Privacy Policy | Hannah Crawford Coaching

1. Who is responsible for your information?

Hannah Crawford Coaching is the coaching business operated by Hannah Crawford.

The data controller for this website and the coaching services is Thistle And Rose Arts Limited, company number 12486449, trading as Hannah Crawford Coaching, provided that the company is the entity determining the purposes and means of the relevant processing.

Registered office: C/O Atek Accounting Solutions Ltd, Locke King House, 2 Balfour Road, Weybridge, Surrey, England, KT13 8HD.

For privacy questions, requests or complaints, email contact@hannahcrawford.org.

This policy explains how personal information is collected, used, stored and shared when you visit hannahcrawford.org, use a free resource, complete the quiz, enquire about coaching, purchase a product or work with Hannah.

2. The information we collect

Depending on how you interact with the business, we may collect:

Your name and email address.
Your quiz answers, scores and result.
Whether you agreed to receive marketing, the wording shown to you, and the date, time and source of that decision.
Information about your business, website, Instagram account, business history, goals, revenue range and coaching enquiry.
Messages and information you share by email, Instagram DM or WhatsApp.
Booking details, payment status, invoices and purchase history.
Coaching session recordings, transcripts, notes, goals, milestones and resources.
Information you choose to discuss during coaching, which may include health information, disability, neurodivergence, relationships, personal history or other sensitive information.
Technical information generated when you visit the website, including cookie preferences and analytics information where you have consented.
Information needed to provide digital content, manage your account or access, handle customer service and meet legal obligations.

Please do not include sensitive personal information in an application unless you consider it necessary for your enquiry.

3. How we use your information and our lawful bases

We only use personal information for specified purposes and where a lawful basis applies.

Website operation and security

We use necessary technical information to deliver the website, maintain security, troubleshoot errors and prevent misuse.

Lawful basis: legitimate interests in operating a secure, functional website, balanced against your rights and expectations. Where necessary, processing may also be required to comply with legal obligations.

Quiz: Discover Your Biggest Business Block

We use your answers to calculate your quiz scores and result. If you provide your name and email address, we use these details to deliver the result you requested and unlock the full result.

We store the result, scores, timestamps, marketing consent status and relevant consent wording version in Netlify Forms and MailerLite. Your browser may also store a local record that you have unlocked the result, so you are not asked to unlock it again on the same device.

The quiz is a business reflection tool. It is not a diagnosis or a verdict on your personality.

Lawful basis: taking steps at your request to provide the result, and legitimate interests in administering the quiz and preventing unnecessary repeat collection. Where the information is processed for marketing, we rely on your separate consent.

Free audio and PDF

We use your name and email address to deliver the audio, send its backup link or deliver the PDF you requested.

Lawful basis: taking steps at your request to provide the resource. We do not require marketing consent to deliver it.

Email marketing

If you actively tick the optional marketing box, we use your details to send the welcome sequence, relevant follow-up emails and occasional marketing about Hannah’s resources, coaching and offers.

We record your consent, its wording version, source and timestamp. You can unsubscribe at any time.

Lawful basis: consent under UK GDPR and the applicable electronic marketing rules. We do not treat a quiz retake, application or client relationship as fresh marketing consent.

If you buy The Sanctuary, we may send you a small number of emails about our similar coaching services (the “soft opt-in”), unless you tick the box at checkout to say you’d rather not. You can unsubscribe from these at any time.

Coaching applications and enquiries

We use your application information to review your enquiry, assess whether coaching may be suitable, respond to you and arrange a chemistry call.

We may contact you by email or Instagram DM where appropriate to respond to your enquiry.

Lawful basis: taking steps at your request before entering a contract. We may also rely on legitimate interests in managing enquiries and keeping proportionate records.

Please avoid including information that is unnecessary to your enquiry.

Coaching delivery

If you become a client, we use your contact details, business information, goals, session notes and related records to provide coaching, arrange sessions, maintain your Notion hub, respond to you and administer the coaching relationship.

Lawful basis: performance of the coaching contract and, where applicable, legitimate interests in managing the relationship and maintaining appropriate records.

Sensitive information shared during coaching

You may choose to discuss information about health, disability, neurodivergence or other matters that fall within special categories of personal data.

We do not need this information for every coaching interaction. Where it is necessary to process special category data, we will identify and document a valid Article 9 UK GDPR condition before processing it. Where appropriate, we will ask for your explicit consent, separately from the coaching contract and marketing consent. You may decline to share information that is not necessary for coaching.

If you withdraw explicit consent, we will stop processing the relevant special category information on that basis. This will not make earlier lawful processing unlawful. We may need to retain limited records where another lawful basis or condition applies, such as a legal obligation or the establishment, exercise or defence of legal claims.

We do not provide clinical treatment, diagnosis or medical care.

Session recordings and transcription

With your knowledge, coaching sessions may be recorded and transcribed using Google Meet and tl;dv. The resulting recordings and transcripts may be stored in your private Notion hub and used to support coaching, document agreed actions and maintain continuity between sessions.

We will explain the recording arrangement before recording begins. If a session includes special category data, the applicable lawful basis and Article 9 condition will be established before that processing takes place.

You can choose not to be recorded. If you do, sessions go ahead as normal, but you won’t receive session recordings, transcripts or Hannah’s written notes, and your Notion hub won’t be kept up to date with them.

We do not use recordings or transcripts to train our own AI models.

Purchases, bookings and payments

We use purchase and booking information to process payments, provide access to The Sanctuary, manage single-session bookings, administer coaching packages, issue invoices, handle refunds or cancellations and provide customer support.

Stripe processes card payments. We do not receive or store your full card details.

TidyCal manages bookings for single sessions. GoCardless collects monthly Direct Debit instalments for coaching payment plans. Xero is used for invoicing and accounting.

Lawful basis: performance of a contract and compliance with legal obligations, including applicable tax and accounting requirements.

AI tools

Hannah uses Claude, an AI assistant provided by Anthropic, for business administration and drafting. For coaching clients, session notes and transcripts are processed with Claude so that Hannah can organise them into each client’s private Notion hub (summaries, actions, goals and milestones).

Claude is used under Anthropic’s commercial terms for business accounts, and client information is not used to train Anthropic’s models. Where session material includes special category information, it is processed only on the basis explained in “Sensitive information shared during coaching” above.

Hannah reviews everything Claude produces. AI tools do not replace Hannah’s responsibility for coaching decisions or client confidentiality.

Legal obligations and disputes

We may use or retain relevant records to comply with legal obligations, maintain accounts, respond to lawful requests, prevent fraud or establish, exercise or defend legal claims.

Lawful basis: legal obligation or legitimate interests, depending on the purpose.

4. Who receives your information?

We use service providers to operate the website, deliver resources, communicate with clients and administer the business. Depending on the service you use, information may be processed by:

Netlify: website hosting and quiz form submissions.
Google: Google Workspace email, Google Meet sessions, Google Fonts and Google Analytics 4, subject to your cookie preferences.
MailerLite: resource delivery, email marketing, subscriber records and consent management.
Flodesk: existing subscriber information while the migration to MailerLite is completed and the account remains active.
Stripe: payment processing for The Sanctuary.
GoCardless: Direct Debit instalments for coaching payment plans.
TidyCal: single-session bookings.
Notion: private client hubs, notes, goals, milestones and resources.
tl;dv: session recording and transcription.
WhatsApp and Meta/Instagram: client support, enquiries and arranging calls.
Zapier and Captivate: automating The Sanctuary purchase-to-access process and sending private-feed invitations.
Xero: invoices, accounting and financial records.
Anthropic: Claude AI assistance, where information is entered into that service.

Your external accountant may receive relevant financial records through Xero or another secure process.

These providers act in different capacities depending on the service. Where a provider processes personal data on our behalf, we will put the required contractual data protection arrangements in place. Some providers may also process information for their own purposes under their own privacy policies.

We do not sell your personal information. We do not use your website activity for advertising or remarketing.

We may disclose information where required by law or to professional advisers where necessary.

5. International processing and transfers

Some service providers may store or access information outside the United Kingdom, including in the United States or the European Economic Area.

Before relying on an international transfer, we will check the provider’s current data-processing terms, hosting locations and applicable transfer mechanism. Where required, we will use an applicable UK adequacy regulation, appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum, or another lawful transfer mechanism. Where required for the chosen safeguard, we will complete a data protection test and apply any additional protections identified.

The countries and mechanisms applicable to each provider depend on its current configuration and contractual terms. You can contact contact@hannahcrawford.org for further information.

6. Cookies and similar technologies

The website uses necessary technologies to provide its functionality and may use Google Analytics 4 to understand website use.

Analytics cookies are not necessary to deliver the basic website. They will only be set after you have given valid consent through the cookie controls. You can refuse analytics cookies without losing access to the website.

The quiz may use local storage to remember that you have unlocked your result. This is separate from analytics cookies. We will assess its precise behaviour and provide appropriate information in the cookie notice.

For details, see the Cookies section below or the cookie information displayed on the website.

7. How long we keep information

We keep personal information only for as long as reasonably necessary for the purposes described above, including applicable legal, accounting and dispute requirements.

Our retention periods are:

Quiz and free-resource records for people who do not consent to marketing: up to 12 months after the last relevant interaction, unless needed sooner for security or legal reasons.
Marketing subscriber records: while consent remains active, with minimal suppression records retained afterwards to honour opt-outs.
Unsuccessful coaching applications: up to 12 months after the enquiry closes, unless a dispute or legal requirement justifies longer retention.
Coaching client notes, recordings and transcripts: during the coaching relationship and for up to 24 months afterwards, subject to a review of what remains necessary and any legal claim requirements.
Financial and tax records: generally six years after the relevant accounting period where required for company accounting and tax purposes, or for the applicable statutory period.
Booking records and customer-service correspondence: generally up to 24 months after the service or enquiry, unless needed for accounting or legal purposes.
Cookie preferences and technical logs: for the shortest period reasonably necessary for consent management, security and troubleshooting.

We will adjust these periods where a shorter or longer period is justified. We will delete or anonymise information when it is no longer needed.

8. Your rights

Subject to the applicable legal conditions and exemptions, you may have the right to:

Request access to your personal information.
Ask us to correct inaccurate information.
Ask us to erase information.
Ask us to restrict processing.
Object to processing based on legitimate interests.
Receive certain information in a portable format.
Withdraw consent where processing relies on consent.
Object to direct marketing at any time.

To exercise a right, email contact@hannahcrawford.org. We may need to verify your identity before responding.

Withdrawing marketing consent will stop future marketing but will not affect the delivery of a resource you have already requested. Objecting to or withdrawing consent for particular processing may affect our ability to provide a particular feature, such as recording a coaching session, but we will explain any practical consequences.

9. Security

We use proportionate technical and organisational measures to protect personal information against unauthorised access, loss, alteration or disclosure. No online service can be guaranteed completely secure.

If a personal data breach occurs, we will assess it and notify the ICO and affected individuals where the law requires.

10. Children

This website and coaching service are intended for adults. We do not knowingly collect children’s personal information for these services.

11. Changes to this policy

We may update this policy to reflect changes to our services, providers or legal obligations. The latest version will be published on this page with its updated date.

12. Complaints

Please contact us first at contact@hannahcrawford.org if you have concerns about how your information is handled.

You can also complain to the Information Commissioner’s Office (ICO):

Website: https://ico.org.uk/make-a-complaint/

Telephone: 0303 123 1113

You have the right to complain to the ICO if you believe your personal information has been handled unlawfully.