Privacy Policy
Last updated: 21 September 2026
Your privacy matters to me. This policy explains, in plain terms, what personal information I collect when you visit my website, get in touch or work with me, why I need it, how I look after it, and the rights you have. I only collect what I need, I keep it safe, and I never sell it.
Who I am
Susan Forrest Coaching and Consulting Ltd (“I”, “me”, “my”) is a company registered in the United Kingdom under company number SC901283, with its registered office at 1 Trinity Grove, Edinburgh, EH5 3HB. I am the “data controller” for the personal information described in this policy, which means I decide how and why it is used.
You can contact me about anything in this policy at susan@susanforrestcoachingandconsulting.co.uk.
What I collect, why, and my legal basis
UK data protection law requires me to have a lawful basis for using your information. Here is what that looks like in practice:
| Who / when | What I collect | Why I use it | Lawful basis |
|---|---|---|---|
| You contact me through my website | First and last name, email address and your message | To read and reply to your enquiry | Legitimate interests (responding to people who contact me) |
| You are a client or business contact | Name, email, phone number, organisation, job title, contracts, proposals and our correspondence | To agree and deliver coaching, consulting, facilitation or workshops, and manage our relationship | Contract, or steps taken at your request before a contract; legitimate interests |
| You take part in coaching or a programme | Goals, development plans, psychometric assessments and session notes, where relevant | To support your development and keep good professional records | Contract; legitimate interests |
| You join mindfulness teaching | Intake information, including relevant health information | To check that mindfulness practice is safe and suitable for you, and to adapt it where needed | Contract; explicit consent for health information |
| I invoice or pay you | Invoice, payment and accounting records | To get paid, pay suppliers and meet tax and accounting duties | Legal obligation |
| You ask to hear from me | Name and email address | To send occasional updates, insights or event information | Consent |
| You visit my website | IP address, browser and device details, and pages visited (through cookies) | To keep the site secure and working, and to understand what is useful to visitors | Legitimate interests for essential cookies; consent for all others |
Health information for mindfulness
Mindfulness practice is not right for everyone in every circumstance, so before I teach it I ask some questions about your health, including relevant physical and mental health, as part of an intake process. I do this only to check that it is safe and suitable for you to take part, and to adapt the practice where needed. This is “special category” information, so I ask for your explicit consent before collecting it, use it only for this purpose, keep access restricted to me, and hold it no longer than necessary. You do not have to answer, but without this information I may not be able to offer you mindfulness teaching. You can withdraw your consent at any time by emailing me. If you choose to share other health or wellbeing information in coaching or consulting, I will treat it with the same care.
Marketing
I will only send you updates if you have asked me to. Sending an enquiry through my contact form does not add you to a mailing list. You can unsubscribe at any time using the link in any message, or by emailing me.
If you choose not to give me the details on my contact form, I may not be able to reply to your enquiry.
Confidentiality
Confidentiality is at the heart of coaching and consulting. What you share with me in sessions is treated as confidential and used only for the purpose of our work together. The only exceptions are where I am legally required to disclose information, or where there is a serious risk of harm to you or to someone else.
Who I share your information with
I do not sell your personal information. I only share it where it is needed to run my business, with trusted providers who act on my instructions and must keep it secure. These include:
- my website host, Netlify
- Microsoft 365 (email, calendar and cloud storage)
- my accountants and other professional advisers, and my accounting and payment providers
Sometimes I work as an associate for another organisation. In that case, the organisation that engages me is usually responsible for the information it shares with me, and its own privacy notice will also apply.
I may also disclose information where the law requires it, or to protect legal rights. Some of my providers may handle information outside the UK. Where they do, I make sure appropriate safeguards are in place, as UK data protection law requires.
How long I keep your information
I keep personal information only for as long as I need it and then delete it securely. In general:
- Website enquiries and general enquiries: up to 12 months
- Client records, including coaching, mindfulness and project records: 7 years after our work ends, for professional practice and to deal with any claims
- Contracts and financial records: 6 years, to meet legal and tax requirements
- Marketing updates: until you unsubscribe or withdraw consent
I may keep information for longer if the law requires it, or if a complaint or legal claim is ongoing.
How I keep it safe
I use appropriate technical and organisational measures, including password protection, multi-factor authentication where available, secure cloud storage, regular software updates and restricted access. No system is completely secure, but I take reasonable care to protect what you share with me.
Cookies
Cookies are small text files placed on your device when you visit a website. My website uses strictly necessary cookies to keep it secure and working properly, and these do not need your consent. I only use other cookies, such as analytics that help me understand which pages are useful, if you accept them through the cookie banner. You can change your choice at any time using cookie settings, or through your browser settings. More detail on the cookies used is available from my website host, Netlify: netlify.com/privacy.
Your rights
You have the right to:
- be told how your information is used (this policy does that)
- ask for a copy of the information I hold about you
- ask me to correct anything inaccurate or incomplete
- ask me to delete your information, in certain circumstances
- ask me to restrict how I use your information, or object to it, in certain circumstances
- ask for your information in a portable format, where it applies
- withdraw your consent at any time, where I rely on it (this will not affect anything I did before)
I do not use automated decision-making or profiling. To use any of your rights, email me at the address above. There is no charge, and I will respond within one month. I may need to check your identity first.
If you have a concern
I would like the chance to put things right, so please contact me first. I will acknowledge your complaint within 30 days and respond as quickly as I can. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.
Other things to know
Children. My services are for adults, and I do not knowingly collect information from anyone under 18.
Other websites. My website may link to other sites. This policy does not cover them, so please read their privacy policies.
Changes. I review this policy regularly and will post any updates on this page, with a new “last updated” date.