Privacy Policy

Last updated 16 October 2026

This Privacy Policy explains what personal data I collect when you use this website, contact me, or work with me as a coaching client, how and why that data is used, who it is shared with, how long it is kept, and your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Information I collect

Depending on how you interact with me, I collect and process the following categories of personal data:

A. Contact and enquiry details

When you submit the contact form on this website or contact me by email or telephone, I collect your name, email address, telephone number (if you choose to provide it), and the contents of your message.

B. Consultation and coaching records

If you book an initial 15-minute consultation or become a coaching client, I collect the information you share with me during our calls and correspondence, along with session dates, brief coaching notes, and agreed action points.

C. Payment and invoicing records

If you purchase coaching sessions, I keep records of payments received, bank transfer dates, payer name and reference, invoices or receipts issued, and session attendance. Payments are made directly by bank transfer; I do not collect or store payment card details.

D. Technical and website security data

When you visit this website or submit the contact form, technical data such as your IP address, browser type, and basic request headers is processed automatically by Cloudflare to deliver the website securely and verify that form submissions are made by a human rather than an automated script.

Special category (sensitive) personal data

During a consultation or coaching session, you may choose to share information relating to your physical or mental health or emotional wellbeing. Under UK GDPR, health information is classed as special category data. I only record or process this information with your explicit consent (Article 9(2)(a) UK GDPR) in order to provide coaching, and you may withdraw that consent at any time.

2. How I use your information and lawful bases

Under UK data protection law, I must have a valid lawful basis for each way I use your personal data. I process your information for the following purposes:

• Responding to enquiries and arranging consultations: To reply to messages sent through the website or by email and to schedule or hold an initial 15-minute video consultation. Lawful basis: taking steps at your request prior to entering into a contract (Article 6(1)(b)) and legitimate interests in responding to prospective clients (Article 6(1)(f)).
• Delivering coaching services: To schedule and conduct video coaching sessions, keep session notes, and manage our coaching agreement. Lawful basis: performance of a contract (Article 6(1)(b)), and explicit consent (Article 9(2)(a)) for any health or wellbeing information you choose to disclose.
• Accounting and tax compliance: To issue invoices or receipts, reconcile bank transfer payments, and maintain financial accounts required by HM Revenue & Customs (HMRC). Lawful basis: compliance with a legal obligation (Article 6(1)(c)).
• Website operation and spam prevention: To serve this website securely and protect the contact form against automated spam and abuse using Cloudflare Turnstile. Lawful basis: legitimate interests in maintaining website security (Article 6(1)(f)).

I do not use your contact details for unsolicited marketing newsletters, and I never sell, rent, or trade personal data to third parties.

3. Who I share your information with

I do not share your personal information with third parties except where necessary to operate this website, deliver coaching services, or comply with legal obligations:

Service providers (data processors)

The following trusted providers process limited personal data on my instructions and under data protection agreements:

• Cloudflare: Provides website hosting, content delivery, DNS, the Cloudflare Turnstile spam check on the contact form, and email delivery for contact form messages.
• Microsoft: Provides email hosting (Outlook) used to send, receive, and store correspondence.
• Zoom or Microsoft Teams: Provides the video call platform used to conduct remote consultations and coaching sessions.
• SortaSystems: Maintains the technical infrastructure of this website. SortaSystems does not store, access, or read client messages or coaching records.

Banking providers

Payments are made by direct bank transfer. My UK bank processes payment transactions as an independent data controller under UK banking and financial regulations.

Legal and safeguarding disclosures

Everything discussed in coaching sessions is kept confidential. I will only disclose personal information without your prior consent in the following exceptional circumstances:

• where I reasonably believe there is an immediate, serious risk of harm to you or to another person, in order to protect vital interests (Article 6(1)(d) and Article 9(2)(c) UK GDPR) or fulfil safeguarding responsibilities; or
• where disclosure is required by UK law, statutory safeguarding duties, or a court order (Article 6(1)(c) UK GDPR).

If I discuss coaching work during professional supervision, no identifying personal data is shared.

4. International data transfers

Some of the service providers listed above (such as Cloudflare, Microsoft, and Zoom) operate global infrastructure and may process data outside the United Kingdom. Where personal data is transferred outside the UK, it is protected by safeguards recognised under UK GDPR, including UK adequacy regulations (such as the UK Extension to the EU–US Data Privacy Framework), the UK International Data Transfer Agreement (IDTA), or standard contractual clauses.

5. How long I keep your information

I keep personal data only for as long as necessary for the purpose for which it was collected, or to meet legal and tax record-keeping requirements:

When the applicable retention period ends, personal data is permanently deleted.

6. Cookies and spam protection

This website does not use advertising, tracking, or behavioural analytics cookies, and no cookies are set when you browse the page.

When you use the contact form, the site loads Cloudflare Turnstile to verify that the form is being submitted by a person rather than an automated bot. Turnstile checks technical signals from your browser (such as your IP address and browser environment) without using tracking cookies. Further details are available in Cloudflare’s Privacy Policy.

7. Data security

I take appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, or disclosure:

• All traffic between your browser and this website is encrypted using HTTPS (TLS).
• Messages submitted through the contact form are sent directly to my email inbox and are not stored in a website database.
• Email accounts and devices used to hold client notes and records are encrypted, password-protected, and secured with two-factor authentication.
• Session notes are stored separately from billing records wherever practical.

8. Your data protection rights

Under the UK GDPR and the Data Protection Act 2018, you have the right to:

• Request access to a copy of the personal data I hold about you (a Subject Access Request).
• Request rectification of any inaccurate or incomplete personal data.
• Request erasure of your personal data where there is no lawful basis for me to continue holding it (note that financial records must be retained for 6 years by law).
• Request restriction of how I process your personal data in certain circumstances.
• Request data portability, receiving the personal data you provided to me in a structured, commonly used, machine-readable format.
• Object to processing where I rely on legitimate interests as my lawful basis.
• Withdraw consent at any time where processing is based on your consent, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please email lucy.lancashire@hotmail.co.uk. I will respond within one calendar month. There is normally no fee for exercising your rights.

9. Questions and complaints (ICO)

If you have any questions or concerns about this Privacy Policy or how your personal data is handled, please contact me first at lucy.lancashire@hotmail.co.uk so I can address the issue.

You also have the right to lodge a complaint with the UK supervisory authority for data protection:

10. Changes to this policy

I may update this Privacy Policy from time to time to reflect legal, technical, or operational changes. The current version is always published on this page with the ‘Last updated’ date shown at the top.