1. Introduction

This Privacy Policy explains how Denise Hayden-Hawkins (“I”, “me” or “my”) collects, uses, stores and protects personal information when you visit my website, contact me, subscribe to communications, purchase or access a course, programme or digital product, complete an assessment or form, or participate in coaching services.

I am committed to handling personal information responsibly, transparently and in accordance with applicable UK data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025, together with applicable electronic communications legislation.

This Privacy Policy applies to clients, prospective clients, customers, course and programme participants, subscribers, website visitors and individuals who otherwise interact with my business.

2. Who Is Responsible for Your Personal Information?

For personal information collected through my website, forms, funnels, course area, coaching services and other business activities, Denise Hayden-Hawkins is the data controller.

This means that I determine why and how your personal information is processed.

Website: denisehh.com
Email: [email protected]

My website, customer relationship management system, forms, funnels and course area are supported by Coach Foundation, which acts as a data processor on my behalf in relation to personal information collected through these services.

3. Personal Information I May Collect

Depending on how you interact with me, I may collect:

• your name;
• email address;
• telephone number;
• billing and transaction information;
• information you provide when making an enquiry;
• information provided when booking or participating in coaching;
• information submitted through questionnaires, assessments, forms or diagnostic tools;
• course and programme registration information;
• course progress and participation information;
• communications between you and me;
• feedback and testimonials where provided;
• information relating to appointments and attendance;
• website and technical information such as IP address, browser information, device information and cookie or visitor-tracking data; and
• any other information you choose to provide during our professional relationship.

I aim to collect only information that is reasonably necessary for the relevant purpose.

4. Special Category Personal Information

Coaching conversations can sometimes involve information of a personal or sensitive nature.

Depending on what you voluntarily choose to discuss or disclose, this could include information concerning health, racial or ethnic origin, religious or philosophical beliefs, sexual life or sexual orientation, or other information treated as special category personal data under UK data protection law.

I do not require you to disclose special category information unless it is genuinely relevant to the service being provided.

Where I intentionally process special category personal information, I will ensure that there is both an appropriate lawful basis under UK GDPR and an applicable condition permitting the processing of special category data.

Where appropriate, I may seek your explicit consent.

You are not required to disclose information that you do not wish to share, subject to any information reasonably necessary for me to provide the service safely and appropriately.

5. How I Use Personal Information

I may use your personal information to:

• respond to enquiries;
• arrange and deliver coaching services;
• administer coaching relationships;
• provide courses, programmes, assessments and digital products;
• create and manage customer or participant accounts;
• process and administer purchases;
• communicate about bookings, programmes or purchases;
• provide customer support;
• maintain appropriate business and coaching records;
• manage cancellations and rescheduling;
• send requested resources;
• send marketing communications where permitted;
• improve my services, courses and website;
• maintain the security and operation of my website and systems;
• respond to data protection requests or complaints;
• comply with legal, regulatory, insurance, accounting or professional obligations; and
• establish, exercise or defend legal claims where necessary.

I will not use personal information for purposes that are incompatible with the purposes for which it was collected unless permitted by law.

6. Lawful Bases for Processing

Under UK data protection law, I must have a lawful basis for processing personal information.

Depending on the circumstances, I may rely on:

Contract – where processing is necessary to enter into or perform a contract with you, for example when you purchase a course or engage me for coaching.

Legitimate interests – where processing is reasonably necessary for the operation, administration, security or development of my business and those interests are not overridden by your rights and interests.

Consent – where you have given clear consent for a particular purpose.

Legal obligation – where processing is necessary for me to comply with a legal requirement.

In limited circumstances, other lawful bases recognised under UK data protection law may apply.

Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

7. Coaching Confidentiality and Data Protection

Information shared during coaching is treated as confidential, subject to the terms of my Coaching Agreement and applicable legal and professional obligations.

There may be limited circumstances in which information needs to be disclosed, including where:

• disclosure is required by law or lawful authority;
• there is a serious or imminent risk of harm;
• safeguarding obligations apply;
• you have authorised the disclosure; or
• disclosure is otherwise lawfully required or permitted.

As part of maintaining professional standards, I may discuss coaching matters in professional supervision or mentoring. Where this occurs, identifying information will be removed or minimised wherever reasonably possible.

8. Coaching People Who Know Each Other

Where I separately coach two or more individuals who know each other, including people in a personal or professional relationship, each person is treated as a separate client with a separate confidential coaching relationship.

I will not ordinarily disclose information from one client’s coaching relationship to another without appropriate permission or another lawful basis for doing so.

9. Sharing Personal Information

I do not sell your personal information.

I may share personal information with trusted service providers where reasonably necessary to operate my business and provide my services.

These may include providers supporting:

• website hosting;
• customer relationship management;
• forms and funnels;
• course and membership delivery;
• email and communications;
• file and media storage;
• payment processing;
• appointment scheduling;
• professional administration;
• accounting, legal or insurance services; and
• other technology necessary to deliver my services.

Where a service provider processes personal information on my behalf, appropriate contractual and data-protection arrangements are used where required.

I may also disclose information where required by law, lawful authority, safeguarding obligations or where reasonably necessary to establish, exercise or defend legal claims.

10. Coach Foundation and Technology Providers

My website, CRM, forms, funnels and course area are supported by Coach Foundation.

For personal information collected through these services, I remain the data controller and Coach Foundation acts as a data processor, processing personal information on my instructions.

Coach Foundation currently uses a number of service providers in delivering the platform, including:

HighLevel Inc. (United States) – website hosting, CRM, funnels, forms, membership/course functionality and email/SMS delivery.

Amazon Web Services (United States) – file and media storage.

Google Workspace (United States) – internal document handling by Coach Foundation.

Stripe (United States/Ireland) – payment processing where applicable. Depending on how a payment is processed and the account arrangements in place, Stripe may process information under separate terms applicable to its services.

Coach Foundation has advised that it will notify me before adding a new subprocessor and provides a mechanism for objections where appropriate.

These providers may change from time to time. Where changes materially affect how your personal information is processed, this Privacy Policy will be updated where appropriate.

11. International Transfers

Some personal information collected through my website, CRM, forms and course area is processed or stored outside the United Kingdom.

In particular, Coach Foundation has confirmed that the underlying HighLevel platform is hosted in data centres in the United States.

Where personal information is transferred outside the UK, appropriate safeguards are used where required by UK data protection law.

Coach Foundation has confirmed that transfers to its US-based providers rely, where applicable, on the UK Extension to the EU–US Data Privacy Framework where the relevant provider is certified. Where that mechanism is not applicable, transfers are supported by appropriate contractual safeguards, including the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, together with relevant data processing and security arrangements.

Security measures described by Coach Foundation include encryption in transit and at rest and role-based access controls.

Other service providers I use may also process information outside the UK. Where this occurs, I will take reasonable steps to ensure that appropriate safeguards required by applicable UK data protection law are in place.

12. How Long Personal Information Is Kept

I keep personal information only for as long as reasonably necessary for the purposes for which it was collected, including to:

• provide services;
• maintain appropriate coaching and business records;
• comply with legal, tax, accounting, insurance or professional obligations;
• deal with complaints;
• establish, exercise or defend legal claims; and
• maintain necessary records of transactions and consent.

Different types of information may therefore be kept for different periods.

Information held within my Coach Foundation-supported account is retained while the account remains active unless I delete particular records sooner.

Coach Foundation has advised that if my account is terminated, I can export relevant contacts, orders and course-member information before closure. Coach Foundation states that the account will be closed and deleted within 30 days following termination, with residual backup copies subsequently removed in accordance with the underlying platform’s standard backup cycle.

Deletion from one active system may not always result in immediate deletion from secure backup systems where temporary retention is technically necessary or legally permitted.

I will periodically review the personal information I hold and delete or anonymise information that is no longer reasonably required.

13. Security

I take reasonable organisational and technical steps to protect personal information against unauthorised access, alteration, disclosure, loss or misuse.

I also use third-party service providers that implement security measures appropriate to their services.

Coach Foundation has confirmed that its platform arrangements include measures such as encryption in transit and at rest and role-based access controls.

No internet-based system can, however, be guaranteed to be completely secure.

14. Your Data Protection Rights

Depending on the circumstances, UK data protection law may give you rights including the right to:

• request access to personal information held about you;
• request correction of inaccurate or incomplete information;
• request deletion of personal information in certain circumstances;
• request restriction of processing;
• object to certain processing;
• request transfer of information in certain circumstances;
• withdraw consent where processing relies on consent; and
• raise a complaint about how your personal information has been handled.

These rights are not absolute and may be subject to legal conditions or exemptions.

To exercise a data protection right, contact: [email protected]

I may need to verify your identity before acting on a request.

Where information is held through my Coach Foundation-supported platform, I can access, correct, export or delete contact records as appropriate. Coach Foundation can provide technical assistance where necessary.

15. Data Protection Complaints

If you have a concern or complaint about how I have handled your personal information, please contact me in the first instance at: [email protected]

I will handle data protection complaints in accordance with applicable UK data protection requirements.

I will acknowledge a data protection complaint within 30 days, investigate it appropriately, keep you informed where necessary, and provide an outcome without undue or unjustifiable delay.

Further information about my complaints process is available in my separate Data Protection Complaints Procedure.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.

You do not have to contact me before raising a concern with the ICO, although I welcome the opportunity to resolve concerns directly where possible.

16. Marketing Communications

Where permitted by law, I may send information about my coaching services, courses, programmes, resources, events or related services.

Where consent is required, I will ask for it appropriately.

You may unsubscribe from marketing communications at any time by using an unsubscribe facility provided in the communication or by contacting: [email protected]

Withdrawing from marketing communications will not prevent me from sending service-related communications that are necessary for an existing booking, purchase, programme or coaching relationship.

17. Cookies and Similar Technologies

My website uses cookies and similar technologies.

Some cookies are strictly necessary for the website to function. The platform may also use first-party visitor-tracking technology.

Other technologies, such as analytics, advertising or social-media tracking tools, may be used if they are added to the website.

Where consent is required under applicable UK law for non-essential cookies or similar technologies, those technologies should not be activated until the appropriate consent has been obtained.

A cookie consent mechanism may therefore be displayed when you visit the website.

Further details about cookies and similar technologies may be provided through the website’s cookie notice or cookie settings.

18. Payments

Where you purchase a coaching service, course, programme or digital product, payment information may be processed through a third-party payment provider such as Stripe.

I do not need to receive or retain your complete payment-card details where these are processed directly by the payment provider.

The payment provider processes information in accordance with the legal and contractual terms applicable to its service.

I may retain transaction information such as your name, amount paid, product or service purchased, transaction date, payment status and other information reasonably required for accounting, administration, customer service or legal purposes.

19. Courses, Programmes, Assessments and Digital Products

When you register for or purchase a course, programme, assessment, intensive or digital product, I may process information necessary to:

• register your purchase;
• provide access;
• administer your participation;
• record progress where the platform supports this;
• communicate with you about the product or programme;
• provide associated coaching or support where included;
• maintain transaction and participation records; and
• deal with questions, complaints or contractual matters.

This includes products and programmes offered within my Self-Trust and Identity Shift ranges.

Where a product includes a questionnaire, assessment or diagnostic exercise, the information you provide will be processed for the purpose of delivering and administering that resource and any associated services.

Specific contractual terms relating to purchases, access, cancellation and refunds are contained in my Course & Programme Terms and Conditions and Refund Policy.

20. Testimonials and Case Studies

I will not publish an identifiable testimonial, client story or case study for promotional purposes without an appropriate lawful basis and, where required, your permission.

Where permission has been given, you may contact me if you later wish to discuss continued use. Withdrawal of consent does not affect processing that was lawful before consent was withdrawn, and other legal considerations may apply depending on the circumstances.

Where possible, information may be anonymised.

21. Children

My coaching services, courses and programmes are primarily intended for adults unless expressly stated otherwise.

I do not knowingly seek to collect children’s personal information through adult services.

If a service is offered to a person under 18, appropriate arrangements relating to consent, safeguarding, privacy and contracting will be considered before the service begins.

22. Changes to This Privacy Policy

I may update this Privacy Policy from time to time to reflect changes in my services, technology, service providers or legal requirements.

The latest version will be made available through my website and the “Last updated” date will be amended accordingly.

Where a change materially affects how personal information is processed, I will take appropriate steps to bring the change to the attention of affected individuals where required.

23. Contact

If you have questions about this Privacy Policy, how your personal information is handled, or wish to exercise your data protection rights, please contact:

Denise Hayden-Hawkins
Email: [email protected]
Website: denisehh.com