CLEAR INFORMATION, CONFIDENT CHOICES
Privacy Policy
This draft explains how personal information is used in connection with Sharon Forrester’s business education website, enquiries and programmes. It distinguishes the website’s current features from planned course-account services.
Who is responsible for your information
The website trades under the name Sharon Forrester. [Confirm the legal name and status of the data controller, trading entity, postal address and any company registration details.] The existing business contact is hello@sharonforrester.com; please confirm that this is also the correct privacy contact before publication.
Contact us through the Contact page or by email about how your information is used. [Confirm whether a data protection officer or other designated privacy contact is required or appointed.]
Information you provide
Contact enquiries may include your name, email address, optional telephone number, reason for contacting us and message. The free-guide form asks for your name and email, an optional telephone number and your separate marketing choice.
Elite applications ask for your name, email, business name, optional website, industry, business stage, challenges and goals, together with a privacy acknowledgement. Please do not include health information, identification documents or other sensitive personal information in free-text fields.
The existing speaking form is currently a demonstration and does not send or store its entries through a connected submission service. It displays event-related fields, including organisation, location, preferred date and audience size. Use the Contact page for an actual speaking enquiry.
Website visits and technical information
Our website hosting and service providers may process technical information such as IP addresses, requested pages, browser information and security logs to deliver and protect the site. [Confirm the actual Netlify logging configuration, recipients and retention arrangements.] No analytics script, advertising pixel or third-party video embed was identified in this supplied website build.
Why we use information and our lawful bases
We use information to respond to enquiries, provide requested resources, review applications, administer purchases and billing, arrange teaching or coaching and meet legal obligations. The appropriate lawful basis depends on the activity, rather than every activity requiring consent.
The activity-specific bases below are draft proposals for the controller to verify. Any reliance on legitimate interests requires an assessment of necessity, proportionality and your interests and rights.
| Activity | Proposed lawful basis | Reason |
|---|---|---|
| Enquiries and pre-purchase discussions | Contract steps at your request, or legitimate interests | Respond to requests and discuss services |
| Providing a requested free guide | Legitimate interests, subject to assessment | Fulfil the resource request without requiring marketing consent |
| Reviewing programme applications | Contract steps at your request, or legitimate interests | Assess suitability and respond |
| Purchases, recurring billing and course administration | Contract | Supply and manage agreed services |
| Accounting, tax and required business records | Legal obligation, where applicable | Meet relevant legal record-keeping requirements |
| Security and proportionate dispute records | Legitimate interests, subject to assessment | Protect the site and establish or defend claims |
| Optional email newsletter and offers | Consent for the current opt-in approach | Send only the marketing you have chosen |
Contact forms and application handling
The contact, free-guide and Elite application forms contain Netlify Forms declarations. On a configured Netlify deployment, submitted details are processed through Netlify and made available to authorised business users. Delivery, notification recipients and storage settings must be confirmed and tested before launch.
The local preview does not process submissions. The Elite application’s privacy acknowledgement is not marketing consent or a waiver of your rights. An application does not enrol you or take payment.
Course and membership purchases
To administer a purchase we may need your customer details, selected programme, payment reference, billing information and subscription status. Stripe-hosted checkout is used for the supplied public payment links. The exact information collected at checkout depends on the payment-link settings and must be verified.
Operational purchase records and fulfilment must be securely connected before automatic course access is offered. The current website does not grant access merely because a checkout redirect or confirmation page is visited.
Customer accounts and learning progress
The member dashboard is currently a public design preview, with illustrative membership month and progress. It does not hold real customer accounts or private course files.
If authenticated accounts are introduced, the notice must be updated to identify the actual authentication, database and storage providers, account details, learning progress, session records and entitlement information processed. Access must be restricted to the relevant customer and authorised administrators.
Stripe and billing information
When you choose a payment link, you leave this website for Stripe-hosted checkout. Stripe processes payment details and may provide customer, transaction and subscription information to the business to administer the purchase. This does not mean the business processes no personal data.
This website has no custom card-entry form. Stripe’s own privacy information applies to its processing. [Confirm the Stripe account holder, contractual roles, collected fields, supported billing-management arrangements and any international-transfer safeguards.]
Service communications and optional marketing
We may contact you about an enquiry, application, purchase or agreed teaching arrangements using the relevant lawful basis. These messages are separate from optional marketing.
The free-guide newsletter checkbox is optional, separate and unticked. Your choice and the consent wording/version are included with the submission. Declining marketing does not prevent requesting the guide or purchasing a course. No mailing-list provider is connected in the supplied code; any later integration must respect the recorded choice.
You can withdraw marketing consent by using the unsubscribe option in a marketing email or by contacting hello@sharonforrester.com. Withdrawal does not affect processing already lawfully carried out. We may keep a minimal suppression record to honour your choice.
Who may receive information
Information may be processed by the website host and form handler (Netlify), payment provider (Stripe), authorised business personnel and necessary professional advisers or authorities. Disclosure must be limited to what is needed for the relevant purpose.
[Confirm the email/inbox provider, newsletter provider if appointed, learning-platform providers, accountants or other recipients, processing contracts and whether each recipient acts as a processor or an independent controller.] The Google Drive guide is an external resource; Google’s own processing applies when you open it.
Storage and security
Reasonable technical and organisational measures must be maintained to protect personal information, including access controls, secure transmission, account security, limited administrative access and proportionate retention. [Confirm and document the measures actually used by the business and its providers.]
No private customer records, real purchase records or API secret keys are intentionally included in the public website assets. Private learning materials must not be published at unrestricted URLs. No online service can guarantee absolute security.
International transfers
Some providers may process information outside the UK. The location and safeguards depend on the providers and account settings; this draft does not claim that all data stays in the UK.
[Confirm relevant destinations and whether an applicable adequacy arrangement, UK International Data Transfer Agreement, UK Addendum or another valid safeguard is used. Describe how individuals can obtain information about the safeguards.]
How long information is kept
Retention should be based on the purpose, whether an enquiry is still active, the duration of the customer relationship, applicable legal record-keeping duties and proportionate needs to address complaints or claims. Information should be deleted or anonymised when no longer needed, subject to lawful exceptions.
[Confirm and document the retention criteria or periods for unsuccessful applications, enquiries, consent/suppression records, transaction/accounting records, learning accounts and provider logs. Align deletions and backups with those decisions.] No arbitrary retention promise is made in this draft.
Your data protection rights
Depending on the circumstances and lawful basis, you may request access to your personal information, correction of inaccuracies, erasure, restriction of processing or portability. These rights are not absolute and may be subject to legal exceptions.
You have the right to object to processing based on legitimate interests in the circumstances provided by law, and to object to direct marketing at any time. We must stop using your information for direct marketing when you object.
Where processing relies on consent, you may withdraw it at any time. No solely automated decision with legal or similarly significant effects was identified in the supplied website; application review is intended to be carried out by Sharon. Reassess this if automation is added.
Making a rights request
Email hello@sharonforrester.com with a clear description of your request. We may ask for proportionate information to establish identity or clarify what you need. Requests must be handled within the time limits and exceptions under applicable data protection law; this draft does not replace those duties.
Please avoid sending unnecessary sensitive information. If another provider acts as a separate controller for its processing, its own rights-request process may also apply.
Questions and complaints
Please contact us if you have a concern so that it can be investigated. You may also complain to the UK Information Commissioner’s Office; you do not have to accept an internal resolution before exercising that right.
Updates to this notice
This notice should be updated when services, providers or data practices change. Material changes should be communicated where appropriate. Draft reviewed on 11 October 2026; the final effective date and approval are to be confirmed before publication.