PRIVACY POLICY
2026 Privacy Policy
1. Who is responsible for your information
This Privacy Policy explains how John Beavis Associates Ltd, trading under the brand John Beavis | Leadership & Performance, collects and uses personal information in connection with our website, enquiries, advisory and coaching relationships, and digital learning.
John Beavis Associates Ltd is the controller responsible for the processing described here, except where another controller is expressly identified. Our company registration number is 09801439.
Contact: John Beavis, john@johnbeavis.com
2. Information we collect
Depending on your relationship with us, we collect contact and professional information, such as your name, email address, telephone number, organisation, role and billing details.
We also collect information you provide in enquiries, correspondence, agreements, development plans and feedback. For advisory and coaching engagements, this may include your objectives, professional circumstances, reflections and relevant session notes.
For digital purchases, we process order and payment-status information, account details and information about access to and use of purchased learning resources. Payment providers process payment credentials under their own security arrangements; please do not send card details by email or through an enquiry form.
When you visit the website, our hosting provider may process technical information such as IP address, device and browser details, requested pages, timestamps and security logs. Analytics and other optional tracking are addressed in our Cookie Policy and depend on the site’s configuration and your choices.
Please provide only information reasonably relevant to your enquiry or engagement. Avoid including unnecessary health information or identifiable confidential information about other people in website forms.
3. Where information comes from
We collect information directly from you when you contact us, purchase content or participate in an engagement.
Where an organisation sponsors your engagement, it may provide your professional contact details, role and agreed development objectives. We may also receive relevant information from an introduction, referral or publicly available professional source. Where required, we will explain the source and intended use when we first contact you or within the applicable legal timeframe.
Technical and transaction information may be supplied by the website platform, payment providers and other service providers supporting your interaction with us.
4. Why we use information and our lawful bases
We use personal information only where an applicable lawful basis supports the particular purpose.
Enquiries and individual agreements
We use information to respond to requests, discuss a potential engagement and deliver an agreement with you. Where necessary, our basis is taking steps at your request before a contract or performing our contract with you.
Organisation-funded engagements
Where the organisation is the contracting party, our basis for processing participants’ ordinary personal information is normally our legitimate interest in arranging and delivering the agreed professional support. We consider the participant’s interests and reasonable expectations when doing so.
Purchases and learner access
We use information to process orders, provide purchased content, administer accounts and respond to support requests. Our basis is contract where you are the customer, or legitimate interests where we are supporting an organisation’s authorised learners.
Business administration and security
We use information to manage correspondence, protect accounts, prevent misuse, maintain appropriate records and improve our service. Our basis is normally our legitimate interest in running a secure and effective professional practice.
Legal and accounting obligations
We process relevant records to meet tax, accounting and other applicable legal requirements. Our basis is legal obligation. We may also retain information needed to establish, exercise or defend legal claims, relying on legitimate interests and any additional legal condition required.
Marketing
Where we send optional marketing communications, we rely on consent where required by applicable law. Any other permitted direct marketing must satisfy the relevant legal requirements and our legitimate-interests assessment. You may object or unsubscribe at any time. Service messages about an existing purchase or engagement are separate from marketing.
Testimonials
We seek permission before publishing an identifiable testimonial, name or logo. The information published and its intended use will be agreed with you.
Optional cookies and tracking
We seek consent where required. Further details appear in our Cookie Policy.
5. Sensitive information
Coaching conversations may touch on personal wellbeing. Some information, including information about physical or mental health, has additional legal protection.
We seek to minimise the sensitive information we record. Before deliberately collecting or recording special-category information, we will identify the relevant lawful basis and an additional condition permitted by data-protection law, and explain the arrangements to you. Where we rely on explicit consent, we will request it separately; accepting our terms or this policy does not provide that consent.
Where consent is the basis, you can withdraw it by contacting us. Withdrawal does not affect processing that was lawful before withdrawal. We will explain any effect on the support we can provide and any information we must retain on another lawful basis.
6. Confidentiality and organisational sponsors
Session content is treated as confidential. An employer or sponsor does not automatically receive access to conversations or coaching notes because it funds the engagement.
We agree any objectives, administrative updates or progress reporting with you at the outset. Disclosure outside those arrangements requires an appropriate lawful basis and will be discussed with you where possible, unless disclosure is legally required or otherwise lawfully necessary, including in response to a serious risk of harm.
Where professional supervision is used, we seek to anonymise information wherever practicable and apply appropriate confidentiality safeguards.
Sessions are not recorded without an express prior agreement covering the purpose, access and retention arrangements.
7. Who receives information
Information is available only to people and organisations that need it for a legitimate purpose connected with our work or legal obligations.
This can include authorised administrative support, website and learning-platform providers, payment processors, email and communications providers, secure storage and IT providers, accountants, insurers, legal advisers and professional supervisors. They receive only information relevant to their role.
Our website is hosted by Squarespace. Payments may be processed through Stripe or another provider identified at checkout. Those providers may act as processors for some activities and independent controllers for others, as explained in their own privacy information.
We use appropriate contractual and confidentiality arrangements where a provider processes information on our behalf. We may also disclose information to regulators, courts or public authorities where legally required or otherwise lawfully justified.
We do not sell personal information. Permission to publish a testimonial does not authorise publication of private session information.
8. International processing
Some technology providers may store or access information outside the country where you are located, including outside the UK or European Economic Area.
Where applicable transfer restrictions apply, we must use an appropriate lawful mechanism. This may be an applicable adequacy decision or regulations, or approved contractual safeguards with additional measures where necessary.
[CONFIRM AND INSERT THE COUNTRIES AND TRANSFER MECHANISMS ACTUALLY USED FOR YOUR MAIN PROVIDERS, INCLUDING SQUARESPACE AND ANY PAYMENT, EMAIL, STORAGE OR VIDEO PLATFORM.]
You can contact john@johnbeavis.com for information about relevant transfers and how to obtain a copy of applicable safeguards, subject to appropriate protection of confidential information.
9. How long we keep information
We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including applicable legal, accounting and claims-related requirements.
For enquiries that do not lead to an engagement, retention depends on whether the enquiry remains active, whether further contact is reasonably expected and whether a lawful reason for continued retention exists.
For client records and coaching notes, we consider the engagement’s duration, the need for continuity, the sensitivity of the information, professional and insurance requirements, and relevant legal limitation periods. Notes should not be retained simply because an account or invoice must be retained longer.
For orders, invoices and accounting records, the applicable statutory record-keeping requirements determine retention. Learner account and access records are retained for the access period and any further period justified by support, purchase records or legal requirements.
For marketing, we retain the information while a lawful basis for contact continues. If you opt out, we may retain minimal suppression information to respect your choice.
Technical logs and cookie-related information are retained according to their operational purpose and the verified periods described in our Cookie Policy.
We review information for deletion or anonymisation when its purpose ends. A legal dispute, investigation or other lawful preservation requirement may justify longer retention. Contact us if you would like the criteria explained for your particular records.
10. Security
We use proportionate technical and organisational safeguards to protect personal information, including access controls, appropriate account security and confidentiality arrangements.
No online system can be guaranteed completely secure. Please protect your login details and tell us promptly if you suspect unauthorised access to your account or information shared with us.
11. Your rights and choices
Depending on applicable law and the basis for processing, you may have rights to access your information, correct inaccuracies, request deletion, restrict processing, object to processing, receive certain information in a portable format and withdraw consent.
You have the right to object to direct marketing at any time. You may also object to processing based on legitimate interests on grounds relating to your particular situation.
To exercise a right, contact john@johnbeavis.com. We may request proportionate information to verify your identity or authority to act for someone else.
We respond within the period required by applicable law, normally one month, subject to any lawful extension or adjustment. Rights are not absolute; if a request cannot be met in full, we will explain why and outline your options.
Withdrawing consent does not affect processing carried out lawfully before withdrawal. You can unsubscribe from marketing through the relevant message or by contacting us.
12. Cookies and external services
Our Cookie Policy explains cookies and similar technologies associated with the website and how to manage relevant choices:
www.johnbeavis.com/cookie-policy
Links to external websites take you to services with their own privacy information. Where a third-party player, checkout or other service is embedded, both this policy and the provider’s applicable privacy information may be relevant.
13. Children
Our services and learning resources are intended for adults in professional leadership roles. We do not knowingly offer accounts to, or deliberately collect information from, children under 18 through this website. Please contact us if you believe a child has supplied information so we can assess and address it appropriately.
14. Complaints
To raise a data-protection concern or complaint, contact John Beavis at john@johnbeavis.com or write to the registered office stated above. Please describe the issue and the information involved. You do not have to use a special form.
We will acknowledge a data-protection complaint within 30 days, investigate without undue delay, keep you informed and explain the outcome and any action taken.
You may also complain to the relevant supervisory authority. For UK matters, contact the Information Commissioner’s Office at ico.org.uk. For matters within the Spanish authority’s remit, contact the Agencia Española de Protección de Datos at aepd.es. If you are in the EEA, you may also contact the authority in your country of habitual residence, place of work or the alleged infringement, as applicable.
You do not need our permission to contact a regulator.
15. Updates to this policy
We will update this policy when our processing or applicable requirements change. The date above identifies the latest revision. Where legally required, we will provide additional notice or obtain fresh consent before changing how information is used.
Using our website does not, by itself, constitute consent to every activity described in this policy.