Privacy Policy
1. Who we are and what this policy covers
Lucy Oldershaw Training and Consultancy Ltd is the controller responsible for the personal data covered by this policy. The company is registered in England and Wales under company number 17368269, with its registered office at 124 City Road, London, EC1V 2NX. You can contact us at [email protected] .
This policy applies to visitors to our websites, people who contact us, delegates, clients, suppliers and people who use our forms, booking systems or training and consultancy services. Our Cookie Policy is separate and explains how cookies and similar technologies operate on our websites.
We are a standalone controller for the personal data described in this policy and we do not routinely share it with any other business. Where a particular service does require personal data to be shared with another organisation, we will identify the relevant roles, lawful basis, purpose and safeguards, and provide any information required by data protection law.
2. Personal data we collect
Depending on your relationship with us, we may collect your name, job title, organisation, email address, telephone number, business and billing address, correspondence, booking and payment information, attendance records, course work, feedback, assessment information, marketing preferences, IP address, browser and device information, and website usage data.
Our services are designed for professional adult learners and business clients. We do not ask for DBS certificate numbers, criminal records information, safeguarding case files or identifiable information about children through our ordinary forms, and we ask that you do not send us any of this information. If it reaches us unexpectedly, we will restrict access to it and assess whether it should be deleted, returned or retained under a specific lawful process.
3. How we obtain information
We collect information directly from you through enquiries, forms, emails, calls, bookings, payments, training and consultancy. We may also receive information from your organisation, from a booking contact, from a service provider supporting a booking, or from publicly available business sources. Technical information may be collected through cookies and similar technologies, as described in our separate Cookie Policy.
4. Purposes and lawful bases
We process personal data for the purposes set out below. The relevant lawful basis depends on the particular activity:
Enquiries and pre-contract discussions: Article 6(1)(b) UK GDPR, where processing is necessary to take steps at your request.
Delivering training, consultancy, bookings, administration and support: Article 6(1)(b) where processing is necessary for a contract, or Article 6(1)(f) where the relationship is with an organisation and processing is necessary for our legitimate business interests.
Accounts, invoices, tax and statutory records: Article 6(1)(c) where a legal obligation applies, and Article 6(1)(f) for related business administration.
Security, fraud prevention, service improvement and record management: Article 6(1)(f), following an assessment of necessity and the effect on individuals.
Electronic marketing: consent where PECR requires it, or the existing customer soft opt-in where all of the conditions are met. Every marketing message includes an easy way to unsubscribe.
Non-essential analytics and similar technologies: consent under PECR, handled through our separate Cookie Policy.
We will not rely on the Data (Use and Access) Act 2025 as a general replacement for the ordinary UK GDPR lawful bases. Where we rely on a statutory recognised legitimate interest, we will confirm that the specific statutory conditions apply.
5. Recordings and AI
Some webinars and training sessions may be recorded for replay or quality purposes. We will tell you before recording starts, explain the purpose and lawful basis, and give you any applicable choice or route to object. Delegates must not discuss identifiable children, families, safeguarding concerns or candidate information in recorded sessions.
We may use AI tools for drafting, research, transcription or administration. We do not intentionally submit identifiable personal data, safeguarding information, DBS information or confidential client material to generative AI tools unless a documented assessment and appropriate safeguards permit it. We use approved settings, minimise what we input and apply human review. We do not make solely automated decisions that produce legal or similarly significant effects for individuals.
6 . Providers and international transfers
We may use GoHighLevel, Google Workspace, Stripe, Airtable, Sage, Zapier, Slack and other providers for hosting, forms, CRM, email, payments, accounting, storage and administration. We maintain a register of the providers and sub-processors we use, and we review it whenever our services change.
You can view the current list here: https://bit.ly/3SpcMfN . The list is updated from time to time as our providers change, so please check it for the position that applies today.
Stripe may act as an independent controller for some payment processing. Other providers may act as processors or as independent controllers, depending on the service and the contract in place. Where personal data is transferred outside the UK, we use a lawful transfer mechanism and appropriate safeguards, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful mechanism.
7. Payment information
Online card payments are handled through Stripe and we do not store full card details ourselves. Stripe’s own privacy information also applies to its processing. We retain transaction and invoice records for accounting, fraud prevention, dispute handling and legal obligations.
8. Retention
We keep personal data only for as long as is reasonably necessary for the purpose it was collected for, taking account of legal, accounting, contractual, insurance and dispute requirements. Our current operational periods are:
Financial and tax records: for the period required by applicable law.
Routine delegate, course and consultancy records: normally up to two years after completion, unless a longer period is justified.
Session recordings: normally up to two years where they are needed for replay or quality purposes.
Marketing records: until you unsubscribe, withdraw consent, or after a reasonable period of inactivity.
Complaints: for the period needed to investigate, defend or manage the matter under our records schedule.
We review our records periodically and securely delete, anonymise or restrict them once they are no longer needed.
9. Your rights and complaints
Subject to legal conditions and exemptions, you may have the right to access your personal data and to ask for rectification, erasure, restriction or data portability. You may object to processing, withdraw consent where we rely on it, and object to direct marketing at any time. You may also ask us about solely automated decision-making with legal or similarly significant effects.
To exercise any of these rights, contact [email protected]. We normally respond to a valid access request within one month and we may ask for proportionate identity verification first.
If you are unhappy with how we have handled your personal data, you can make a data protection complaint to us by completing this form: https://lucy-oldershaw.fillout.com/data-complaint or by emailing [email protected] with “Data Protection Complaint” in the subject line. We will acknowledge receipt within 30 days of receiving your complaint. We will then make appropriate enquiries into it without undue delay, keep you informed of progress, and tell you the outcome.
You also have the right to complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/ or on 0303 123 1113. You do not have to complain to us first, although raising it with us directly is often the quickest route to a resolution.
Further information is available on this in our Data Protection Complaints Notice which available here: https://lucyoldershaw.co.uk/complaints-notice
10. Changes
We may update this policy when our services, providers, processing purposes or legal requirements change. The latest version will always be published with its effective date.
Effective date: 10 August 2026.
Review date: 10 August 2027, or sooner following a material change.
Stay in the Loop
Safer Recruitment updates, straight to your inbox.
QUICK LINKS
Home
About
Training
Consultancy
Contact
© 2026 Lucy Oldershaw Training and Consultancy Ltd · Registered in England and Wales, Company No. 17368269 · ICO ZC218349