top of page

Privacy

Last reviewed: 2 August 2026

This privacy notice explains how we collect, use, store, share, and protect personal data when you interact with our business, including through our website, services, workshops, online courses, bookings, and communications.

1. Who we are

Hamilton Hill is a UK-based sole trader coaching and consultancy business operated by Victoria Hewitt.

2. Data controller and contact details

Hamilton Hill is the data controller for the personal data described in this notice.

Contact: victoria@hamiltonhill.co.uk

If you have any questions about this notice or how we use your personal data, please contact us using the details above.

3. What personal data we collect

We may collect and process the following personal data:

  • Identity and contact details: name, email address, telephone number, job title, organisation, and correspondence details.

  • Service information: intake forms, goals, notes, preferences, feedback, and records of sessions or communications.

  • Payment and booking information: booking details, invoices, payment status, and related administrative records.

  • Technical and usage data: IP address, browser type, device information, pages visited, and basic website analytics.

  • Special category data: limited information about health, wellbeing, accessibility, or other sensitive needs, where you choose to provide it and where it is necessary for the services we provide.

We usually collect this information directly from you, but we may also receive it from third parties such as a referee, employer, event organiser, or payment/booking platform where relevant.

4. Why we use your data

We use personal data for the following purposes:

  • To provide coaching, consultancy, online courses, and workshops.

  • To manage enquiries, bookings, contracts, and payments.

  • To communicate with you about sessions, updates, changes, and relevant resources.

  • To maintain records and manage our business operations.

  • To meet legal, accounting, tax, and health and safety obligations.

  • To improve our website, services, and communications.

  • To send marketing emails or newsletters where you have opted in or where otherwise permitted by law.

5. Lawful bases for processing

We rely on the following lawful bases under UK GDPR:

  • Contract: where processing is necessary to deliver services, manage bookings, or take steps before entering into a contract.

  • Consent: where you have given clear consent, including for optional marketing communications and, where required, special category data.

  • Legitimate interests: where processing is necessary for our business interests, such as keeping records, improving services, maintaining security, and responding to enquiries, provided your rights do not override those interests.

  • Legal obligation: where processing is necessary to comply with legal requirements such as tax and accounting obligations.

Where we process special category data, we will only do so where an additional legal condition under UK GDPR applies, such as your explicit consent or where the processing is necessary for providing services with your consent and appropriate safeguards.

You may withdraw consent at any time where we rely on consent for processing.

6. Sharing your data

We may share personal data with trusted third parties where necessary to run our business and provide our services, including:

  • Email, scheduling, payment, video-conferencing, document storage, and website service providers.

  • Professional advisers such as accountants, lawyers, or insurers.

  • Other third parties where required by law or to protect our legal rights.

These providers only process personal data on our instructions or where they are independently responsible for their own processing under their own privacy notices.

7. International transfers

Some of our service providers may store or process personal data outside the UK. Where this happens, we will take steps to ensure appropriate safeguards are in place, such as the UK International Data Transfer Agreement, standard contractual clauses, or equivalent protections where required.

8. How long we keep data

We keep personal data only for as long as necessary for the purposes for which it was collected, including legal, accounting, and reporting requirements.

Our usual retention periods are:

  • Coaching and consultancy records: up to 7 years after the end of the working relationship.

  • Enquiry emails: usually up to 2 years if no contract is formed.

  • Mailing list data: until you unsubscribe or withdraw consent.

  • Financial and tax records: for the period required by law.

When data is no longer needed, it is securely deleted or anonymised.

9. Cookies and website analytics

Our website may use essential cookies and, where enabled, analytics cookies or similar technologies to help the website function, improve performance, and understand how visitors use the site.

Where required, we will ask for your consent before placing non-essential cookies. Further details about cookies and cookie choices should be set out in our cookie notice.

10. Data security and confidentiality

We use appropriate technical and organisational measures to protect personal data, including:

  • Password-protected and, where appropriate, encrypted systems.

  • Limiting access to personal data to those who need it.

  • Using data minimisation and anonymisation where possible.

  • Secure disposal of digital and physical records.

  • Confidentiality arrangements and clear boundaries around coaching records.

While no system is completely secure, we take reasonable steps to protect your information.

11. Your rights

Under UK GDPR, you have the right to:

  • Access your personal data.

  • Ask for correction of inaccurate or incomplete data.

  • Ask for erasure of your data in certain circumstances.

  • Ask us to restrict processing in certain circumstances.

  • Object to processing based on legitimate interests or direct marketing.

  • Request data portability, where applicable.

  • Withdraw consent at any time where we rely on consent.

To exercise your rights, contact us using the details above. We may need to verify your identity before responding.

12. Complaints

If you have concerns about how we handle your personal data, please contact us first so we can try to resolve the issue.

You also have the right to complain to the UK data protection regulator, the Information Commissioner’s Office (ICO):

Website: https://ico.org.uk
Telephone: 0303 123 1113

13. Changes to this notice

We review this privacy notice at least annually and may update it from time to time to reflect changes in our services, legal requirements, or the way we use personal data.

bottom of page