This Privacy Policy explains how The Growth Lab Limited collects, uses, and protects your personal data. We are committed to handling your information with care and in full compliance with UK GDPR and the Data Protection Act 2018.

Please read this policy alongside our Terms and Conditions, which are available on our website.

1. Who We Are

The Growth Lab Limited is the data controller for the personal data we collect. When we refer to 'we', 'us', or 'The Growth Lab', we mean Rachel Cheal trading through The Growth Lab Limited.

If you have any questions about how we use your data, please contact us:

• Email: rachel@thegrowthlab.co.uk

• Website: www.thegrowthlab.co.uk

2. What Data We Collect

The personal data we collect depends on how you interact with us. This may include:

Contact and identity information

• Your name, email address, and phone number

• Information you provide when enquiring about or purchasing our services

Financial and coaching-related information

• Financial information you share in the course of coaching (such as income, spending, debts, savings, or business finances)

• Personal context you share that is relevant to your financial situation

• Notes and summaries from coaching sessions

Business information (small business owner clients)

• Business financial details, trading information, and related context you share during coaching

Technical and transactional data

• Payment records (we do not store card details — these are handled by our payment provider)

• Booking and appointment records

• Email correspondence

3. How We Use Your Data

We use your personal data to:

• Deliver the coaching services or workshops you have purchased

• Communicate with you about your sessions and related administration

• Manage your bookings and payments

• Prepare for and follow up on coaching sessions

• Maintain records of our work together

• Improve and develop our services

• Comply with our legal obligations

4. Our Legal Basis for Processing

We process your personal data on the following legal bases:

• Contract: to fulfil the services you have purchased from us

• Legitimate interests: to manage our business effectively, maintain records, and improve our services — where this does not override your rights

• Legal obligation: where we are required to process data to comply with the law

• Consent: where we have asked for and received your explicit consent (for example, for any optional communications)

5. Our Use of Artificial Intelligence

We use AI tools to support the delivery and administration of our services. This can include drafting session notes, summaries, and resources; organising information to support coaching preparation and follow-up; and general administrative tasks.

Any AI tools we use are accessed via business-grade subscriptions that include Data Processing Agreements (DPAs), meaning providers are contractually obligated to handle your data in accordance with UK GDPR.

We may use AI tools to work with information you have shared with us in the course of coaching. We do not input highly sensitive data such as bank account numbers, passwords, or payment card details into AI tools.

AI tools support our work; they do not replace professional judgement. All coaching and guidance is provided directly by Rachel Cheal.

6. Who We Share Your Data With

We do not sell your personal data. We may share it with third parties only in the following circumstances:

• Service providers: third-party platforms we use to operate our business (such as booking, payment, and email tools), all of whom are contractually required to handle your data securely and in accordance with UK GDPR

• Legal requirements: where we are required to disclose information by law or to protect the rights, property, or safety of ourselves or others

We will not share your personal data with any third party for their own marketing purposes.

7. How Long We Keep Your Data

We keep your personal data for as long as is necessary to deliver our services and meet our legal obligations. In practice, this means:

• Coaching records: up to six years following the end of our working relationship, to comply with standard legal and accounting requirements

• Financial records: up to six years from the relevant transaction, as required by HMRC

• Email and general correspondence: up to three years after our last contact

We will delete or anonymise your data when it is no longer needed.

8. Your Rights

Under UK GDPR, you have the right to:

• Access: request a copy of the personal data we hold about you

• Correction: ask us to correct inaccurate or incomplete data

• Erasure: ask us to delete your data, where there is no lawful reason for us to keep it

• Restriction: ask us to limit how we use your data in certain circumstances

• Portability: receive your data in a structured, commonly used format

• Object: object to our processing of your data where we rely on legitimate interests

• Withdraw consent: where processing is based on consent, you may withdraw it at any time

To exercise any of these rights, please contact us at rachel@thegrowthlab.co.uk. We will respond within one calendar month.

If you are unhappy with how we have handled your data, you have the right to complain to the Information Commissioner's Office (ICO) at www.ico.org.uk.

9. Data Security

We take appropriate technical and organisational measures to protect your personal data from unauthorised access, loss, or disclosure. These include using secure, reputable platforms for storing and communicating data, and ensuring that any third-party providers we use meet appropriate data protection standards.

No method of electronic storage or transmission is completely secure. If you have concerns about how data is being handled, please contact us.

10. Cookies and Website Data

Our website may use cookies or similar technologies to help it function and to understand how visitors use it. Where this is the case, we will present you with a cookie notice when you visit and ask for your consent where required.

We do not use your website data to build personal profiles or for targeted advertising.

11. Marketing Communications

We will only send you marketing communications if you have opted in to receive them. You can unsubscribe at any time by clicking the unsubscribe link in any email or by contacting us directly.

We do not bundle marketing consent into our Terms and Conditions or any other contract. Consent is always obtained separately and freely.

12. Changes to This Policy

We may update this Privacy Policy from time to time. The current version will always be available on our website. We will notify you of any material changes by email where we hold your contact details.