Privacy Policy
This policy explains how Agistspaceio (trading name used by Theodore White, sole trader) collects, uses, stores, and protects personal data. It applies to all services provided at agistspaceio.digital and to coaching services delivered in person or online.
This policy is written to comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018), and the Privacy and Electronic Communications Regulations 2003 (PECR).
1. Who we are
Data controller: Theodore White (trading as Agistspaceio)
5 Cherry Tree Avenue, Balerno EH14 5AN, England
Email: [email protected]
Phone: +44 7624 817 593
As a sole trader processing personal data for coaching purposes only, Agistspaceio is not required to register with the Information Commissioner's Office (ICO) under the current fee exemption for sole traders who process data for core business purposes only. However, the UK GDPR and DPA 2018 still apply in full.
2. What personal data we collect
Enquiry and booking data
When you complete the contact or booking form, or send an email directly, we may collect: your name, email address, phone number (if provided), and the content of your message.
Client data
During a coaching engagement, we may collect: session notes, goals you share, career and employment context you provide, and any materials you send (CVs, presentations, written work). These are held in confidence and used solely for the purpose of delivering your coaching.
Website usage data
If you have accepted analytics cookies, we collect anonymised data about how you use the website — pages visited, time on page, referral source. This is processed by Google Analytics 4 under a data processing agreement. No personally identifying information is included in analytics data.
Technical data
Your browser sends certain technical data automatically (IP address, browser type, device type). This is logged briefly by our web host for security purposes. We do not use this data for profiling.
3. Legal basis for processing
| Purpose | Legal basis (UK GDPR Article 6) |
|---|---|
| Responding to an enquiry you initiated | Legitimate interests (Art. 6(1)(f)) |
| Delivering coaching sessions you have contracted for | Performance of contract (Art. 6(1)(b)) |
| Keeping session notes to deliver the coaching | Performance of contract / Legitimate interests |
| Analytics (if consented) | Consent (Art. 6(1)(a)) |
| Complying with legal obligations (tax records) | Legal obligation (Art. 6(1)(c)) |
Where data is categorised as special category under Article 9 (for example, health information you voluntarily share during coaching), the additional basis for processing is explicit consent and, where applicable, the exercise of legal claims or vital interests.
4. How we use your data
- To respond to your enquiry and arrange a free exploratory call
- To deliver coaching sessions and maintain session continuity
- To send administrative messages related to sessions (scheduling, invoices)
- To improve the website (analytics only, with consent)
- To comply with tax and accounting obligations
We do not use your data for marketing, profiling, or automated decision-making. We do not sell or share your data with third parties for commercial purposes.
5. Who we share data with
We do not sell personal data. We share data only where necessary:
- Google LLC — analytics processing (if consented). Google Analytics 4 data is anonymised and processed under a Data Processing Agreement. Standard Contractual Clauses apply for any transfers outside the UK.
- Web hosting provider — technical logs for site security. Data is stored within the UK/EEA.
- Accounting software — invoice and payment records. No session content is shared.
- Professional supervisor — coaching supervisors may hear anonymised case material as part of professional practice requirements. No identifying information is disclosed.
6. Retention periods
| Data type | Retention period |
|---|---|
| Enquiry emails (no contract formed) | 12 months from last contact |
| Client session notes | 5 years after engagement ends |
| Invoice and payment records | 6 years (HMRC requirement) |
| Analytics data (if consented) | 26 months (Google Analytics default, shortened to 14 months in our configuration) |
| Website technical logs | 30 days |
7. Your rights under UK GDPR
You have the following rights. To exercise any of them, email [email protected]. We will respond within one calendar month.
- Right of access — request a copy of the personal data we hold about you
- Right to rectification — ask us to correct inaccurate or incomplete data
- Right to erasure — ask us to delete your data, subject to any legal obligations to retain it
- Right to restrict processing — ask us to pause processing while accuracy is disputed
- Right to data portability — request your data in a machine-readable format (applies to data processed by consent or contract)
- Right to object — object to processing based on legitimate interests
- Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing
8. Cookies and electronic communications
We use cookies in accordance with PECR. Essential cookies are placed without consent. Analytics cookies require your prior consent, which you can give, refuse, or customise using the cookie banner displayed on your first visit. You can change your preferences at any time using the "Cookie preferences" link in the footer. See our full Cookies Policy for details.
9. Children's data
Our services are intended for adults in professional contexts. We do not knowingly collect data from anyone under the age of 18. If you believe we have inadvertently collected a child's data, contact us at the email address above and we will delete it promptly.
10. Security
We take reasonable technical and organisational measures to protect personal data against unauthorised access, loss, or alteration. Email is not an inherently secure channel; if you have concerns about transmitting sensitive information, please discuss an alternative with us.
11. Changes to this policy
We may update this policy from time to time. The "Last updated" date at the top of this page will change when we do. We will not notify existing contacts of minor changes, but material changes will be communicated by email to active clients.
12. Complaints
If you are unhappy with how we have handled your personal data, please contact us in the first instance at [email protected]. If you remain dissatisfied, you have the right to complain to the UK's supervisory authority:
Information Commissioner's Office (ICO)
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
ico.org.uk/make-a-complaint