GDPR and Privacy Policy

HJ Wheeler Associates Ltd is committed to protecting personal information and using it fairly, lawfully, transparently and securely. This policy explains how we collect, use, share and protect personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and relevant amendments made by the Data (Use and Access) Act 2025.

1. Who We Are and Our Data Protection Roles

HJ Wheeler Associates Ltd may act as a data controller or a data processor depending on the particular processing activity.

We act as a data controller where we decide why and how personal data is used, for example in relation to enquiries, our own client and professional records, invoicing and the delivery of services where we determine the purposes of processing.

We may act as a data processor where a commissioning organisation provides personal data for us to process on its behalf and in accordance with its documented instructions, for example participant contact details or other information supplied for an agreed programme, diagnostic or consultancy assignment.

Questions about our use of personal data may be directed to Holly Wheeler at: hollywheeler@gmail.com.

2. Personal Data We May Collect

Name, address, telephone number, email address and other contact details.
Payment, invoice and financial information where applicable.
Correspondence, enquiries, appointment and programme information.
Information provided during therapy, coaching, leadership development, interviews, diagnostics or other professional work.
Information relating to health, wellbeing or personal circumstances where relevant to the service provided.
Participant, stakeholder or employee information supplied by a commissioning organisation.
Technical or website information collected through our website or online services where applicable.
Other information reasonably necessary for professional relationships or commissioned work.

3. How We Use Personal Data

To provide therapy, coaching, leadership development, organisational development and associated professional services.
To respond to enquiries and arrange, manage and deliver appointments, programmes and contracts.
To communicate with clients, participants, commissioners, associates and professional partners.
To process payments, manage invoices and maintain appropriate business, professional and financial records.
To undertake agreed interviews, diagnostics, surveys, evaluation or programme activity.
To comply with legal, contractual, regulatory, safeguarding, insurance or professional obligations.
To operate and protect our business, systems and services.

4. Lawful Basis for Processing

We process personal data only where we have a lawful basis. Depending on the circumstances, this may include contract, legal obligation, legitimate interests, recognised legitimate interests where applicable under current data protection law, or consent. Where we rely on consent, it may be withdrawn at any time. Where we act solely as a processor, the commissioning organisation is responsible for determining the lawful basis for the processing and we process the information only in accordance with the controller’s documented instructions, except where UK law requires otherwise.

5. Special Category Data

Some information processed through therapy, coaching, EDI work, wellbeing activity or other professional services may be special category data, including information about physical or mental health, racial or ethnic origin, religious or philosophical beliefs, sexual orientation or other protected information.

Where HJ Wheeler Associates Ltd acts as controller, we will process special category data only where there is both a lawful basis and an appropriate additional condition under data protection law. We collect and use such information only where it is relevant and necessary. Where we act as processor, we handle special category data in accordance with the commissioning controller’s documented instructions and applicable contractual safeguards.

6. Data Minimisation, Privacy by Design and DPIAs

We apply data minimisation and data protection by design. We seek to collect, access and retain only the personal information reasonably necessary for the purpose of the work and consider privacy, confidentiality and security when designing projects, programmes, surveys, diagnostics and information-sharing arrangements.

Where proposed processing is likely to result in a high risk to individuals’ rights and freedoms, we will undertake an appropriate Data Protection Impact Assessment (DPIA), or support the commissioning organisation to undertake one, before the processing begins.

7. Information Received from Commissioning Organisations

We may receive personal information from commissioning organisations, for example participant or stakeholder names, contact details or relevant programme information. We will use this information only for the agreed purpose and, where required, ensure that individuals receive appropriate privacy information about how their data will be used.

Where we process information on behalf of a client, the processing will be governed by appropriate contractual or data-processing terms. At the end of the agreed processing period, information will be returned or securely deleted where required by the controller, unless the law requires otherwise.

8. Associates, Service Providers and Data Sharing

We do not share personal data unnecessarily. Information may be shared where required by law or safeguarding obligations, with the individual’s consent where appropriate, for secure payment or professional services, to obtain appropriate legal or professional advice, or with trusted service providers supporting functions such as email, cloud storage, booking, website, accounting and IT.

Associates and professional partners are given access only to information reasonably necessary for their role and are subject to appropriate confidentiality and data-protection requirements.

Where an associate or service provider acts as a sub-processor on a client contract, appropriate contractual protections will apply.

We share the minimum personal data necessary for the relevant purpose and expect organisations processing information for us to provide appropriate security and confidentiality.

9. International Transfers and Cloud Services

Some technology or cloud service providers may store or process information outside the UK. Where personal data is transferred internationally, we will ensure that the transfer is permitted under UK data protection law and that an appropriate transfer mechanism or safeguard is in place where required.

10. Data Storage, Security and Retention

We use appropriate technical and organisational measures to protect personal data against accidental loss, unauthorised access, disclosure, alteration or misuse. Access is limited according to professional or business need.

Personal data is retained only for as long as necessary for the purpose for which it is held and in accordance with relevant legal, contractual, insurance, safeguarding and professional requirements. HJ Wheeler Associates Ltd maintains an internal Information & Data Management Schedule setting out proportionate retention rules for the main categories of information we hold. Information that is no longer required is securely deleted, returned or anonymised as appropriate.

11. Marketing Communications

Where we send marketing or newsletter communications, we will do so only where permitted by law. Individuals can unsubscribe at any time using the option provided in the communication or by contacting us. Withdrawing consent to marketing will not affect any other service.

12. Your Rights

Subject to the circumstances and applicable law, individuals may have rights to access personal data, request correction or deletion, restrict or object to processing, request portability of certain data, and withdraw consent where consent is relied upon. Individuals may also complain to the Information Commissioner’s Office (ICO).

These rights are not absolute. We may need to verify identity and may need to retain or continue processing information where there is a lawful reason to do so. Where HJ Wheeler Associates Ltd acts as processor, requests relating to data subject rights will normally be referred to or handled in cooperation with the commissioning controller.

13. Personal Data Breaches

If a personal data breach occurs, we will assess the risk to individuals and take appropriate action. Where HJ Wheeler Associates Ltd is the controller and notification is legally required, we will notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of a reportable breach. Where required, affected individuals will also be informed.

Where we act as a processor, we will notify the relevant controller without undue delay after becoming aware of a personal data breach and provide reasonable assistance in meeting its legal obligations.

14. Data Protection Complaints

Anyone who believes that HJ Wheeler Associates Ltd has infringed data protection law in its handling of their personal information may make a complaint to Holly Wheeler at hollywheeler@gmail.com. We will facilitate complaints by email or another reasonable method, acknowledge receipt within 30 days, make appropriate enquiries, keep the complainant informed where necessary, and respond with the outcome without undue delay.

Individuals also retain the right to complain to the Information Commissioner’s Office.

15. Accountability and Review

The Director is responsible for data protection within HJ Wheeler Associates Ltd. We maintain proportionate records, contracts and procedures appropriate to the nature and scale of our processing so that we can demonstrate compliance with our data-protection obligations.

This policy will be reviewed annually and sooner where there are material changes to our processing activities, systems, services or legal requirements.

Policy last reviewed: 24.08.2026
Next review date: 24.08.2027