Privacy Policy

1. Who we are

Hastings & Harris [insert full legal name and trading status] is the controller of the personal data described in this privacy policy. This means we decide why and how that personal data is used.

2. About this privacy policy

This privacy policy explains how we collect, use, store and share personal data when you:

• visit our website;
• contact us with an enquiry;
• become a client or take part in coaching, mentoring, training, workshops, retreats or events;
• work with us as a supplier, facilitator, venue or business contact; or
• receive communications from us.

We only use personal data where we have a lawful reason to do so and we aim to collect only the information we genuinely need.

3. Personal data we may collect

Depending on your relationship with us, we may collect and use:

• identity and contact details, including your name, job title, organisation, email address, telephone number and postal address;
• professional information, including your role, employment background, development objectives and information relevant to a coaching, mentoring or learning programme;
• enquiry and correspondence records, including emails, meeting notes and information you provide when asking about our services;
• client and service information, including proposals, contracts, bookings, attendance records, programme requirements, agreed objectives and feedback;
• financial and transaction information, including invoicing details and payment records;
• event information, including dietary, accessibility, accommodation or emergency contact requirements;
• marketing preferences and records of consent, objections, opt-outs or unsubscribes;
• technical information relating to use of our website, such as IP address, browser type, device information and website activity, where this is collected by our hosting, security or analytics systems;
• photographs, video, testimonials or case-study information, but only where an appropriate lawful basis has been identified and any necessary permission has been obtained; and
• any other information you choose to provide to us.

4. Special category data

Some information requires additional protection under data protection law. This may include information about health, disability, dietary requirements that reveal health or religious information, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, sex life or sexual orientation.

We do not ask for special category data unless it is genuinely necessary. Where you provide health, dietary or accessibility information so that we can make suitable arrangements for a workshop, retreat or event, we will normally process it with your explicit consent.

Where special category data is discussed during coaching or mentoring, we will treat it as confidential and restrict access to those who genuinely need it. We will identify both a lawful basis under Article 6 of the UK GDPR and an additional condition under Article 9 before processing it.

You may withdraw consent at any time. This will not affect processing already carried out before consent was withdrawn, although it may affect our ability to provide a requested adjustment or service.

5. How we collect personal data

We may collect personal data:

• directly from you, including by email, telephone, video call, meeting, booking form or during delivery of our services;
• from your employer, sponsoring organisation or another person arranging a programme or event on your behalf;
• from a referral partner or professional contact;
• from publicly available professional sources, such as an organisation’s website or a professional networking profile; and
• automatically through our website, hosting and security systems, and through optional cookies or analytics where these are used.

Where personal data has been obtained from someone other than you, we will provide privacy information within the period required by law unless an exemption applies.

6. How and why we use personal data

Responding to enquiries and preparing proposals

We use contact details, correspondence and relevant business information to respond to questions, understand requirements and prepare proposals.

Providing coaching, mentoring, training and consultancy services

We use personal and professional information to plan, administer and deliver agreed services, communicate with participants and clients, monitor progress and provide appropriate support.

Administering workshops, retreats and events

We use booking, attendance, contact and logistical information to manage participation, venues, accommodation, catering, accessibility and safety.

Managing client and supplier relationships

We use contact, contractual and transaction information to manage relationships, arrange services, maintain records and communicate about ongoing work.

Accounting, taxation and legal compliance

We use transaction, contract and identity information to issue invoices, maintain accounting records, comply with tax and legal obligations, respond to regulators and establish, exercise or defend legal claims.

Improving and safeguarding our services

We may use feedback, service records and limited technical information to maintain quality, improve our services, protect our website and systems, prevent misuse and investigate security incidents.

Marketing and professional communications

We may send relevant information about our services, events or business updates where you have asked to receive them, where you have given consent, or where we are otherwise permitted to do so under data protection law and the Privacy and Electronic Communications Regulations.

You can opt out at any time by using the unsubscribe option in a message or contacting us. We may retain a minimal suppression record so that we can continue to respect your preference.

7. Coaching and mentoring confidentiality

Information shared during coaching or mentoring is treated as confidential.

Where an employer or sponsoring organisation pays for a programme, we will not normally share the detailed content of individual sessions. We may share agreed administrative information, such as attendance, or high-level themes, progress measures and outcomes where this has been explained and agreed in advance.

We may disclose information where required by law or where disclosure is necessary to protect someone’s vital interests. Where possible and appropriate, we will discuss this with the individual before making a disclosure.

8. Sharing personal data

We only share personal data where this is necessary, proportionate and lawful.

We may share personal data with:

• carefully selected venues, accommodation providers, caterers, facilitators, coaches, event partners or other suppliers involved in delivering a requested service;
• IT, website hosting, video-conferencing, email, cloud-storage, booking, accounting and administrative service providers;
• professional advisers, including accountants, insurers, legal advisers and auditors;
• your employer or sponsoring organisation, but only to the extent explained in this policy, agreed with you or necessary to administer the service;
• regulators, courts, law-enforcement bodies, public authorities or other organisations where disclosure is required or permitted by law; and
• a prospective buyer, seller or adviser if the business is reorganised, sold or transferred, subject to appropriate confidentiality and data protection safeguards.

When we use a processor to handle personal data on our behalf, it must only act on our documented instructions, keep the information secure and confidential, and comply with applicable data protection law.

For training workshops, retreats and events, we will share only the minimum personal data required by the relevant provider. Where consent is required, we will obtain express consent before sharing the information.

We do not sell personal data.

9. International transfers

Some of the technology and service providers we use may store or process personal data outside the United Kingdom.

Where personal data is transferred internationally, we will ensure that an appropriate legal mechanism is in place. This may include UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another safeguard permitted by data protection law.

Further information about the safeguards used for a particular transfer is available on request.

[Confirm whether any current suppliers process data outside the UK and record the relevant safeguards before publication.]

10. How long we keep personal data

We keep personal data only for as long as it is reasonably required for the purpose for which it was collected, including legal, accounting, insurance and reporting requirements.

Our usual retention periods are:

• enquiries that do not become client work: up to 12 months after the last meaningful contact;
• client contracts, proposals, invoices, payment and accounting records: normally six years after the end of the relevant client relationship or financial period, or longer where required by law;
• coaching, mentoring and programme administration records: normally up to two years after the engagement ends, unless a different period is agreed or a longer period is needed for a legal or contractual reason;
• detailed coaching or mentoring notes: kept only for as long as they remain genuinely necessary, normally no longer than two years after the engagement ends;
• workshop, retreat and event booking records: normally up to two years after the event;
• dietary, health and accessibility information collected for a specific event: normally deleted within three months after the event, unless it is needed for an ongoing complaint, insurance matter or legal claim;
• marketing contact information: until you opt out, withdraw consent or we decide it is no longer necessary, with records reviewed regularly;
• suppression records: a minimal record may be retained for as long as necessary to ensure that we continue to respect an opt-out or objection; and
• website and analytics information: for the period stated in our cookie settings or by the relevant provider.

We may anonymise information so that it can no longer identify anyone. Anonymised information may be retained for statistical, reporting or service-improvement purposes.

11. Data security

We use appropriate technical and organisational measures to protect personal data against accidental or unlawful loss, alteration, unauthorised access, disclosure or misuse.

These measures may include access controls, password protection, secure cloud systems, software updates, backups, confidentiality requirements and limiting access to those who genuinely need the information.

No internet or electronic storage system can be guaranteed to be completely secure, but we take proportionate steps to reduce risk and respond appropriately to suspected incidents.

12. Website cookies and analytics

Our website may use cookies and similar technologies to operate securely and understand how it is used.

Strictly necessary cookies may be used without consent where they are required for the website to function. Where non-essential analytics, preference or marketing cookies require consent, they will not be set until you have made a choice.

You can manage or withdraw cookie consent through the cookie settings available on the website.

[Confirm the website’s actual cookies and analytics tools before publication. Any cookie banner and cookie notice must match this wording.]

13. Your data protection rights

Depending on the circumstances and the lawful basis being used, you may have the right to:

• ask for a copy of the personal data we hold about you;
• ask us to correct inaccurate or incomplete personal data;
• ask us to delete personal data;
• ask us to restrict how personal data is used;
• object to certain uses of personal data;
• receive personal data in a portable format;
• withdraw consent at any time where consent is the lawful basis; and
• ask for safeguards where personal data is transferred internationally.

These rights do not apply in every circumstance and legal exemptions may apply. We may ask for information to confirm your identity before responding to a request.

There is normally no charge for exercising a data protection right. We will respond within the period required by law.

14. Your right to object

You have the right to object at any time to the use of your personal data for direct marketing. If you object, we will stop using your personal data for that purpose.

You may also object where we rely on legitimate interests. We will consider the circumstances and stop the processing unless we can demonstrate compelling legitimate grounds that override your rights, or the processing is needed to establish, exercise or defend legal claims.

To object, contact enquiries@hastingsharris.com.

15. Data protection complaints

You can complain to us if you believe we have not handled your personal data properly.

We will acknowledge a data protection complaint within 30 days of receiving it. We will investigate it without undue delay, keep you appropriately informed and tell you the outcome.

You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113

We would appreciate the opportunity to consider your concerns first, but this does not affect your right to contact the ICO.

16. Automated decision-making

We do not use personal data to make decisions about individuals solely by automated means where those decisions have legal or similarly significant effects.

17. Changes to this privacy policy

We may update this privacy policy where our services, systems, suppliers or legal obligations change.

The latest version will be published on this website and the “last updated” date will be amended. Where a change materially affects how we use personal data, we will take reasonable steps to bring it to the attention of affected individuals before the new use begins.