Privacy Notice

Who is responsible for your data

I am the data controller for the personal data described in this notice.

Contact: hello@whatnowwhatnext.co.uk

I am registered with the Information Commissioner's Office (ICO). My registration number is ZC208974.

What data I collect

Depending on how we work together, this may include:

• Contact details (name, email, phone)
• Coaching session notes (written before, during and after sessions) and post-session contact reports
• Information you share about your goals, values, personal strengths and traits, and reflections, including anything you record in the Being and Becoming tool (goals and sub-goals, values, personality/strengths assessments such as VIA, Saboteurs, OCEAN, Conker leadership type, actions, learnings, and free-text notes or scratchpad entries)
• Session recordings and transcripts, where you've given permission for a session to be recorded for my accreditation, supervision and continuing professional development
• Any other information you choose to share with me in the course of coaching

A note on incidental detail: session notes are kept under your initials rather than your name, but conversations naturally bring in incidental detail — your employer, location, or role, for example. This is still your personal data even without your name attached, and I handle it with the same care.

A note on sensitive information: most of what's recorded in Being and Becoming (strengths, values, goals) is not "special category" data under UK GDPR. Occasionally, though, clients mention things like health, mental health, or religious belief in notes or conversation. Where that happens, I treat it as sensitive and rely on your explicit consent (given by choosing to share it with me) to process it, and I take extra care with how it's stored and who can see it.

Why I process your data, and my legal basis

• To deliver the coaching service you've engaged me for — necessary for our contract
• To keep accurate records so I can refer back to your progress over what is often a multi-year coaching relationship — necessary for our contract and my legitimate interest in providing consistent, well-informed coaching
• To record and transcribe sessions for my own accreditation, supervision and CPD — your explicit consent, given separately each time this is proposed
• Where sensitive information is involved, as described above — your explicit consent

How and where your data is stored

Your Being and Becoming data is stored locally in the browser on my own device — it is not held in a cloud database or shared platform. I periodically back up this data as files, which I save to my normal file storage, synced via OneDrive. OneDrive (Microsoft) therefore acts as a data processor for these backup files, under Microsoft's own security and data protection terms.

Session notes, contact reports, and any session recordings or transcripts are also kept as documents on my OneDrive, under your initials rather than your name.

General coaching records (contracts, invoices, email correspondence) are kept using standard business tools (e.g. email, accounting software) in the ordinary way.

Sharing your data

I don't sell or share your data for marketing purposes. In two situations, your data may be seen by others:

• Backup storage: as above, backup files are stored via OneDrive.
• Accreditation and supervision: where you've given consent for a session to be recorded, my supervisor or accrediting body may review the recording or transcript (or an extract of it) as part of my professional development.
• Being and Becoming file exchange: I may email you a copy of your Being and Becoming data (for example, prepopulated ahead of a session) for you to review and update, and you may in turn share an updated copy back with me to support our discussion.
• AI-assisted preparation: I sometimes use an AI assistant (Claude, made by Anthropic) to help me think through how to approach a session or a particular challenge. When I do this, I only use your initials rather than your full name, and I keep what I share to what's genuinely useful for that purpose. Anthropic's own data handling terms apply to anything shared with it in this way.

I do not otherwise share your personal data with third parties, except where required by law.

How long I keep your data

Coaching relationships with WNWN often run over several years, and there's real value — to you as well as me — in being able to look back over that history. My default approach is:

• I keep your coaching records for the duration of our working relationship, and
• for up to 3 years after our last engagement, in case you return for further coaching or want to look back at your own progress.

Recordings and transcripts are kept for a shorter, specific period: only for as long as needed for the accreditation, supervision or CPD purpose they were made for, and then deleted — rather than being kept for the same multi-year window as general coaching records.

After that, I'll delete your records unless you ask me to keep them for longer, or to delete them sooner. You can ask me to delete your data at any time (see your rights, below) — the app makes this straightforward, since every entry can be individually reviewed and deleted.

Your rights

Under UK GDPR, you have the right to:

• Access the personal data I hold about you
• Correct it if it's inaccurate or incomplete
• Erase it (sometimes called "the right to be forgotten")
• Restrict or object to certain processing
• Receive a copy of your data in a portable format (the Being and Becoming Export feature already does this)

To exercise any of these, just get in touch at hello@whatnowwhatnext.co.uk. If you're not satisfied with how I've handled your data, you also have the right to complain to the ICO (ico.org.uk).

Keeping your data secure

I take reasonable steps to protect your data, including keeping devices used to store client data secured (e.g. passcode/encryption), and being careful about where and how backup files are stored and shared.

Changes to this notice

I may update this notice from time to time — for example, as I refine the tools I use or my data practices change. The version here will always be the current one; I'll let existing clients know if anything material changes.