Privacy Notice

Who is responsible for your information?

Emma Ross Transformational Coaching and Consultancy Limited is the data controller responsible for personal information processed in connection with this website and the professional services I provide.

The company is registered with the Information Commissioner's Office (ICO). I am Emma Ross, the named data protection contact for the company and the person responsible for overseeing its data protection arrangements.

You can contact me about your personal information, data protection rights or privacy concerns using the business email address or telephone number provided in the footer of this website.

I handle personal information in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and relevant amendments.

---

What information do I collect?

The information I collect depends on the reason you contact me and the services you choose to use. It may include:

• Your name and contact details.
• Information included in enquiries, correspondence and appointment bookings.
• Information supplied during an initial conversation or through intake documents.
• Professional agreements, appointment records and relevant session notes.
• Information about your circumstances, goals and experiences that is relevant to our agreed work.
• Information about purchases, invoices, payments and financial transactions.
• Information you provide when subscribing to my mailing list.
• Technical information processed when you use this website or external booking and communication services.

Where appropriate, I may also request an emergency contact or other information necessary for professional and safeguarding arrangements.

I aim to collect only information that is relevant and necessary for the purpose for which it is requested.

---

Information used in coaching, counselling and supervision

Coaching, counselling and professional supervision are distinct services, and the information needed for each will reflect the nature and purpose of our agreed work.

Coaching may involve information about your business, career, leadership, professional responsibilities, goals, decisions and wider personal circumstances. I aim to collect and record only what is relevant to our work. Occasionally, sensitive personal information may also arise.

Counselling may involve information about your emotional wellbeing, physical or mental health, personal history, relationships and life experiences. Some of this information receives additional protection under data protection law.

Professional supervision involves information about a practitioner's professional work, development, ethical responsibilities and client relationships. Information about individual clients should be limited to what is necessary for meaningful professional reflection and supervision.

I maintain appropriate professional records to support continuity, reflection, professional accountability and the safe and effective delivery of services.

---

Where does your information come from?

Most information comes directly from you, through enquiries, bookings, correspondence, questionnaires and professional sessions.

Occasionally, information may be provided by a professional referrer, an organisation commissioning services or another person involved in an appropriate referral.

Where information is received from another source, I consider whether it is appropriate to collect and use it, what confidentiality obligations apply and what privacy information needs to be provided.

---

Why do I use personal information?

Personal information is used for purposes connected with providing and administering my services, including:

• Responding to enquiries and considering whether a service is suitable.
• Booking, managing and communicating about appointments.
• Establishing professional agreements and delivering agreed services.
• Maintaining appropriate professional records and continuity of work.
• Managing purchases, payments, accounts and other business administration.
• Meeting legal, professional and safeguarding responsibilities.
• Responding to concerns, complaints and data protection requests.
• Sending newsletters or other marketing communications where an appropriate lawful basis exists.

Information collected through confidential professional work is not automatically used for marketing or mailing lists.

---

The lawful basis under Article 6 depends on the purpose of the processing and is considered separately from any additional condition required for special-category information under Article 9.

For example, information needed to provide an agreed coaching service may be processed on the basis of contractual necessity under Article 6, while particular sensitive information may require explicit consent or another applicable condition under Article 9.

---

Sensitive and special-category information

Some personal information receives additional protection under UK data protection law. This includes information about physical or mental health, alongside other categories specified in the UK GDPR.

Where I process special-category information, I must have an appropriate lawful basis under Article 6 of the UK GDPR and an additional condition under Article 9.

Counselling

Counselling may involve processing information about physical or mental health as part of providing therapeutic care.

The health or social care condition under Article 9(2)(h) of the UK GDPR, together with the relevant provisions of the Data Protection Act 2018, is applicable where its legal requirements are met, including the necessary duties of professional confidentiality.

Coaching

Business, leadership and career coaching do not automatically constitute health care or treatment.

I aim to minimise the collection and recording of special-category information in coaching. Where such information is necessary for an agreed purpose, an appropriate Article 9 condition is required.

Explicit consent under Article 9(2)(a) may be appropriate in these circumstances. Where relied upon, this requires a clear, specific and informed agreement to the processing. Simply choosing to share personal information during a conversation does not, by itself, constitute explicit consent.

Professional supervision

Professional supervision may involve sensitive information about a supervisee or information relating to their professional client work.

Identifying information is minimised wherever practicable, and any processing of special-category information must have an appropriate legal basis and Article 9 condition relevant to its purpose.

Other circumstances

In limited circumstances, different Article 9 conditions may apply, including where processing is necessary for the establishment, exercise or defence of legal claims.

I consider what information is genuinely necessary, the purpose for which it is processed and the confidentiality and data protection responsibilities that apply.

---

Confidentiality and professional supervision

Confidentiality is an important part of my professional relationships with clients and supervisees.

Information shared during coaching, counselling or supervision is treated confidentially, subject to applicable law and the limits explained in the relevant professional agreement.

As part of maintaining ethical and accountable practice, I discuss aspects of my client work within my own professional supervision.

I normally refer to clients by their first name or initial and limit other identifying details wherever practicable. These discussions take place within a professional relationship that is itself subject to confidentiality.

Using a first name or initial does not necessarily make information anonymous, as an individual may sometimes be identifiable from other circumstances. I remain mindful of this when deciding what information is necessary to share.

---

When might information need to be disclosed?

Confidentiality is not absolute. There may be circumstances where information must or may appropriately be disclosed because of legal requirements, serious safeguarding concerns or other significant professional responsibilities.

Decisions about disclosure are considered carefully, with attention to the nature of the concern, the legal basis for sharing and the potential consequences.

Any disclosure will be limited to information that is necessary and proportionate to the circumstances.

Where appropriate and possible, I will discuss concerns and proposed disclosures with you.

Information may also need to be provided to professional advisers, insurers, relevant authorities or other appropriate parties where a valid legal or professional basis exists.

---

Continuity arrangements and unexpected absence

I recognise the importance of appropriate arrangements for clients if illness, incapacity or other unexpected circumstances prevent me from continuing my professional work.

In such circumstances, limited personal information may need to be accessed or shared with an appropriately designated professional to contact affected clients and support suitable continuity or ending arrangements.

Any access or disclosure would be limited to what is necessary and handled in accordance with confidentiality, data protection and relevant professional responsibilities.

---

Which external services do I use?

I use external services to support communication, appointments, payments, website operation and business administration.

These include:

• Future Internet Services for website hosting and a business email account.
• Google Gmail for business email correspondence.
• Proton Mail for exchanging confidential counselling documentation, including professional agreements, completed intake forms and other sensitive correspondence.
• Google Calendar for scheduling and appointment availability.
• Calendly for arranging Clarity Calls and relevant appointments.
• Zoom for online professional sessions.
• MailerLite for mailing list subscriptions and email communications.
• Stripe for card and online payments.
• ThriveCart for product, sales and checkout pages.
• WhatsApp for initial enquiries and appropriate practical communication.

I also use Apple Mail on my laptop to access my website-associated business email account.

Different providers may act as processors or independent controllers for different activities. I consider the relevant privacy, confidentiality and security arrangements when using their services.

Further information about online communication, booking arrangements and digital services is provided in my separate Digital Policy.

---

Pre-session questionnaires

Some services involve collecting information before an appointment to help us make effective use of our time together.

For The Mighty 90, I provide an editable Word questionnaire by email for you to complete and return before your session.

The questionnaire allows you to reflect on the circumstances you want to explore and provides a starting point for our coaching conversation.

Your responses are treated as confidential client information and managed in accordance with the applicable professional record-keeping arrangements.

As email has security limitations, please contact me if you are concerned about sending sensitive information by this method.

---

Payments, financial records and accountants

When you purchase a service or product, relevant information may include your name, contact details, billing information, purchase details and payment transaction information.

I use Stripe for card and online payment processing. Some purchases are made through checkout pages provided by ThriveCart.

I use HRA Accounting to support the company's accounting, financial reporting and tax obligations.

For these purposes, I provide relevant business financial records, including bank statements. These may contain client names, payment references, dates, transaction amounts and other financial information.

This information is shared for accounting and legal compliance purposes, not for the provision of coaching, counselling or professional supervision.

My accountants have their own legal, professional and confidentiality responsibilities in relation to information handled through their services.

---

International processing and transfers

Some external services used by my business operate internationally. Depending on the provider and its arrangements, personal information may be stored, processed or accessed outside the United Kingdom.

Where international transfers are subject to UK data protection requirements, an appropriate legal transfer mechanism must be in place.

Depending on the destination and circumstances, this may involve applicable UK adequacy regulations or recognised contractual safeguards.

You can contact me if you would like further information about international processing relevant to your personal data and the applicable safeguards.

---

How is personal information stored and protected?

I take appropriate steps to protect personal information against unauthorised access, loss, misuse and inappropriate disclosure.

Paper professional records are stored in lockable filing cabinets.

Electronic professional records are stored using an encrypted USB drive. Backups are maintained separately on an external drive kept in a locked filing cabinet.

Where appropriate, identifying client information is maintained separately from brief professional session notes.

Business email is managed through a dedicated Gmail account and an email account supplied by my website hosting provider. Two-step verification is enabled on the Gmail account.

Email correspondence is deleted when no longer needed for its relevant purpose, taking account of any applicable professional or legal retention requirements.

I also consider the security and privacy arrangements of external services used in operating the business.

No system can guarantee complete security, but I remain responsible for taking appropriate steps to protect personal information within my care.

---

How long is information retained?

Different types of personal information are retained for different periods, depending on their purpose and any applicable legal or professional requirements.

Professional client records

Relevant coaching, counselling and professional supervision records are normally retained for seven years after the professional work ends. This period reflects my professional indemnity insurer's requirements.

Information may need to be retained for longer in particular circumstances, such as an unresolved complaint, safeguarding concern or legal claim.

Enquiries that do not lead to professional work

If you enquire about my services but decide not to proceed, I will normally retain relevant enquiry information for up to six months after our last substantive contact.

It will then be securely deleted unless there is a justified reason to retain it longer.

Financial records

Relevant accounting, payment and transaction records are retained for the periods required under applicable company, accounting and tax law. This will commonly involve at least six years, although some circumstances require longer.

Mailing list information

Subscription information is generally retained while you remain subscribed to the mailing list.

If you unsubscribe, information used for active marketing is removed or updated. Limited information may be retained where necessary to respect your preferences and demonstrate compliance.

Bookings and administration

Booking and administrative information is retained according to its purpose, including whether it forms part of a professional record, financial record or routine correspondence.

Information is securely deleted or anonymised when it is no longer required, subject to applicable obligations.

---

Mailing lists and marketing

If you choose to join my mailing list, I use MailerLite to send information about my services, resources and professional interests.

You can unsubscribe at any time using the link included in marketing emails.

Becoming a coaching, counselling or supervision client does not automatically subscribe you to marketing communications.

Confidential professional records are kept separate from mailing list activities.

---

Website information and cookies

My website is hosted by Future Internet Services. As with other websites, hosting and related systems may process technical information associated with website access, such as IP addresses and requests made to the server.

I do not currently use Google Analytics to track visitor activity on this website.

Some external services, including the embedded Calendly booking facility, may use cookies or similar technologies.

The Calendly facility may require cookie permissions before it can display and function.

Where consent is required for cookies or similar technologies, it must be obtained before the relevant technologies are used.

If you do not wish to use the Calendly booking facility, you can contact me directly using the details in the footer to discuss an appointment.

Further information is available in my Digital Policy.

---

Is providing information compulsory?

You can make an initial enquiry without providing detailed personal information.

However, some information is necessary to arrange appointments, establish a professional agreement, provide an appropriate service or meet legal responsibilities.

If necessary information is not provided, I may be unable to arrange an appointment or deliver a particular service appropriately.

Where you are unsure why information is requested, you are welcome to ask before providing it.

---

Your data protection rights

UK data protection law gives individuals a number of rights concerning their personal information.

Depending on the circumstances, these may include:

• The right to be informed about how information is collected and used.
• The right to request access to personal information held about you.
• The right to request correction of inaccurate or incomplete information.
• The right to request deletion of information in appropriate circumstances.
• The right to request restriction of processing in certain circumstances.
• The right to data portability where the legal requirements are met.
• Rights relating to certain forms of automated decision-making.
• The right to withdraw consent where processing relies on consent.

These rights are not absolute. Some records may need to be retained or processed for valid legal or professional reasons.

Requests can be made using the business contact details in the website footer. I will respond within the applicable legal timeframe, normally one calendar month, subject to any permitted extension or relevant exception.

Your right to object

You have the right to object to certain processing based on legitimate interests. Whether processing must stop depends on the circumstances and applicable law.

You have the right to object to the use of your personal information for direct marketing at any time.

---

Questions, concerns and data protection complaints

If you have questions or concerns about how your personal information is handled, or wish to make a data protection complaint, please contact me using the business email address or telephone number in the footer of this website.

I will acknowledge a data protection complaint within 30 days of receipt, take appropriate steps to investigate it without undue delay and communicate the outcome.

You also have the right to raise concerns with the Information Commissioner's Office (ICO).

Information about making a complaint is available through the ICO complaints service.

---

Changes to this Privacy Notice

I review this notice when relevant changes occur in my professional services, information handling arrangements or applicable law.

Updated information will be published on this website, and significant changes will be brought to affected individuals' attention where required.