1. Who is responsible for your information?

I am Kaye Heyes, and I operate as a sole trader.

I am the data controller for the personal information described in this policy. This means I am responsible for deciding how and why your information is used.

Name: Kaye Heyes
Email: [email protected]
Correspondence address: 170 College Road, Deal, Kent CT14 6BY
Website: kayeheyes.com

This policy applies when you:

visit my website;

contact me or make an enquiry;

complete a form;

book or receive coaching, supervision or another service;

join a programme, workshop, event, course or community;

subscribe to a newsletter, email course or waitlist;

attend an online meeting;

make a payment; or

communicate with me in another way.

2. What information might I collect?

The information I collect will depend on how you choose to work or communicate with me.

Contact information

This may include:

your name;

email address;

telephone number;

postal address;

business or organisation details; and

any other contact information you choose to provide.

Enquiries, applications and bookings

This may include:

the service, course or event you are interested in;

information you enter into an enquiry, application, booking or intake form;

appointment and scheduling information;

messages or emails between us;

your reasons for seeking support;

your goals and what you would like help with; and

relevant information about Access to Work or another funding arrangement.

Coaching and supervision information

If we work together, I may hold:

information you share during our work;

your goals, reflections and agreed actions;

limited notes about sessions;

accessibility or communication preferences;

records of appointments and attendance;

relevant emails or follow-up messages; and

information needed to provide the agreed service.

Personal and sensitive information

Coaching conversations can sometimes include personal information about your:

health or wellbeing;

disability;

ADHD, Autism, AuDHD or another experience of neurodivergence;

access needs;

medication;

emotional wellbeing;

personal circumstances; or

other sensitive parts of your life.

Some of this is legally described as special-category information, which means it is given additional protection.

I will only ask for or use sensitive information where it is relevant to our work together.

Where required, I will ask for your clear and explicit consent before using this information.

Payments

Payments are processed through Stripe.

I may receive limited information connected with your payment, such as:

your name;

email address;

billing address;

payment amount;

payment status;

transaction reference; and

invoice information.

I do not normally receive or store your complete payment-card details.

Website information

When you use my website, certain technical information may be collected, such as:

your IP address;

browser and device type;

pages visited;

the date and time of your visit;

how you arrived at the website;

form submissions;

cookie choices; and

general information about how the website is used.

Marketing information

If you subscribe to emails, I may hold:

your name and email address;

the date you subscribed;

your communication preferences;

records of your consent;

information about emails being opened or clicked, where this feature is enabled; and

information about courses, services or events in which you have expressed an interest.

Session recordings and transcripts

With your permission, I may use Zoom recording or the Fathom AI meeting assistant during some sessions.

Where this is used, the information collected may include:

audio or video;

your Zoom display name;

meeting chat;

a transcript;

an automated summary;

agreed actions;

meeting details; and

information shared during the conversation.

Because sessions can include personal conversations, recordings and transcripts may contain sensitive information. They are treated with the same care and confidentiality as the rest of our work together.

3. How do I collect your information?

I may collect information:

directly from you;

through forms on my website;

through email, telephone or online meetings;

during coaching, supervision, courses, workshops or events;

through booking and payment systems;

from an employer, Access to Work adviser or funding organisation where you have authorised this;

from a professional or referrer where you have given permission;

automatically through website technologies; and

through service providers acting on my behalf.

I will not deliberately seek personal information about you from another person without an appropriate reason.

4. Why do I use your information?

I only use your information where I have a lawful reason to do so.

Responding to enquiries

I may use your information to:

reply to your enquiry;

understand what support you are looking for;

discuss whether a service may be suitable;

arrange an introductory conversation; and

take steps you have requested before we agree to work together.

Legal reason: Taking steps towards a contract and my legitimate interest in responding to genuine enquiries.

Providing coaching, supervision and other services

I may use your information to:

provide the service we have agreed;

understand your goals and circumstances;

make appropriate adjustments;

arrange and manage sessions;

communicate with you;

provide materials or follow-up;

keep appropriate records; and

fulfil the agreement between us.

Legal reason: Providing the service we have agreed or taking steps towards providing it.

Where sensitive personal information is involved, I will normally rely on your explicit consent as the additional legal condition for using it.

Session recording and transcription

Where you have agreed to recording or transcription, I may use it to:

create an accurate summary;

identify agreed actions;

provide helpful follow-up;

support accessibility or information processing needs; and

reduce the pressure to take notes during the session.

Legal reason: Your consent and, where sensitive information is involved, your explicit consent.

Recording or transcription is optional.

You can say no without losing access to the underlying coaching or supervision service. We can continue without Fathom or recording, and I can take appropriate manual notes instead.

You can also change your mind before or during a session.

Processing payments

I may use payment and transaction information to:

process payments;

issue invoices and receipts;

manage instalments or refunds;

maintain financial records; and

meet tax and accounting requirements.

Legal reason: Providing the agreed service and meeting my legal obligations.

Newsletters and marketing

If you choose to subscribe, I may send you:

newsletters;

email courses;

information about events;

programme or service information; and

related updates.

Legal reason: Your consent.

You can unsubscribe at any time by using the unsubscribe link in an email or contacting me.

After you unsubscribe, I may keep a minimal record of your email address on a suppression list. This helps me make sure you are not accidentally added back to the mailing list.

Running and protecting my business

I may use information to:

operate and secure my website;

manage my business;

prevent fraud or misuse;

troubleshoot technical issues;

improve my website and services;

maintain appropriate records; and

protect my legal rights.

Legal reason: My legitimate interests in running and protecting my business, where these do not override your rights.

Testimonials

I will only publish an identifiable testimonial, photograph or case study with your permission.

Legal reason: Your consent.

You can ask me to stop using an identifiable testimonial in future. I will take reasonable steps to remove it from places I control.

5. Confidentiality and sensitive conversations

I treat information shared during coaching and supervision as confidential.

I will not ordinarily share what you tell me without your permission.

There may be limited situations where information needs to be used or shared, including where:

you have asked or authorised me to share it;

there is a serious concern about your safety or someone else’s safety;

there is a safeguarding concern;

I am required to do so by law or court order;

information is needed to obtain legal or professional advice;

it is necessary for an insurance matter or legal claim; or

relevant aspects of my work are discussed in confidential professional supervision.

Where I discuss work in professional supervision, I will minimise or remove identifying information wherever reasonably possible.

Where possible and appropriate, I would discuss a proposed disclosure with you first.

Further information about confidentiality may also be included in our coaching or supervision agreement.

6. Zoom and Fathom

Some meetings and sessions take place through Zoom.

With your explicit permission, I may use Fathom as an AI meeting assistant. It may appear as a participant in the Zoom meeting and can create a recording, transcript, summary or list of agreed actions.

I will always tell you before Fathom or another recording tool is used.

I will explain:

what is being recorded or transcribed;

why it may be helpful;

how the resulting information will be used;

how long it will be kept; and

how you can say no or change your mind.

Fathom will not be used secretly.

Choosing not to be recorded will not prevent you from receiving coaching or supervision.

For group sessions, recording will only take place where an appropriate consent process has been completed for everyone who may be recorded.

AI-generated transcripts and summaries can contain mistakes. I will not treat them as a perfectly accurate or authoritative account without reviewing them appropriately.

7. The trusted systems I use

I use a small number of trusted services to run my website and business.

FEA Create and HighLevel

My website, forms and client-management systems are provided through FEA Create, which uses the HighLevel platform.

Depending on how you interact with me, these systems may process:

your contact details;

enquiries and form submissions;

appointment and booking information;

course or programme registrations;

emails and communication preferences;

records of services you have purchased;

website activity; and

information needed to provide relevant materials or client access.

FEA Create and HighLevel process this information to provide the website, contact-management, booking, email, automation and related systems I use.

Microsoft

I may use Microsoft Outlook and other Microsoft services for:

email;

calendars;

correspondence;

documents; and

secure business administration.

Zoom

Zoom may process meeting and technical information when you attend an online session, meeting or event.

Where recording is enabled with your permission, this may include audio, video, meeting chat or transcripts.

Fathom

Where you have consented to its use, Fathom may process:

meeting audio and video;

transcripts;

summaries;

action points;

meeting metadata; and

attendee information.

Stripe

Stripe processes payments securely.

It may process:

contact and billing details;

payment-card information;

payment and transaction information;

information used to prevent fraud;

refunds; and

payment disputes.

Stripe also has its own responsibilities under data-protection and financial-services law.

Other professional support

Where necessary, information may also be shared with:

accountants or bookkeepers;

insurers;

legal or professional advisers;

professional supervisors;

website, IT or technical-support providers;

event, course or booking platforms;

employers or funding organisations where you have authorised this;

Access to Work contacts where relevant;

law-enforcement bodies, courts or regulators where required; or

a successor to the business if it is sold or restructured, subject to appropriate protections.

Only information reasonably needed for the relevant purpose will be shared.

I do not sell your personal information.

8. Information processed outside the UK

Some of the systems I use are international services and may process or store information outside the United Kingdom.

Where this happens, I take reasonable steps to make sure appropriate safeguards are in place.

These may include:

processing in a country recognised as providing appropriate protection;

approved contractual data-protection terms; or

another transfer safeguard permitted under UK data-protection law.

You can contact me if you would like more information about the safeguards relevant to your information.

9. How long do I keep information?

I only keep personal information for as long as it is reasonably needed.

My normal retention periods are:

General enquiries that do not become clients: up to 24 months after our last meaningful contact.

Applications and waitlist information: up to 24 months, unless you ask me to keep it for longer.

Coaching and supervision agreements, important correspondence and core service records: up to six years after our work ends.

Limited session notes: up to three years after our work ends.

Fathom recordings, transcripts and AI summaries: normally up to 12 months after the session, and deleted sooner where they are no longer needed.

Financial and tax records: normally six years after the end of the relevant financial year, or longer if legally required.

Newsletter and marketing information: until you unsubscribe, withdraw consent or the mailing list is closed.

Marketing suppression records: for as long as needed to respect your request not to receive marketing.

Testimonials: while the testimonial remains in use or until the relevant consent is withdrawn.

Website and cookie information: according to the settings and duration of the relevant technology.

Data-protection requests and complaints: for as long as reasonably needed to respond and demonstrate how the matter was handled.

Information may be kept for longer where reasonably necessary for legal, insurance, safeguarding, regulatory or accounting reasons.

When information is no longer needed, I will securely delete it or anonymise it.

10. How do I protect your information?

I use reasonable technical and organisational measures to protect personal information.

These may include:

password-protected accounts and devices;

multi-factor authentication where available;

restricted access;

secure cloud services;

appropriate software and security updates;

confidentiality arrangements;

limited access to coaching and supervision records;

appropriate agreements with service providers; and

secure deletion and disposal procedures.

No online or storage system can be guaranteed to be completely secure, but I take proportionate steps to reduce the risk of loss, misuse or unauthorised access.

11. Cookies and similar technologies

My website may use cookies and similar technologies.

Some are needed for the website to work properly, including technologies used for:

website security;

forms;

bookings;

page functionality;

remembering your preferences; and

saving your privacy choices.

The website may also use optional technologies for analytics, embedded content or marketing.

Where consent is legally required, optional technologies will not be activated until you have made a choice.

You can review or change your cookie preferences through the website’s cookie banner or preference tool.

More detail about the cookies and technologies currently in use should be provided in the website’s cookie notice.

12. Your choices and rights

Depending on the circumstances, you may have the right to:

ask what personal information I hold about you;

ask for a copy of your information;

ask me to correct inaccurate or incomplete information;

ask me to delete information;

ask me to limit how information is used;

object to certain uses of your information;

receive certain information in a portable format;

withdraw consent;

object to direct marketing; and

ask about safeguards used when information is processed internationally.

These rights are not absolute, and there may be situations where the law allows or requires me to keep or continue using certain information.

To exercise one of these rights, contact:

Email: [email protected]

I may need to confirm your identity before providing personal information.

I will normally respond within one month. I will let you know if I need more information or if the law allows additional time.

Your right to object

You can object at any time to your information being used for direct marketing.

If you object, I will stop using your information for that purpose.

You may also object where I rely on legitimate interests. I will consider your circumstances and stop the relevant use unless there is a strong lawful reason to continue.

Withdrawing consent

Where I rely on your consent, you can withdraw it at any time.

This includes consent for:

marketing;

testimonials;

the use of sensitive personal information; and

session recording or AI transcription.

Withdrawing consent does not affect anything that was lawfully done before you withdrew it.

In some circumstances, withdrawing consent to the use of information that is essential to a service may mean I am unable to continue providing that part of the service. I will explain this clearly if it applies.

13. Questions or concerns about your information

If you have a question or concern about how I have used or looked after your personal information, please contact me.

You do not need to use legal language or complete a complicated form. Simply explain what has concerned you and include any information that may help me look into it.

You can contact me by:

Email: [email protected]

Post:
Kaye Heyes
170 College Road
Deal
Kent
CT14 6BY

If you make a data-protection complaint, I will:

confirm that I have received it within 30 days;

take appropriate steps to investigate it without unnecessary delay;

keep you informed where appropriate; and

explain the outcome once my review is complete.

I hope I will be able to resolve any concerns directly, openly and fairly.

You also have the right to raise a concern with the Information Commissioner’s Office, which is the UK regulator for data protection.

You do not have to contact me before approaching the ICO, although they may ask whether you have already tried to resolve the matter directly.

14. Automated decisions

I do not use your information to make solely automated decisions that have a legal or similarly significant effect on you.

My systems may perform routine automated actions, such as:

sending a booking confirmation;

providing access to materials;

sending an email you requested; or

recording an administrative preference.

These routine actions do not make significant decisions about you.

15. Links to other websites

My website may contain links to websites or services operated by other organisations.

I am not responsible for how those organisations handle personal information. You should review their privacy information before providing information to them.

16. Changes to this policy

I may update this policy when:

my services change;

I begin using a new system;

my data-handling practices change; or

data-protection law or guidance changes.

The latest version will be published on my website with an updated revision date.

Where a significant change affects existing clients or subscribers, I will take reasonable steps to bring it to their attention.

17. Contact me

Questions about this policy or how I use personal information can be sent to:

Kaye Heyes
Email: [email protected]
Correspondence address: 170 College Road, Deal, Kent CT14 6BY