Reflect to Achieve Coaching - Data Privacy Notice

Reflect to Achieve Coaching is the name I trade under. I am committed to protecting and respecting your privacy. This Privacy Policy explains how I collect, use, and safeguard your personal data when you visit my website, use my contact form, book an introductory coaching call or contact me directly.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, I am the Data Controller for your personal information.

My contact details

Sarah McAllister at hello@reflecttoachievecoaching.com

CLIENTS AND ENQUIRIES

What information I collect and the lawful basis I use to do so

If you make an enquiry or become a client, whether directly or via my website, I use the lawful bases of contract and legitimate interest to collect the following personal information:

· Names and contact details (email address and/or telephone number)

· Purchase or service history

· Payment details (including card or bank information for transfers and direct debits)

· Financial transaction information

· Information relating to compliments or complaints

· Correspondence

· Records of consent, where appropriate

I also use those lawful basis to collect or use the following special category information. This information is subject to additional protection due to its sensitive nature:

· Brief notes of information shared by client during coaching sessions which may include information such as beliefs, sexual orientation, financial, health and relationship situations. I usually keep this information anonymised and will delete six months after our final coaching session.

I use the lawful basis of consent to collect the following personal information:

· Call recordings if required and agreed between us.

· Testimonials voluntarily provided.

· Name and email address for newsletters for non-clients when you explicitly opt-in to receive these.

Why do I collect the above information

I collect the information in order to provide the contracted services and for dealing with queries, complaints or claims. It is required in order to arrange appointments, take payments, carry out coaching services, keep legally required records such as accounts and to submit tax returns.

I also use the information for my legitimate interest such as:

· Being able to offer clients services or keep in touch (if they have given me consent to be on a mailing list).

· Keeping logs of the coaching hours I build up as evidence for my coaching certification and to apply for accreditation with the professional coaching bodies. The coaching bodies usually ask for anonymized logs, but may request contact details of clients in order to be able to contact them and verify that they did receive coaching from me.

· My personal development and reflection. When having mentoring or supervision I may share information about coaching sessions with my mentor/supervisor, however, I will never share details revealing who the client is.

· Promoting my services by including testimonials (provided with consent) on a website and/or leaflets.

The lawful bases for collecting data and your rights

As mentioned above I use three bases for collecting personal information. An explanation of these bases is set out below:

· Consent - I have permission from you after I gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

· Contract – I have to collect or use the information so I can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.

· Legitimate interests – I am collecting or using your information because it benefits me without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability.

You can find out more about lawful bases and your data protection rights below and on the Information Commissioner’s Office (ICO) website.

Where I get personal information from

· Directly from you or via website contact/booking forms that you have completed

· From payment systems/bank statements

· From Optimus Coaching Academy (as provided by you to them)

How long I keep information

For clients: I will keep information for the previous 7 tax years, unless I am legally required to keep it longer. I delete any rough notes that I have taken during sessions six months after our final session.

Enquiries & bookings: If you do not proceed with coaching after our introductory call, your contact details will be securely deleted within 6 months.

Newsletter subscribers: I will retain your name and email address for as long as you remain subscribed. If you unsubscribe, your details are immediately removed from the active mailing list.

Who I share data with

I do not sell, rent, or lease your personal data to third parties. I will disclose any information I collect, use or receive if required or permitted by law, such as to comply with a subpoena or similar legal process, and when I believe in good faith that disclosure is necessary to protect my rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.

To run my business efficiently, I share data with trusted service providers:

Hostinger: Hosts my website and processes form submissions securely.

Google: I keep my diary on Google Calender and may send meeting invitations and use Google Meet for calls.

Microsoft: I use Outlook for managing emails and may use Teams for arranging calls.

How I keep your data secure

Your data is kept on encrypted USB drives and my log with your name and email address is additionally password protected on those drives.

Email correspondence is stored in Outlook and Hostinger and therefore rely on the security put in place by Microsoft and Hostinger. See their full security terms. In brief, they secure information you provide on computer servers in a controlled, secure environment, protected from unauthorized access, use, or disclosure. they keep reasonable administrative, technical, and physical safeguards to protect against unauthorized access, use, modification, and personal data disclosure in its control and custody. However, no data transmission over the Internet or wireless network can be guaranteed.

USE OF WEBSITE

If you simply view my website reflecttoachievecoaching.com, Hostinger automatically collects certain information about your device, including information about your web browser, IP address, time zone, and some of the installed cookies on your device. Additionally, as you browse the Site, Hostinger collects information about the individual web pages or products you view, what websites or search terms referred you to the Site, and how you interact with the Site. They refer to this automatically-collected information as “Device Information.”

Their top priority is customer data security, and, as such, they may process only minimal user data, only as much as it is absolutely necessary to maintain the website. Information collected automatically is used only to identify potential cases of abuse and establish statistical information regarding website usage. This statistical information is not otherwise aggregated in such a way that it would identify any particular user of the system.

You can visit the website without telling us who you are or revealing any information, by which someone could identify you as a specific, identifiable individual. If, however, you wish to use some of the website’s features, or you wish to receive my newsletter or provide other details by filling a form, you may provide personal data to us, such as your email, first name, last name, city of residence, organization, telephone number. You can choose not to provide us with your personal data, but then you may not be able to take advantage of some of the website’s features. For example, you won’t be able to receive my newsletter or contact me directly from the website. If you do provide data via the website, please see previous section “clients and enquiries”.

My website may contain links to other websites that are not owned or controlled by us. Please be aware that I am not responsible for such other websites or third parties' privacy practices. I encourage you to be aware when you leave my website and read the privacy statements of each website that may collect personal information.

Hostinger secures information you provide on computer servers in a controlled, secure environment, protected from unauthorized access, use, or disclosure. They keep reasonable administrative, technical, and physical safeguards to protect against unauthorized access, use, modification, and personal data disclosure in its control and custody. However, no data transmission over the Internet or wireless network can be guaranteed.

HOW TO COMPLAIN

If you have any concerns about my use of your personal data, you can make a complaint to me at hello@reflecttoachievecoaching.com.

If you remain unhappy with how I’ve used your data after raising a complaint with me, you can also complain to the ICO.

The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint

FURTHER INFORMATION ON LAWFUL BASES AND DATA PROTECTION RIGHTS

Under UK data protection law, I must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK General Data Protection Regulations. You can find out more about lawful bases on the ICO’s website.

Which lawful basis I relay on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which my apply on the ICO’s website.

· Your right of access - You have the right to ask us for copies of your personal information. You can request other information such as details about where I get personal information from and who I share personal information with. There are some exemptions which means you may not receive all the information you ask for. Read more about the right of access.

· Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. Read more about the right to rectification.

· Your right to erasure - You have the right to ask us to delete your personal information. Read more about the right to erasure.

· Your right to restriction of processing - You have the right to ask us to limit how I can use your personal information. Read more about the right to restriction of processing.

· Your right to object to processing - You have the right to object to the processing of your personal data. Read more about the right to object to processing.

· Your right to data portability - You have the right to ask that I transfer the personal information you gave us to another organisation, or to you. Read more about the right to data portability.

· Your right to withdraw consent – When I use consent as our lawful basis you have the right to withdraw your consent at any time. Read more about the right to withdraw consent.

If you make a request, I must respond to you without undue delay and in any event within one month. To make a data protection rights request, please contact me using the contact details at the top of this privacy notice.

Last updated

27 August 2026