Privacy Policy

1. Who We Are

The data controller is Phill Hanlon, trading as Phill Hanlon Coaching International, based in Wales, United Kingdom.

Contact: [email protected] — +44 (0)7482 426530

2. What Personal Data We Collect

Information you give us directly

• Full name and contact details (email address, telephone number, postal address)
• Information submitted via our contact, discovery-call or enquiry forms
• Coaching and therapy session notes and records
• Health and wellbeing information relevant to the services you request
• Payment and billing information (processed securely by our payment provider)

Information collected automatically

• Technical data such as IP address, browser type and version, time zone and operating system
• Usage data including pages visited, time spent on pages and referring URLs
• Cookie data (see Section 9 below)

3. How We Use Your Personal Data

We only use your personal data where we have a lawful basis to do so under UK GDPR Article 6 (and Article 9 for special category data). Our purposes and legal bases are:

• Responding to your enquiry or booking request — Legitimate interests / Pre-contractual steps
• Delivering coaching, hypnotherapy, NLP or Time Line Therapy® services — Performance of a contract
• Maintaining client session records — Legal obligation / Legitimate interests
• Sending service-related communications (appointment reminders, follow-ups) — Performance of a contract / Legitimate interests
• Sending marketing communications (where you have opted in) — Consent
• Improving our website and services — Legitimate interests
• Complying with legal and regulatory obligations — Legal obligation

Where we process special category data (such as health information) in the context of therapy or coaching, we rely on Article 9(2)(h) UK GDPR and Schedule 1, Part 1 of the Data Protection Act 2018, or on your explicit consent.

4. How Long We Keep Your Data

We retain personal data only for as long as necessary for the purposes described in this policy, or as required by law. Our standard retention periods are:

• Client session records and associated personal data: 7 years from the date of the last session (in line with professional practice standards)
• Enquiry and contact form data (where no engagement follows): 12 months
• Financial and billing records: 6 years (HMRC requirement)
• Marketing consent records: until consent is withdrawn, plus 1 year
• Website analytics data: 26 months (rolling)

5. Who We Share Your Data With

We do not sell your personal data. We may share it with trusted third parties only where necessary:

• IT and hosting providers who support the operation of this website (data processed under contract with appropriate safeguards)
• Payment processors for billing purposes (independent data controllers under their own privacy policies)
• Professional supervisors or consultants, under strict confidentiality obligations
• Law enforcement or regulatory authorities where required by law

Where any third party is located outside the UK, we ensure appropriate safeguards are in place (such as UK adequacy decisions or standard contractual clauses) before transferring your data.

6. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:

• Right of access: Request a copy of the personal data we hold about you (a Subject Access Request).
• Right to rectification: Ask us to correct inaccurate or incomplete data.
• Right to erasure: Ask us to delete your data where there is no compelling reason for us to continue processing it.
• Right to restrict processing: Ask us to pause processing your data in certain circumstances.
• Right to data portability: Where processing is based on consent or contract, request your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interests, including direct marketing.
• Right to withdraw consent: Where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, please contact us at [email protected]. We will respond within one calendar month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction or alteration, including:

• Encrypted transmission of data via HTTPS/TLS
• Access controls limiting who can view client records
• Secure storage of physical records with restricted access
• Regular review of our security practices

No method of transmission over the internet is completely secure. In the event of a data breach likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and inform you without undue delay where required.

8. Children's Privacy

Our services are directed at adults aged 18 and over. We do not knowingly collect personal data from children under 18. If you believe a child has provided us with personal data, please contact us immediately and we will take steps to delete it.

9. Cookies

Our website uses cookies — small text files placed on your device — to enable core functionality, remember your preferences and (where you have consented) analyse how visitors use the site.

Strictly necessary cookies are required for the website to function and cannot be switched off. They do not require your consent.

Analytics and performance cookies help us understand how visitors interact with the site. These are only set with your consent, which you can give or withdraw via the cookie banner displayed on your first visit.

You can also manage cookies through your browser settings. Disabling certain cookies may affect the functionality of the site.

10. Links to Other Websites

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites. We encourage you to read the privacy policy of any website you visit.

11. Changes to This Policy

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page.

Continued use of our website or services after any changes constitutes acceptance of the updated policy.

12. Contact Us

If you have any questions, concerns or requests regarding this privacy policy or the way we handle your personal data, please contact us:

• By email: [email protected]
• By telephone: +44 (0)7482 426530
• By post: Phill Hanlon Coaching International, Wales, United Kingdom