Privacy Policy

This policy explains what personal data we collect when you use this website, subscribe to the Diary, book a call or enrol on the course, what we do with it, and the rights you have over it.

• What we collect
• Why, and the lawful basis
• Marketing
• Who we share it with
• Transfers outside the UK
• How long we keep it
• Your rights
• Cookies
• Complaints
• Changes

1. What we collect

• Identity and contact data - name, email address, business name, job title, and billing address where relevant
• Transaction data - what you bought, when, the amount, and the licence tier. We do not hold your full card number; that stays with [payment provider]
• Course data - your progress, assessment results, certificates and anything you post in the member community
• Booking data - the details you give when you book a call, and anything you tell us on it
• Technical data - IP address, browser type and device, and how you move through the site

We do not deliberately collect special category data. Please do not send us health, political or similar sensitive information.

2. Why we use it, and our lawful basis

• To supply the course and manage your account - performance of our contract with you
• To take payment, invoice and keep accounting records - contract, and legal obligation for tax records
• To provide support and handle complaints - contract, and our legitimate interest in running the service well
• To send the Diary newsletter and course updates - your consent, or our legitimate interest where you are an existing customer and the content is closely related
• To arrange and follow up calls you book - your consent, and our legitimate interest in responding to enquiries
• To keep the site secure and improve it - our legitimate interest in a working, safe website
• To meet legal and regulatory duties - legal obligation

Where we rely on legitimate interests, we have weighed those interests against your rights and are happy to explain the assessment on request.

3. Marketing

The Diary newsletter is published through Substack. When you subscribe, Substack processes your email address under its own privacy policy as well as this one. Every issue carries an unsubscribe link and you can leave at any time.

We do not sell your data, and we do not share it with third parties for their own marketing.

4. Who we share it with

We share personal data only with providers who help us run the service, under contract and only on our instructions:

• [course platform], which hosts the course and your account
• [payment provider], which processes payments
• Substack, which delivers the newsletter
• Calendly, which handles call bookings
• Vercel, which hosts this website
• our accountants and professional advisers, and any regulator or authority where we are legally required to disclose

5. Transfers outside the UK

Some of those providers are based outside the UK, including in the United States. Where personal data leaves the UK we rely on UK adequacy regulations, or on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with appropriate safeguards. Ask us and we will tell you which applies to a given provider.

6. How long we keep it

• Account and course data - for your access period and 24 months afterwards, so you can come back without starting over
• Financial records - 6 years after the end of the tax year they relate to, as UK tax law requires
• Newsletter subscription - until you unsubscribe, then we keep a suppression record so we do not email you again by mistake
• Enquiries and bookings that do not lead to a purchase - 24 months

7. Your rights

Under UK GDPR you have the right to ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or transfer it to another provider. You can object to processing based on legitimate interests, and withdraw consent at any time where consent is our basis.

Email [support email address] to exercise any of these. We respond within one month. There is no fee unless a request is manifestly unfounded or excessive. We may need to confirm your identity first.

8. Cookies and analytics

This website sets no advertising or tracking cookies. [Confirm before launch: whether Vercel Analytics or any other analytics is enabled, and add a cookie banner if anything non-essential is set]. The course platform and payment provider set their own cookies, which are necessary for those services to work, and are covered by their policies.

9. Complaints

Please raise any concern with us first at [support email address]. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority, at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right before you approach the ICO.

10. Changes to this policy

We review this policy regularly. If we make a material change we will update the date at the top of this page and, where the change significantly affects you, tell you by email.