a standard consistent with POPIA and, where applicable, GDPR.

If you are located in the European Economic Area (EEA), your data may be transferred to countries that the European Commission has not deemed to provide an adequate level of protection. In such cases, we rely on standard contractual clauses or equivalent safeguards where required.

08 Your Rights

Depending on your jurisdiction, you have some or all of the following rights in relation to your personal information:

09 Children's Privacy

Our services are directed at professional adults. We do not knowingly collect or process personal information from anyone under the age of 18. If you believe we have inadvertently collected information from a minor, please contact us immediately and we will delete it.

10 Changes to This Policy

We may update this policy from time to time to reflect changes in our practices or applicable law. When we make material changes, we will update the effective date at the top of this page. Your continued use of the website after any changes constitutes acceptance of the updated policy. We encourage you to review this page periodically.

11 Contact and Data Subject Requests

To exercise any of your rights, submit a data access or deletion request, ask a question about this policy, or report a concern, please contact the Responsible Party directly:

We will acknowledge your request within 5 business days and aim to resolve it within 30 days, or within such shorter period as required by applicable law.