4. How Long We Keep Your Data

Data type > Retention period

• Enquiry / contact form data > 2 years from last contact, then deleted

• Mailing list data > Until you unsubscribe or withdraw consent, then deleted within 30 days

• Coaching client data (notes, correspondence) > 3 years from end of coaching relationship, then securely deleted

• Financial / billing records > 6 years from the end of the relevant tax year (UK HMRC requirement)

• Website analytics / technical data > As set by the analytics provider (see clause 7); typically 14 months

• Testimonials > Until you ask us to remove them, or we update the Website

We regularly review the data we hold and delete or anonymise anything we no longer need.

5. Who We Share Your Data With

We do not sell your personal data to third parties. We share data only where necessary to operate our business, and only with the following categories of recipient:

●      Payment processors (e.g. Stripe, PayPal): to process your payments securely. Your payment details go directly to the payment processor and are not stored by us.

●      Email marketing platforms (e.g. Mailchimp, Flodesk, or similar): to manage and send our mailing list. Your name and email are stored on these platforms in accordance with their own privacy policies.

●      Scheduling and video-conferencing tools (e.g. Acuity, Calendly, Zoom, Google Meet): to manage session bookings and deliver coaching calls.

●      Website hosting and analytics providers: to host the Website and help us understand how it is used (e.g. Squarespace, Wix, Webflow, Google Analytics).

●      Cloud storage providers: to store our files and correspondence securely (e.g. Google Workspace, Dropbox).

●      Professional supervisors and advisers: on a strictly anonymised basis and only to the extent required for our ethical practice or legal obligations.

●      Law enforcement or regulators: where we are legally required to do so.

Where our third-party providers process your data, they do so as data processors acting on our instructions, and are bound by their own data protection obligations. We select providers with reasonable care and require that they maintain appropriate security standards.

6. International Transfers of Your Data

Some of our third-party providers are based outside the UK or process data on servers located outside the UK. Where your data is transferred outside the UK, we ensure that appropriate safeguards are in place — for example, the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or an adequacy decision by the UK Secretary of State.

The countries most commonly involved are the United States (via providers such as Mailchimp, Stripe and Zoom, which operate under UK-approved transfer mechanisms or adequacy frameworks) and countries in the European Economic Area (which benefit from UK adequacy decisions).

You can request details of the specific safeguards in place for any transfer by contacting us at hello@andreyasparrow.com.

7. Our Key Third-Party Processors

We currently use, or may use, the following categories of processor. This list is not exhaustive; we will update it as our tech stack evolves. You should review the privacy policy of each relevant provider for full details of how they handle your data.

●      Website platform (e.g. Squarespace / Wix / Webflow / WordPress): hosts the Website and may collect technical and analytics data.

●      Email marketing (e.g. Mailchimp / Flodesk / ActiveCampaign): stores and sends our mailing list communications.

●      Payment processing (e.g. Stripe / PayPal): processes card and online payments.

●      Scheduling (e.g. Acuity Scheduling / Calendly): manages session bookings.

●      Video conferencing (e.g. Zoom / Google Meet): delivers coaching sessions.

●      Analytics (e.g. Google Analytics): tracks website usage in aggregated, anonymised form where possible.

●      Cloud storage (e.g. Google Workspace / Dropbox): stores documents and correspondence.

[Update this list with the specific providers you use before publishing.]

8. Cookies and Similar Technologies

Cookies are small text files placed on your device when you visit a website. We use them to make the Website work properly, to understand how it is used, and — only with your consent — for analytics and marketing purposes.

8.1 Strictly necessary cookies

These are essential for the Website to function. They do not require your consent under PECR. They are used for things like session management, security and load balancing.

8.2 Analytics / performance cookies (consent required)

These help us understand how visitors use the Website — for example, which pages are visited most often and whether visitors get error messages. We only set these if you consent via the cookie banner when you first visit the Website. If you use Google Analytics, data is anonymised where possible and retained for [14] months.

8.3 Marketing / tracking cookies (consent required)

These may be set by our email marketing platform or by third-party advertising pixels (for example, Facebook Pixel or Pinterest Tag) if we use them. They allow us to understand whether our marketing is effective. We only set these with your consent.

8.4 Managing cookies

You can control and delete cookies through your browser settings at any time. You can also withdraw your consent to non-essential cookies at any time by clearing your cookies and declining again when the banner reappears. Note that disabling certain cookies may affect how the Website functions.

For more information about cookies and how to manage them, visit www.allaboutcookies.org or www.ico.org.uk.

[IMPORTANT: You must implement a cookie consent banner or management tool on the Website before launch to comply with PECR. This policy describes what the banner should do, but you must configure it on your website platform. Popular tools include Cookiebot, CookieYes, and Osano. Your website developer can help.]

9. Your Rights Under UK GDPR

Under UK GDPR you have the following rights in relation to the personal data we hold about you:

●      Right of access: you can ask us for a copy of the personal data we hold about you (a “subject access request”). We will respond within one calendar month.

●      Right to rectification: you can ask us to correct inaccurate or incomplete data about you.

●      Right to erasure (“right to be forgotten”): you can ask us to delete your personal data where there is no good reason for us continuing to hold it (for example, you have withdrawn consent and we have no other lawful basis, or the data is no longer necessary for the purpose it was collected).

●      Right to restrict processing: you can ask us to suspend the processing of your data in certain circumstances (for example, while the accuracy is contested).

●      Right to data portability: where we process your data based on consent or contract, and the processing is automated, you can ask us to provide the data in a structured, commonly used and machine-readable format, or to transmit it to another controller.

●      Right to object: you have an absolute right to object to processing for direct marketing purposes. You also have the right to object to processing based on legitimate interests, though we may be able to continue if we have compelling legitimate grounds.

●      Rights in relation to automated decision-making: we do not make any decisions about you based solely on automated processing that has a significant legal or similar effect on you.

●      Right to withdraw consent: where we rely on consent as our lawful basis, you can withdraw it at any time by contacting us or, for marketing emails, by clicking the unsubscribe link. Withdrawal does not affect the lawfulness of processing before withdrawal.

To exercise any of these rights, please contact us at hello@andreyasparrow.com. We will respond within one calendar month (or within three months for complex or numerous requests, in which case we will tell you within the first month). We will not charge you for exercising your rights unless requests are manifestly unfounded or excessive.

You also have the right to complain to the UK Information Commissioner’s Office (ICO) if you are concerned about the way we handle your personal data. The ICO’s website is www.ico.org.uk and you can call their helpline on 0303 123 1113. We would appreciate the opportunity to address your concern first, so please do contact us before going to the ICO.

10. Children’s Personal Data

Our Website and services are directed at adults. We do not knowingly collect personal data from anyone under the age of 18. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at hello@andreyasparrow.com and we will delete it promptly.

11. Security

We take appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing and accidental loss, destruction or damage. These measures include using secure (HTTPS) connections, access controls, strong passwords, and selecting reputable third-party providers with their own security standards.

However, no transmission of data over the internet is completely secure. While we do our best to protect your personal data, we cannot guarantee the security of data transmitted to the Website, and any transmission is at your own risk.

If we become aware of a data breach that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, will also notify you directly.

12. Links to Other Websites

The Website may contain links to other websites. This Privacy Policy applies only to this Website and our use of your personal data. We are not responsible for the privacy practices of other websites. We encourage you to read the privacy notices of every website you visit.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the “Last updated” date at the top of this page. We may also notify you by email (if you are on our mailing list) where changes are significant. We encourage you to review this page periodically.

14. How to Raise a Concern or Make a Complaint

If you have any concerns about the way we handle your personal data, please contact us first at hello@andreyasparrow.com. We will do our best to resolve the issue promptly.

If you are not satisfied with our response, you have the right to complain to the ICO:

●      Website: www.ico.org.uk

●      Telephone: 0303 123 1113

●      Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF