Privacy Notice
Last updated: 3 July 2026
Who we are and how to contact us
Key & Compass is operated by Christabel Tingay, trading as Key & Compass. We provide leadership coaching and organisational development services to individuals and organisations.
Our services are intended for adults aged 18 and over. By providing us with your personal data, you confirm that you are 18 years of age or older.
We are the data controller for the personal information we collect and process about you.
Data controller | Christabel Tingay trading as Key & Compass |
hello@keyandcompass.co.uk | |
Website | www.keyandcompass.co.uk |
ICO registration number | ZC168452 |
If you have any questions about how we use your personal data, or wish to exercise any of your rights, please contact us using the details above.
What personal data we collect
The personal data we collect depends on how you interact with us. Here is an overview of the different types:
If you enquire about or purchase our services
This applies whether you are an individual booking coaching directly, or an organisation enquiring on behalf of employees.
- Your name, email address, phone number and address
- Any information you share with us by email, phone or through our website contact form
- Notes from our conversations
- Invoices and payment records
If you become a coaching client
Whether you are a private individual client or an employee referred by your organisation, the same information is collected and the same confidentiality applies.
- All of the above, plus
- Session notes and records of our coaching work together
- Any information you choose to share during coaching sessions
- Questionnaires or other materials used as part of your coaching
Sensitive personal information
Some of the information you share during coaching may be sensitive, for example, information about your health, mental wellbeing, neurodiversity, religious or philosophical beliefs, sex life, sexual orientation, or political opinions. We call this special category data.
We will only process this type of information with your explicit consent. We will ask you to confirm your consent before we begin working together, and you can withdraw it at any time.
If you are referred to us by a sponsoring organisation
Sometimes individuals are referred to us for coaching by their employer or another organisation (the sponsor). In these cases:
- Your name, email address, phone number and address
- Session scheduling information
- Where agreed with you in advance, brief headline updates may be shared with a named contact at the sponsoring organisation, for example, confirmation that sessions have taken place
- The general areas the coaching is covering, shared in broad terms only.
The content of your coaching sessions is always kept confidential. Nothing discussed in sessions is shared with the sponsoring organisation without your explicit agreement. Your coaching records are held separately from any information shared with the sponsor.
If you provide a testimonial
- Your original testimonial content
- A record of your consent to use it
- Your contact details, if your testimonial was received by email
All testimonials are anonymised before publication. The original content and consent record are held securely and are not shared publicly. Please note that where content has already been published by third parties, such as external websites or print publications, we may not be able to guarantee removal.
If you visit our website
- IP address, unique cookie IDs, device information, browser type
- Behavioural data such as pages viewed and time spent on the site
This data is collected via cookies. Please see the later section on cookies for more information about how we use cookies.
How we collect your data
We collect personal data in the following ways:
- When you contact us by email, phone or through our website contact form
- When you complete any forms or questionnaires we provide as part of our services
- During coaching sessions and related communications
- When you provide a testimonial
- When a sponsoring organisation refers you to us for coaching
- When you visit our website (via cookies; see section 8)
- When you make a payment by bank transfer
Why we use your data and our legal basis for doing so
Under UK GDPR, we must have a legal basis for processing your personal data. The table below sets out what we use your data for and why we are legally permitted to do so.
- To respond to your enquiry and progress towards a coaching contract: Contract – Article 6(1)(b) and Legitimate interests – Article 6(1)(f) (for following up on enquiries)
- To deliver coaching services to you: Contract – Article 6(1)(b)
- To manage the practical administration of your coaching, including scheduling, invoicing and contracting: Contract – Article 6(1)(b)
- To process and record payments and meet our tax obligations: Contract – Article 6(1)(b) and Legal obligation – Article 6(1)(c)
- To process sensitive personal information you choose to share during coaching: Explicit consent – Article 9(2)(a)
- To share headline progress updates with a sponsoring organisation, in agreement with you: Contract – Article 6(1)(b)
- To collect and publish anonymised testimonials for marketing purposes: Consent – Article 6(1)(a) and Explicit consent – Article 9(2)(a) where sensitive information is involved
- To respond to a request to withdraw consent or delete sensitive personal data: Legal obligation – Article 6(1)(c)Consent – Article 6(1)(a)
- To respond to a subject access request or other data rights request: Legal obligation – Article 6(1)(c)
- To operate our website and analyse how it is used: Consent – Article 6(1)(a) (non-essential cookies) and Legitimate interests – Article 6(1)(f) (strictly necessary cookies)
Who we share your data with
We do not sell, rent or share your personal data with third parties for marketing purposes.
We may share your data in the following limited circumstances:
Sponsoring organisations
If you have been referred to us for coaching by an employer or another organisation, we may share limited headline information with a named contact at that organisation, for example, confirmation that sessions have taken place. Any such sharing will always be agreed with you in advance and will not include the content of your coaching sessions.
Legal requirements
We may disclose your personal data if required to do so by law or in response to a valid request from a regulatory or law enforcement authority.
Business transfer
If Key & Compass is sold or transferred, your personal data may be transferred to the new owner as part of that transaction. We would notify you in advance if this were to occur.
Service providers (processors)
We use the following third-party services to store and manage data on our behalf. These companies act as our data processors and are only permitted to use your data as we instruct them:
- Google Workspace: Used to store client records, emails and documents. Data is stored on Google servers in the EU. Google Workspace Data Processing Amendment accepted 18/05/26.
- Cookiebot: Used to manage cookie consent on our website. Cookiebot DPA accepted 18/05/26.
- Docusign, Inc.: DocuSign eSignature stores signed documents in its European data centre region. Limited personal data used in authentication and audit trails may be processed across regions, covered by DocuSign’s EU-approved Binding Corporate Rules for Processors.
How long we keep your data
We keep your data only for as long as necessary.
- Coaching session records and client data: 6 years after the coaching relationship ends, plus 12 months
- Enquiry and discovery conversation records (where you become a client): 6 years after the coaching relationship ends, plus 12 months
- Enquiry records (where you do not proceed): 1 year from last contact, or from the point you confirm you do not wish to proceed
- Signed agreements and electronic signature records: 6 years after the end of the relevant contractual relationship, plus 12 months.
- Invoices and payment records: 6 years after the coaching relationship ends, plus 12 months, in line with HMRC requirements
- Testimonial consent records and original quotes: For as long as the testimonial is in active use, plus 6 years from last use
- Published anonymised testimonials: These are not personal data and are not subject to a retention limit
- Website cookie data: 26 months, or until you clear your browser cookies
- Subject access request and consent withdrawal records: 6 years plus 12 months
After the relevant retention period, personal data is securely deleted. Records are moved to an archive folder within 3 months of the relationship ending and deleted at the end of the retention period.
International transfers
Your personal data is primarily stored on Google servers located in the EU. This transfer is covered by a valid UK adequacy decision under Article 45 of UK GDPR.
DocuSign eSignature stores signed documents in its European data centre region. Limited personal data used in authentication and audit trails may be processed across regions, covered by DocuSign’s EU-approved Binding Corporate Rules for Processors.
Our website uses Cookiebot to manage cookie consent. Cookiebot may process limited technical data via Akamai, a US-based content delivery network. This is covered by appropriate data transfer safeguards.
We do not otherwise transfer your personal data outside the UK without ensuring appropriate safeguards are in place.
Cookies
Our website uses cookies (small files stored on your device) to help it work properly and to understand how visitors use it.
We use Cookiebot to manage cookie consent. When you first visit our website, you will be asked whether you agree to non-essential cookies. You can change your preferences at any time by clicking the fingerprint icon on our website.
Types of cookies we use
- Strictly necessary cookies: These are essential for the website to function. They do not require your consent and are exempt from cookie consent rules under PECR.
- Analytics cookies (e.g. Google Analytics): These help us understand how visitors use the site. We only set these with your consent (Article 6(1)(a)).
If you have any questions about our use of cookies, please contact us at hello@keyandcompass.co.uk
How we keep your data secure
We take the security of your personal data seriously. Our security measures include:
- All data is stored digitally; we do not retain paper records. Any paper notes are immediately transferred to PDF and the paper copy securely destroyed.
- All digital records are stored in Google Workspace, which is password protected with two-factor authentication.
- Access to client records is restricted to Christabel Tingay only.
- We do not store payment card details; all payments are made by bank transfer.
- Google Workspace operates under security standards that meet UK GDPR requirements, as set out in their Data Processing Amendment.
In the event of a personal data breach that is likely to affect your rights and freedoms, we will notify you and the Information Commissioner’s Office (ICO) as required by law.
Your rights
Under UK GDPR, you have the following rights in relation to your personal data:
- Right of access: You can request a copy of the personal data we hold about you.
- Right to rectification: You can ask us to correct inaccurate or incomplete information.
- Right to erasure: You can ask us to delete your personal data in certain circumstances.
- Right to restrict processing: You can ask us to limit how we use your data in certain circumstances.
- Right to data portability: You can ask us to provide your data in a commonly used, machine-readable format.
- Right to object: You can object to processing based on legitimate interests.
- Right to withdraw consent: Where we rely on your consent to process your data, you can withdraw it at any time. This does not affect the lawfulness of any processing carried out before withdrawal.
- Automated decision-making: We do not use automated decision-making or profiling.
To exercise any of these rights, please contact us at hello@keyandcompass.co.uk. We will respond within one month. We may need to verify your identity before processing your request.
You will not be charged a fee to exercise your rights, unless your request is clearly unfounded, repetitive or excessive.
How to make a complaint
If you are unhappy with how we have handled your personal data, please contact us in the first instance at hello@keyandcompass.co.uk and we will do our best to resolve your concern.
You also have the right to complain to the Information Commissioner’s Office (ICO):
Website: www.ico.org.uk
Telephone: 0303 123 1113
Post: ICO, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Other privacy notices
This notice covers our main processing activities. Some activities have their own separate privacy documentation:
- When you purchase coaching sessions or enter into coaching through a sponsor, you will be asked to complete a Coaching Services Agreement which sets out the terms of our working relationship and includes additional data protection information specific to your coaching engagement.
- Coaching programme evaluations: where we conduct a formal evaluation of a coaching programme, participants receive a dedicated Participant Information Sheet covering how evaluation data is collected, used and stored.
This notice is intended to be read alongside any other privacy documentation we provide to you. It does not override those documents.
Changes to this notice
We may update this privacy notice from time to time to reflect changes in our practices or legal requirements. The current version will always be available on our website at www.keyandcompass.co.uk.
Where changes are significant, we will notify existing clients directly.
End/