Privacy Policy

# Privacy policy

Last updated: 22 May 2026

In plain English — what we collect, why, how long we keep it, and your rights under UK data protection law.

Infinity Learning (“we”, “us”, “our”) is the trading name of the coaching practice run by Hiral Kelly. This policy describes how we handle personal data when you use this website or work with us. If anything is unclear, email hiral.kelly@infinity-learning.co.uk and we’ll answer plainly.

## 1. Who we are

Infinity Learning is the data controller for any personal data collected through this site or our coaching engagements.

•⁠ ⁠*Trading name:* Infinity Learning
•⁠ ⁠*Contact:* hiral.kelly@infinity-learning.co.uk · 07739 389 139
•⁠ ⁠*Postal:* Symonds Yat, Ross-on-Wye
•⁠ ⁠*ICO registration:* [— ICO reference number]

## 2. What we collect

•⁠ ⁠*When you submit the contact form:* your name, email address, and any message content you choose to send.
•⁠ ⁠*When you book a discovery call:* name, email, time zone, and meeting preferences — collected by Calendly under their own privacy policy.
•⁠ ⁠*During a coaching engagement:* the minimum needed to deliver the work — name, contact details, sometimes payment information, and brief session notes (initials only, encrypted, no clinical detail).
•⁠ ⁠*When you visit the site:* if you consent to analytics, Google Analytics 4 collects page views, referring URL, approximate location, and device/browser type to help us understand how the site is used. IP addresses are truncated before processing. If you decline, no analytics cookies are set and no analytics data is collected.
•⁠ ⁠*If you subscribe to the newsletter:* name and email only, with explicit consent at signup, freely withdrawable.

## 3. Our lawful basis for processing

Under the UK GDPR (as amended by the Data (Use and Access) Act 2025), we rely on the following lawful bases:

•⁠ ⁠*Contract* — when you’re an active client, processing your data is necessary to deliver the coaching engagement we agreed.
•⁠ ⁠*Legitimate interest* — for responding to enquiries and the ordinary running of a small coaching practice, balanced against your reasonable expectations.
•⁠ ⁠*Consent* — for newsletter signup, marketing communications, and analytics cookies. Withdrawable at any time.
•⁠ ⁠*Legal obligation* — for retention of financial records (HMRC, 6 years) and any safeguarding-related disclosure required by law.

## 4. Special category data

Coaching sessions may, in passing, surface what UK GDPR Article 9 calls “special category data” — for example, references to health, ethnicity, religion, sexuality, or political views. We do not actively collect this data, and we do not record it.

Session notes are limited to a few words about themes (e.g. “decision: restructure”) and do not include direct disclosure of special category data unless you specifically ask us to record something, in which case we rely on your explicit consent under Article 9(2)(a).

## 5. Cookies and local storage

This site uses minimal storage. See our cookie policy for the full list. In summary:

•⁠ ⁠*ck_ok* — a single localStorage entry recording that you dismissed the cookie banner. Strictly necessary, so it requires no consent. No tracking value.
•⁠ ⁠*_ga, *ga* — Google Analytics 4 cookies used to distinguish unique visitors and sessions. These are set *only after you consent. Since 5 February 2026, UK law exempts cookies used *solely for first-party website statistics from the consent requirement, but only where no data is shared with third parties. Because Google Analytics sends data to Google, it does not meet that test, so we continue to treat these cookies as non-essential and ask for your consent before setting them. IP addresses are anonymised; the cookies expire after 2 years.
•⁠ ⁠*No advertising cookies. No cross-site tracking. No third-party tracking pixels.*
•⁠ ⁠Embedded Calendly booking pages may set their own cookies, governed by Calendly’s policy.

You can withdraw analytics consent at any time using the cookie controls on the site, or by adjusting your browser settings.

## 6. Third-party services we use

•⁠ ⁠*Calendly* — for discovery call bookings. Data transferred under their privacy terms; some data may transit through the United States under standard contractual clauses.
•⁠ ⁠*Google Fonts* — for serving the Lato and JetBrains Mono fonts. No personal data is collected by this service.
•⁠ ⁠*Google Analytics 4* — for understanding how visitors use the site, only with your consent. Data is anonymised (IPs truncated); we do not enable advertising features or audience sharing.
•⁠ ⁠*Email provider:* [— your hosting provider, e.g. Fastmail / Google Workspace / Outlook] under their data processing terms.
•⁠ ⁠*Payment processing:* [— provider, e.g. Stripe / Wise / bank transfer]. We do not store card details ourselves.

## 7. International transfers

Calendly is US-based. Their data transfers rely on the UK extension to the EU–US Data Privacy Framework and on standard contractual clauses recognised by the UK ICO. We do not otherwise transfer personal data outside the UK or EEA.

## 8. How long we keep your data

•⁠ ⁠*Contact form enquiries:* 24 months, unless you ask sooner.
•⁠ ⁠*Discovery call records* (where no engagement followed): 12 months, then permanently deleted.
•⁠ ⁠*Active client records:* for the duration of the engagement plus 7 years (professional indemnity insurance and accountability requirements). Then permanently destroyed.
•⁠ ⁠*Financial records:* 6 years (HMRC requirement).
•⁠ ⁠*Newsletter subscribers:* until you unsubscribe, plus 30 days.

## 9. Your rights under UK GDPR

You have the right to:

•⁠ ⁠*Access* — request a copy of any personal data we hold about you.
•⁠ ⁠*Rectification* — ask us to correct anything inaccurate.
•⁠ ⁠*Erasure (“right to be forgotten”)* — ask us to delete your data, subject to legal retention obligations.
•⁠ ⁠*Restriction* — limit how we use your data while a request is being resolved.
•⁠ ⁠*Portability* — receive your data in a portable, machine-readable format.
•⁠ ⁠*Object* — specifically to processing based on legitimate interest, including direct marketing.
•⁠ ⁠*Withdraw consent* — at any time, for any consent-based processing.
•⁠ ⁠*Complain* — to us directly, or to the ICO (see section 11).

To exercise any of these, email hiral.kelly@infinity-learning.co.uk with “Privacy request” in the subject. We respond without undue delay and in any event within one month of receipt. If your request is complex or broad, we may ask you for clarification or to confirm your identity first; where we do, the one-month period pauses until you reply. We carry out a reasonable and proportionate search for the data you’ve asked about.

## 10. How we protect your data

All session notes are encrypted at rest. Devices are passcode-locked with disk encryption enabled. Cloud storage uses multi-factor authentication. Access is limited to Hiral Kelly directly — no employees or contractors handle client data.

In the event of a data breach affecting your personal data, we will notify you and report to the ICO within 72 hours of becoming aware where required, in accordance with UK GDPR Article 33.

## 11. If you have a complaint

Please contact us first — we’ll always try to resolve concerns directly, and we’ll acknowledge any data protection complaint within 30 days. If we can’t resolve it, you have the right to lodge a complaint with the UK Information Commissioner’s Office:

•⁠ ⁠*ico.org.uk/make-a-complaint*
•⁠ ⁠Telephone: 0303 123 1113

## 12. Changes to this policy

When we update this policy, we’ll change the “updated” date at the top and, for material changes affecting active clients, notify you directly. The current version is always at infinity-learning.co.uk/privacy.html.