Updated: 21 October 2026
Who we are and what this notice covers
Herdwick & Goose Limited is responsible for deciding how the personal data described in this notice is used. We are the data controller. Our registered company number is 11618342. You can contact us about privacy at finance@herdwickandgoose.com or by post to Herdwick & Goose Limited, c/o Wil Ames, 31 Dashwood Avenue, High Wycombe, Buckinghamshire HP12 3DZ.
This notice explains how we handle personal data when you enquire about, book or take part in our coaching, training, digital programmes and consultancy. It applies to individual participants and business contacts, including sole traders and people booking on behalf of organisations. Buying as a business does not remove your rights over your personal data.
What we collect and where it comes from
We collect information you provide through enquiries, application forms where used, Calendly bookings, correspondence, purchases and participation in our services. This may include your name, contact details, professional and business information, information supplied to assess an application, booking and attendance details, payment and invoice information, coaching goals, session notes and feedback. Payment and service providers may also give us transaction, booking or access information needed to administer your purchase.
Where a session is recorded or transcribed, the information may include your voice, image, contributions, chat messages, transcript and session summary. Online platforms also process technical information needed to provide their services, as described in their privacy notices.
Depending on what you choose to discuss, coaching notes and recordings may contain special-category data, such as information about physical or mental health, beliefs, ethnicity or sexual life or orientation. A request for a compassionate cancellation may also involve limited health information. We ask you to avoid providing unnecessary sensitive details or identifiable information about other people.
Contact and booking information may be needed to arrange and deliver your service, and financial information may be needed to take payment or meet legal requirements. If essential information is not provided, we may be unable to accept or fulfil a booking. Optional recording and marketing choices are explained separately below.
How we use your information and our legal grounds
We use personal data to register you, arrange and deliver the services you request, provide access and resources, manage payment, and communicate about your booking. Where you contract with us personally, our legal ground is performance of that contract or taking steps at your request before entering it. Where your organisation is the customer, our legal ground for handling its representatives’ details is our legitimate interest in administering and delivering that business relationship.
We use relevant information to manage enquiries, feedback, complaints, security and unpaid fees, and to establish, exercise or defend legal claims. Our legal ground is our legitimate interest in operating and protecting our business, resolving problems and recovering sums owed, except where a legal obligation applies. We use financial records to meet applicable tax, accounting and other legal obligations.
Where we rely on explicit consent to handle special-category coaching information, we seek a clear, specific choice covering that information. The Article 6 basis for information necessary to provide your personally contracted coaching is performance of the contract; the additional Article 9 condition for special-category information is your explicit consent. Optional private-session recording and transcription rely on consent, with explicit consent where special-category information is involved. Your separate consent form explains these choices.
For a compassionate refund request, we ask only for reasonable, proportionate evidence. If health information is necessary, we seek explicit consent to use it to assess the request; you may redact unrelated details. We do not use health information for marketing. If sensitive information is needed for a legal claim, we may instead rely on the legal-claims condition to the extent permitted by law.
Application forms
Where an application is required for a programme or service, we use the information you provide to assess your suitability, communicate the outcome and, if accepted, arrange and deliver the service. We receive forms by email and retain application records in restricted-access folders, including Dropbox. Signed documents are also retained in Adobe cloud storage. Where we assess an application at your request before you enter a contract personally, our legal ground is taking steps at your request before entering a contract. For applications made on behalf of an organisation, our legal ground is our legitimate interest in assessing and administering the proposed business relationship.
We do not routinely request health or allergy information on educational application forms. Please avoid supplying unnecessary sensitive information or identifiable information about other people. If you need participation adjustments, contact us privately. Where health information is necessary to arrange an adjustment, we explain its use and seek explicit consent where that is the applicable condition. We review older application records and remove health details that are no longer needed. Any necessary retention for a legal claim is limited to relevant information and subject to the applicable legal-claims condition.
Private coaching recordings and summaries
We use Zoom for online sessions, live transcription and My Notes. With your agreement, automated transcription and AI-assisted note preparation help us prepare a coaching summary. We check the summary and send it to you within 24 hours of your private coaching session. Necessary client notes, personal information and retained summaries are stored in Cliniko. We explain these uses before recording or transcription starts.
Recording and transcription of private coaching are optional. You can decline either, ask us to stop during a session, or withdraw consent for future processing by contacting us. We can keep necessary written coaching notes without recording you. We will explain if withdrawing consent to sensitive-data processing affects the coaching we can continue to provide. Withdrawal does not affect processing lawfully carried out before it was withdrawn.
Private coaching recordings, transcripts and summaries are not made available to other customers as training replays. Temporary Zoom notes and transcripts help us check summaries and respond to session-related questions. They follow the creation-based retention settings explained below; a coaching programme continuing for several months does not restart those periods. Where a separate audio or video recording is agreed, we explain its purpose and apply its own retention arrangements.
Group sessions and training replays
If a group session or training event will be recorded, we tell participants before recording and explain who will receive the replay and how long access will last. Contributions included in a replay may be seen or heard by customers entitled to access that programme. Our Terms of Business provide six months’ access by default, unless a shorter period or no replay is clearly stated before purchase.
We explain how you can attend without contributing identifiable material, where the session format allows. We obtain the consent required for optional identifiable contributions used in replays, and explicit consent before including special-category information where we rely on that condition.
Please respect other participants’ confidentiality. Participants must not record sessions, take screenshots or share others’ contributions or personal information without the permissions required by our Terms, subject to disclosures required by law. We cannot guarantee the conduct of every participant. Contact us promptly about an unauthorised disclosure or if you wish to discuss withdrawing a contribution from future use.
Recorded lectures and Vimeo
We use Vimeo to host pre-recorded teaching content and provide a direct Vimeo link for you to watch it on Vimeo. These lectures contain teaching content rather than recordings of client sessions or identifiable client accounts. Your access to purchased content lasts for the period stated before booking.
When you follow a Vimeo link, Vimeo processes information about your visit and viewing, which may include your IP address, device and browser details, playback activity and cookies or similar technologies. Vimeo is responsible for its own processing as described in its privacy policy and the choices available on its service. Where we receive viewing information from Vimeo, we use only what is necessary to administer access, support delivery and understand engagement with our content. Our legal grounds are performance of your contract or our legitimate interests in delivering and improving our services, as applicable; we obtain consent where required.
Learning and professional development
We keep general reflections about coaching techniques for professional learning. These learning notes do not contain client names, identifying details, linked references or recognisable accounts of a client’s circumstances.
We only treat material as anonymous where people are no longer identifiable by means reasonably likely to be used, including through other information available to us. Removing a name alone is insufficient. Any information that remains identifiable is personal data and is subject to the relevant lawful basis, special-category condition where applicable, security and retention requirements in this notice.
Who receives your information
Access is limited to people and service providers who need the information for the relevant purpose. We use Calendly for scheduling; Zoom for online sessions, recordings, transcription and notes; Cliniko for coaching client records; Adobe for electronic signatures and signed-document storage; Dropbox and Microsoft OneDrive for document storage and sharing; our email provider for correspondence and returned forms; and Vimeo for video hosting and viewing. We also use Microsoft Word and Excel to create and manage client and administrative documents and spreadsheets, which may be stored on our computers or in the cloud services above. Provider privacy information is linked below. These links supplement this notice and do not replace our responsibility for our use of your information.
We use QuickBooks Online, provided by Intuit, for accounting and financial administration. It processes relevant customer and business contact details, invoices, payments and transaction records. Our legal grounds are compliance with applicable tax and accounting obligations and our legitimate interests in administering our business finances. Intuit processes information on our behalf and, for certain purposes including product improvement, analytics, fraud prevention and security, as an independent controller under its Global Privacy Statement. Financial records follow the retention arrangements below.
We also use payment providers, including Stripe and PayPal where offered, and may receive payment by bank transfer. For an eligible product sold by an identified merchant of record, that merchant handles its own sale and related personal-data processing under the information provided at checkout. We receive the information needed to deliver and administer the product. A provider may act on our instructions for some activities and as an independent controller for others.
Where necessary and lawful, we may share relevant information with IT support, professional advisers including lawyers, accountants, auditors and insurers, banks, HMRC and other authorities, or parties involved in a sale or transfer of our business. We limit disclosures to what is needed and apply the relevant confidentiality and data-protection requirements. Independent controllers, including authorities and some professional advisers, have their own legal responsibilities. We will not share your details with third parties for their own marketing without your express consent.
QuickBooks Online Intuit Global Privacy Statement
International transfers
Our providers and their support teams or subcontractors may process personal data outside the UK, including in the EEA, United States and Australia. Storage location and overseas access depend on the provider and account arrangements.
Where a restricted international transfer is made, it must be covered by applicable UK adequacy regulations, appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum to the EU Standard Contractual Clauses, or a legally permitted exception. Reliance on the UK-US Data Bridge requires the recipient and relevant processing to be covered by it. Where required, a transfer risk assessment or data protection test must support the safeguards. You may contact us for details of the arrangements applicable to your information and how to obtain a copy of the relevant safeguards.
How long we keep information
We will only keep personal data for as long as necessary for the purposes for which we collected it, including applicable legal, accounting and reporting requirements. The appropriate period depends on the type of record, sensitivity, service provided, outstanding questions or complaints, legal obligations and the need to establish, exercise or defend legal claims.
Zoom My Notes: our deletion setting uses the note’s creation date. At 60 days, the note moves to Zoom Trash, where it remains recoverable for a further 30 days before Zoom’s permanent-deletion process. Starred notes are not exempt. We may delete material sooner when it is no longer needed; the recovery period is not an additional period of routine coaching use.
Zoom transcripts: we have set transcript deletion to 90 days. Zoom describes My Notes transcript deletion as permanent deletion without an additional Trash period; an associated transcript may be deleted earlier when its note is deleted. My Notes transcripts and separate Zoom meeting transcripts have distinct settings. The retention period runs under the applicable transcript setting, rather than from the final session of your programme. The 90-day setting is a maximum scheduled period, not a promise of access for the whole period. Provider processing of scheduled deletion may take additional time.
Separate private coaching audio or video recordings: our deletion setting moves these recordings to Zoom Trash 60 days after creation. They remain recoverable there for a further 30 days before Zoom’s permanent-deletion process. These settings are managed separately from My Notes and transcript settings. We may delete recordings sooner when they are no longer needed to check your summary or respond to related questions. The period runs from the recording’s creation, not from the final session of a coaching programme.
A specific legal obligation, complaint or legal claim may justify retaining necessary information beyond a normal deletion date. In that case we preserve only relevant information, limit access and use, and review the need when the matter is resolved. We do not extend routine Zoom retention simply by starring a note or starting another session. Necessary client records and retained summaries are kept in Cliniko under the criteria below.
Client notes and summaries in Cliniko: these may need to be kept longer than the source recording to support ongoing coaching and an appropriate record of the service. We assess retention against the factors above, including any applicable insurer requirements, and review the need when the client relationship ends and when any complaint or claim is resolved.
Training replays: we retain recordings for the access period agreed for the programme and review any further need after that period. A client access period is not a promise that every provider backup disappears on the same day.
Application forms and signed documents: we retain relevant information for as long as necessary to assess the application, administer any resulting service, meet applicable legal and accounting obligations, and deal with related complaints or establish, exercise or defend legal claims. We review the need after the application decision, when the resulting client relationship ends and when any related complaint or claim is resolved. For unsuccessful or withdrawn applications, we keep only what remains necessary to explain the decision, answer related queries or deal with a reasonably anticipated claim. We delete or anonymise information that is no longer needed. Accounting requirements do not automatically justify retaining an entire application form for the same period as financial records.
Financial records: we retain records for the periods required by applicable tax and accounting rules. UK VAT records generally need to be retained for at least six years, with longer periods for certain schemes. This does not mean every coaching note or recording must be kept for six years.
Compassionate cancellation evidence: we keep only what is needed to assess and document the decision and deal with a related query, complaint or claim; unnecessary medical details should be redacted or removed. Marketing preferences and a minimal suppression record may be retained to respect an opt-out. Genuinely anonymous learning material may be retained without a personal-data retention limit.
Deletion from an active account does not necessarily mean immediate deletion from recovery folders or provider backups. Recovery folders and backups are distinct. Zoom Trash remains recoverable during its stated period. Residual provider backups follow the provider’s deletion cycle and must be put beyond ordinary use while awaiting secure deletion or overwriting. We explain applicable limitations when handling an erasure request; a provider’s permanent-deletion label is not a guarantee that every backup or separately downloaded copy is immediately erased. We consider note history, attachments, exports and local copies when removing identifiable material.
Marketing
We may send information about our services where this is permitted by applicable marketing and data-protection laws. For email marketing to individual subscribers, including sole traders and some partnerships, we obtain consent unless the customer soft opt-in applies. That exception requires us to have obtained the address directly during a sale or negotiations, market our own similar services, and offer an opt-out both when collecting the address and in every subsequent marketing message.
Where the law permits marketing based on legitimate interests, our interest is in promoting relevant services and developing our business. We respect applicable rules in the recipient’s location. You can object to direct marketing at any time, free of charge, using the unsubscribe option or by contacting us. We will stop using your personal data for that purpose. Service messages needed for your booking are separate from marketing.
Security and your rights
We are committed to protecting your personal data. We limit access to those who need it and use appropriate technical and organisational measures. No online system can guarantee absolute security. We will investigate suspected personal-data breaches and notify the relevant regulator and affected people where legally required.
Depending on the circumstances and the legal basis used, you may request access, correction, deletion, restriction, portability or object to processing. These rights are subject to applicable conditions and exemptions. Where we rely on consent, you may withdraw it at any time by contacting us, without affecting the lawfulness of earlier processing. You have an absolute right to object to direct marketing.
Please contact finance@herdwickandgoose.com to exercise your rights or update your details. We respond without undue delay and normally within one calendar month. If verification of identity is reasonably needed, the statutory period is calculated in accordance with the applicable rules. We may pause the response period to seek clarification where reasonably required, and may extend it for complex or numerous requests where the law allows; we will explain any applicable extension. Searches for subject-access requests are reasonable and proportionate.
Complaints and changes
If you are unhappy with our handling of your personal data, please contact Wil Ames at finance@herdwickandgoose.com or at the postal address above. We will acknowledge a data-protection complaint within 30 days, investigate appropriately without undue delay, keep you informed as appropriate and communicate the outcome. You also have the right to complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/. This does not require you to waive any right to approach the regulator. Where another jurisdiction’s data-protection law applies, additional rights or routes to a regulator may be available.
We may update this notice from time to time to reflect changes in our services, systems or legal obligations. We provide material changes where appropriate, including before a new use of personal data where legally required. The current notice is available from us on request and at the privacy link supplied with your booking.