1. Who We Are & Scope of This Privacy Policy

This Privacy Policy explains how Rhianna Jones Co collects, uses, stores, shares and otherwise processes personal data in connection with its websites, programmes, coaching services, memberships, digital products, communities and wider business activities.

Who We Are

Rhianna Jones Co is the Data Controller responsible for determining how and why personal data is processed in connection with the activities covered by this Privacy Policy.

For the purposes of applicable data protection law, references to “Rhianna Jones Co”, “we”, “us” or “our” mean Rhianna Jones Co.

Where we use third-party service providers to process personal data on our behalf, those providers may act as Data Processors or, in some circumstances, independent Data Controllers depending on the nature of the service they provide.

Who This Privacy Policy Applies To

This Privacy Policy may apply to personal data relating to:

• visitors to our websites, landing pages and online platforms;

• people who enquire about our services or submit an application;

• prospective clients and leads;

• people who book or participate in sales, discovery, strategy or other calls;

• customers who purchase digital products or resources;

• coaching clients;

• programme participants;

• membership subscribers;

• participants in group coaching, masterminds, workshops or training;

• individuals who participate in WhatsApp groups, Facebook groups or other communities operated by us;

• individuals who submit forms, questionnaires, business audits, content reviews or feedback requests;

• people who communicate with us by email, messaging platforms, social media or other channels;

• individuals who provide testimonials, reviews, images, videos or case-study information;

• people who subscribe to our mailing list or receive marketing communications from us;

• individuals whose information is provided to us in connection with payment administration, disputes, fraud prevention or legal matters; and

• other individuals who interact with Rhianna Jones Co in a way which involves us processing their personal data.

The personal data we collect and the way we use it will depend upon the nature of your relationship and interaction with us.

Services Covered by This Privacy Policy

This Privacy Policy applies across Rhianna Jones Co’s business activities, including where applicable:

• private 1:1 coaching;

• group coaching programmes;

• masterminds and memberships;

• digital programmes and products;

• Motherhood Unpaused;

• complimentary programmes or resources;

• Membership Sites;

• WhatsApp and other programme messaging;

• online communities;

• Zoom or other video-conferencing sessions;

• feedback, audits and content reviews;

• sales and application processes;

• websites, checkout pages and landing pages;

• email communications and marketing; and

• related administrative, payment, customer-service and business activities.

Where a particular programme, service, platform or activity has additional privacy information specific to it, that information should be read alongside this Privacy Policy.

Our Role as Data Controller

As Data Controller, Rhianna Jones Co is responsible for ensuring that personal data for which it determines the purposes and means of processing is handled in accordance with applicable data protection law.

This includes determining, where applicable:

• what personal data is collected;

• why it is collected;

• how it is used;

• the lawful basis relied upon;

• who it may be shared with;

• how long it is retained;

• how it is protected; and

• how individuals may exercise their data-protection rights.

Third-Party Platforms

Some of our services are delivered using independent third-party platforms, including payment processors, Membership Site providers, social media platforms, messaging services, video-conferencing software and other technology providers.

Depending on the circumstances, those providers may process personal data:

• on our behalf as a Data Processor;

• jointly with us where the law recognises joint responsibility; or

• independently as their own Data Controller.

Their own privacy policies may therefore also apply to information processed through their platforms.

Further information is provided in the Third-Party Processors & Other Recipients section of this Privacy Policy.

Personal Data

For the purposes of this Privacy Policy, “personal data” means information relating to an identified or identifiable living individual.

This may include information which identifies you directly, such as your name or email address, as well as information which may identify you when combined with other information.

Certain types of personal data receive additional protection under data protection law. These are addressed in the Coaching Information & Special Category Data section.

Our Contact Details

The Data Controller is:

Rhianna Jones Co
Unit 166106, PO Box 7169,
Poole,
BH15 9EL,
UK

Email: hello@rhiannajones.co 

Questions about this Privacy Policy, the way we process personal data, or the exercise of data-protection rights may be sent to the email address above.

Scope & Other Policies

This Privacy Policy should be read alongside any applicable:

• Terms & Conditions;

• Coaching Agreement;

• Membership Agreement;

• Programme Agreement;

• Cookie Policy;

• checkout terms;

• consent or recording notice; or

• other privacy information provided in connection with a specific service.

Those documents may explain additional contractual or operational matters, but this Privacy Policy is intended to provide the principal explanation of how Rhianna Jones Co processes personal data across its business.

Where there is a conflict between this Privacy Policy and a mandatory requirement of applicable data protection law, the applicable legal requirement will take precedence.

2. Data Protection Principles

Rhianna Jones Co is committed to processing personal data responsibly and in accordance with applicable data protection law, including the UK General Data Protection Regulation (“UK GDPR”) and the Data Protection Act 2018.

When processing personal data, we follow the principles below.

Lawfulness, Fairness & Transparency

We will process personal data lawfully, fairly and transparently.

This means we will:

• identify an appropriate lawful basis for our processing;

• use personal data in ways individuals would reasonably expect, unless another lawful use is justified;

• provide clear information about how and why personal data is used; and

• not deliberately use personal data in ways which are unfair, misleading or unlawfully detrimental to individuals.

Where consent is required for a particular type of processing, we will seek appropriate consent and individuals may withdraw that consent where applicable.

Purpose Limitation

We collect personal data for specified, explicit and legitimate purposes.

We will not ordinarily use personal data for a materially different and incompatible purpose without first considering whether:

• the new use is compatible with the original purpose;

• another lawful basis applies;

• additional information should be provided to the individual; or

• consent or another legal requirement must be satisfied.

For example, information collected to deliver a coaching programme may also need to be used for associated administration, payment management, record keeping or the establishment, exercise or defence of legal claims where there is an appropriate lawful basis.

Data Minimisation

We aim to collect and process only the personal data which is adequate, relevant and reasonably necessary for the purpose for which it is being used.

Because coaching can involve personal discussions, Clients may voluntarily disclose information beyond what we specifically request.

Where particularly sensitive information is not reasonably necessary for us to provide a service, individuals are encouraged not to provide it.

We will not intentionally collect excessive personal data merely because it may potentially be useful in the future.

Accuracy

We take reasonable steps to ensure that personal data we process is accurate and, where necessary, kept up to date.

Individuals are responsible for providing accurate information when interacting with us and should notify us where important information changes or where they believe information we hold is inaccurate.

Where we become aware that personal data is materially inaccurate or incomplete, we will take reasonable steps to correct or update it where appropriate.

Storage Limitation & Retention

We will not retain identifiable personal data for longer than is reasonably necessary for the purposes for which it is processed.

Different categories of information may be retained for different periods depending upon matters including:

• the nature of the information;

• the service or Programme involved;

• our contractual obligations;

• continuity and administration of services;

• accounting and tax requirements;

• payment records and financial disputes;

• fraud and chargeback prevention;

• complaints;

• safeguarding considerations where applicable;

• the establishment, exercise or defence of legal claims; and

• other applicable legal or regulatory requirements.

When personal data is no longer reasonably required, we will take appropriate steps to delete, anonymise or otherwise securely dispose of it.

Further information is provided in the Data Retention section.

Integrity, Confidentiality & Security

We take appropriate technical and organisational measures designed to protect personal data against:

• unauthorised or unlawful access;

• accidental loss;

• inappropriate disclosure;

• destruction;

• alteration;

• misuse; and

• other forms of unauthorised processing.

The measures used will depend upon the nature and sensitivity of the information, the way it is processed and the risks reasonably associated with that processing.

No method of electronic transmission or storage can be guaranteed to be completely secure. We therefore do not promise absolute security, but we take reasonable and proportionate measures to protect personal data.

Accountability

Rhianna Jones Co is responsible for demonstrating compliance with applicable data protection requirements in relation to processing for which it acts as Data Controller.

Where appropriate, this may include:

• maintaining appropriate privacy documentation and records;

• identifying and documenting lawful bases for processing;

• implementing appropriate policies and procedures;

• using suitable contractual arrangements with Data Processors;

• considering data protection when introducing new systems or processing activities;

• implementing appropriate security measures;

• responding to data-protection rights requests;

• managing personal-data breaches appropriately;

• reviewing retention practices; and

• taking additional precautions where processing presents a higher risk to individuals.

Where a processing activity is likely to result in a high risk to individuals’ rights and freedoms, we will consider whether a Data Protection Impact Assessment (DPIA) or other appropriate assessment is required.

Special Category & Sensitive Information

Where we process personal data which receives additional protection under applicable law, including Special Category Data, we will apply the additional requirements relevant to that processing.

Where UK GDPR requires both an Article 6 lawful basis and an additional condition for processing Special Category Data, we will identify and rely upon the appropriate bases before carrying out that processing.

Further information is provided in the Coaching Information & Special Category Data section.

Privacy by Design & Default

Where reasonably appropriate, we aim to consider data protection when designing or changing our programmes, systems, processes and services rather than treating privacy as an afterthought.

This includes considering whether personal data can reasonably be:

• limited;

• access-restricted;

• securely stored;

• deleted when no longer required;

• anonymised or pseudonymised where appropriate; or

• processed in a less intrusive way while still achieving the legitimate purpose.

These principles apply throughout the lifecycle of personal data processed by Rhianna Jones Co.

3. Personal Data We Collect

The personal data we collect depends on how you interact with Rhianna Jones Co, which services or Programmes you use, and the information reasonably required to provide and administer those services.

We may collect, use, store or otherwise process the following categories of personal data.

Identity Data

This may include:

• full name;

• preferred name;

• title, where provided;

• date of birth or age where reasonably required;

• signature or electronic acceptance records; and

• other information reasonably necessary to identify you.

Contact Data

This may include:

• email address;

• telephone or mobile number;

• billing or postal address;

• social media usernames or profile details; and

• other contact information you provide to us.

Account & Login Data

Where you receive access to a Membership Site, digital Programme or other protected platform, we may process information including:

• account identifiers;

• registered email address;

• username;

• account status;

• login and access records;

• Programme access history;

• authentication or security information; and

• information relating to suspected unauthorised account access.

Passwords may be managed by the relevant platform provider and are not necessarily directly accessible to Rhianna Jones Co.

Transaction, Payment & Billing Data

We may process information relating to purchases and payments, including:

• products, Programmes or services purchased;

• amount paid or payable;

• currency;

• VAT and applicable fees;

• payment-plan information;

• billing details;

• transaction identifiers;

• payment dates;

• payment status;

• failed, declined, reversed or refunded payments;

• outstanding balances;

• chargebacks or payment disputes; and

• invoice and accounting records.

Payments may be processed by independent payment providers such as Stripe or other providers we make available.

We do not ordinarily need to directly receive or store complete payment-card details where those details are securely processed by the applicable payment provider.

Programme & Enrolment Data

We may process information concerning your participation in our services, including:

• Programme or membership purchased;

• enrolment and start dates;

• Programme tier or service level;

• access periods;

• attendance and participation;

• resources or services available to you;

• Programme progress where this information is available to us;

• support used;

• complimentary access or bonuses;

• cancellations, suspensions or termination; and

• other records reasonably necessary to administer your participation.

Communications

We may process communications between you and Rhianna Jones Co or members of our team, including communications through:

• email;

• WhatsApp;

• social media;

• website forms;

• customer-support channels;

• Membership Sites;

• video-conferencing platforms; and

• other messaging or communication services.

This may include the content of communications together with relevant metadata such as dates, times and participants.

Questionnaires, Forms & Applications

Where you complete a form, questionnaire, application, survey, feedback form or other submission, we may process the information you choose or are required to provide.

Depending on the purpose, this may include information about:

• your goals;

• business;

• current circumstances;

• experience;

• challenges;

• desired outcomes;

• suitability for a Programme;

• coaching requirements;

• feedback;

• preferences; and

• other information relevant to the particular form.

Coaching Information

Because we provide coaching and mentoring services, you may disclose personal information during coaching sessions, Programme participation or communications with us.

Depending on the nature of the coaching relationship, this may include information about your:

• goals and ambitions;

• beliefs and mindset;

• confidence;

• experiences;

• personal circumstances;

• relationships or family circumstances;

• emotions and challenges;

• work or business;

• finances or financial goals;

• habits and behaviours;

• progress and results; and

• other matters you voluntarily choose to discuss.

Some information disclosed in a coaching context may constitute Special Category Data or otherwise sensitive information. Additional provisions concerning this information are contained in the Coaching Information & Special Category Data section.

Coaching & Session Notes

Where reasonably necessary for the provision, continuity, administration or protection of our services, we may create and retain notes relating to coaching sessions or Client interactions.

These may include:

• topics discussed;

• goals;

• agreed actions;

• progress;

• follow-up points;

• coaching observations;

• relevant Client circumstances;

• administrative information; and

• other information reasonably necessary to maintain appropriate Client or Programme records.

Coaching notes are not intended to constitute medical, psychological or clinical records.

Content Reviews, Social Media Reviews & Business Audits

Where a service includes personalised feedback, reviews or audits, we may process information you submit or make available for that purpose, including:

• social media profiles;

• social media content;

• websites or landing pages;

• marketing materials;

• offers;

• pricing;

• messaging;

• sales processes;

• content strategy;

• audience information;

• business performance information;

• screenshots;

• documents;

• links; and

• other business materials submitted for review.

We may create associated notes, recommendations, feedback or analysis as part of providing the relevant service.

Business & Professional Information

We may process information concerning your business or professional activities where relevant to our services, including:

• business or trading name;

• business type or niche;

• job or professional role;

• products and services;

• target audience;

• offers and pricing;

• business goals;

• marketing activities;

• sales and revenue information where voluntarily provided;

• business performance;

• social media presence;

• website information; and

• other information relevant to coaching, mentoring or business support.

Some business information may not constitute personal data where it relates solely to a separate legal entity. However, it may be personal data where it identifies or relates to an individual.

Messaging Support Data

Where a Programme or service includes messaging support, we may process:

• messages submitted by the Client;

• questions and requests for support;

• voice notes;

• images, screenshots, documents or links sent through messaging;

• responses from Rhianna Jones Co or its team;

• dates and times of communications; and

• information voluntarily disclosed within those communications.

Clients should avoid sending personal or sensitive information which is not reasonably necessary for the support being requested.

Scheduling & Attendance Data

Where you book or attend calls, coaching sessions, workshops, events or other appointments, we may process:

• booking information;

• appointment date and time;

• timezone;

• attendance;

• cancellations and rescheduling;

• late attendance or missed appointments;

• booking-form responses;

• meeting links;

• reminders; and

• related administrative communications.

Community & Group Participation Data

Where you participate in a WhatsApp group, Facebook Group, group coaching environment, membership community or another shared Rhianna Jones Co space, we may process information relating to your participation, including:

• profile information visible through the relevant platform;

• posts;

• messages;

• comments;

• reactions;

• questions;

• images, videos or files you share;

• participation and engagement; and

• moderation or conduct-related information.

Information you voluntarily share in a group environment may also be visible to other participants. This is addressed further in the Group Coaching, WhatsApp, Facebook Groups & Communities section.

Website, Device & Technical Data

When you use our websites, Membership Sites or other online services, we or our technology providers may collect technical information including:

• IP address;

• device type;

• browser type and version;

• operating system;

• approximate location derived from technical information;

• time zone;

• pages viewed;

• referring pages or sources;

• website interactions;

• login and access information;

• cookie identifiers;

• analytics information; and

• other technical or diagnostic data.

The information collected will depend upon the technologies and cookies being used.

Further information is provided in the Cookies & Similar Technologies section.

Marketing & Preference Data

We may process information relating to your preferences and interactions with our marketing, including:

• marketing subscriptions;

• email preferences;

• consent records;

• unsubscribe or opt-out requests;

• communication preferences;

• marketing emails sent;

• email opens or link interactions where tracking is used;

• lead source;

• offers or campaigns you interacted with; and

• information used to understand the effectiveness of our marketing.

Purchasing a Programme or service does not, by itself, constitute blanket consent to receive optional direct marketing where consent or another requirement applies.

Testimonials, Reviews, Case Studies, Images & Video

Where you provide or agree to participate in a testimonial, review, case study or marketing feature, we may process information including:

• your name;

• business or professional information;

• written testimonial or review;

• results or experiences you choose to share;

• photographs;

• screenshots;

• audio;

• video;

• social media profile or username; and

• other information agreed for the particular use.

We will distinguish between identifiable promotional use and genuinely anonymised or aggregated information where appropriate.

Acceptance of Programme Terms does not, by itself, constitute blanket permission for us to use your identifiable image, private communications or testimonial for marketing.

Recordings, Audio & Transcripts

Where calls, sessions, workshops, interviews or other interactions are recorded, we may process:

• video recordings;

• audio recordings;

• transcripts;

• captions;

• chat messages captured as part of a recording;

• names or profile information visible within the recording; and

• information discussed or otherwise captured during the session.

We may also use transcription, meeting-assistance or AI-supported tools where appropriate.

We will provide appropriate notice and obtain consent or rely upon another lawful basis where required before processing recordings or transcripts in this way.

Participation in a Programme does not automatically mean that every call or interaction will be recorded.

Further information is provided in the Calls, Recordings, Transcripts & AI Notetakers section.

Complaints, Disputes, Fraud & Legal Data

Where necessary, we may also process information connected with:

• complaints;

• refund requests;

• payment disputes;

• chargebacks;

• suspected fraud;

• unauthorised account access;

• Intellectual Property misuse;

• contractual disputes;

• debt or payment recovery;

• legal correspondence;

• insurance matters; and

• the establishment, exercise or defence of legal claims.

This may include relevant transaction records, communications, checkout records, electronic acceptance records, access records and other evidence reasonably necessary to investigate or respond to the matter.

We Do Not Necessarily Collect Every Category

The categories above describe personal data that may be processed across Rhianna Jones Co’s wider business.

We do not collect every category of information about every individual.

The information actually collected will depend upon:

• how you interact with us;

• what you purchase or apply for;

• which Programme or service you participate in;

• what information you voluntarily provide;

• which features or platforms you use; and

• what information is reasonably necessary for the relevant purpose.

We aim to collect only personal data which is adequate, relevant and reasonably necessary in accordance with the Data Protection Principles set out in this Privacy Policy.

4. How We Collect Personal Data

We collect personal data through a variety of channels depending on how you interact with Rhianna Jones Co.

Personal data may be collected directly from you, automatically through your use of our websites and platforms, or from third parties where appropriate and lawful.

Information You Provide Directly to Us

Most personal data we process is provided directly by you.

This may occur when you:

• purchase a Programme, membership, product or service;

• create or access an account;

• submit an enquiry;

• apply for a Programme or coaching service;

• book a call or appointment;

• complete a questionnaire, form, survey or application;

• participate in coaching or mentoring;

• submit information for a content review, social media review, business audit or feedback request;

• contact us for support;

• participate in a community;

• provide feedback, a testimonial or review; or

• otherwise communicate or interact with us.

You are responsible for ensuring that personal data you provide is reasonably accurate and that you have the right to provide any personal data relating to another individual.

Checkout, Purchases & Forms

When you purchase from us or submit information through a checkout page, application form, registration page or other online form, we may collect information including:

• identity and contact details;

• billing information;

• Programme or product selected;

• transaction information;

• responses to form questions;

• marketing preferences;

• contractual acknowledgements and consents; and

• other information necessary to process the transaction or request.

We may also retain records showing when and how particular Terms, policies, consents or acknowledgements were accepted.

Sales, Applications & Enquiries

Where you enquire about working with us, apply for a Programme or participate in a sales or discovery process, we may collect personal data through:

• enquiry forms;

• application forms;

• email;

• telephone or video calls;

• social media;

• direct messages;

• booking forms; and

• communications with members of our team.

We may retain reasonable records of these interactions to manage the enquiry, assess suitability, provide requested information, follow up where appropriate and maintain appropriate business records.

Coaching & Programme Participation

We may collect personal data through your participation in our coaching, mentoring, Programmes, memberships, workshops and other services.

This may include information you provide:

• during 1:1 sessions;

• during group coaching;

• through Programme exercises or questionnaires;

• during strategy sessions;

• through content or business reviews;

• when requesting feedback;

• during workshops or masterminds; and

• through other interactions connected with the service.

Because coaching conversations can be personal, you may voluntarily disclose information which we did not specifically request.

Where information is particularly sensitive, the additional provisions in Coaching Information & Special Category Data apply.

Email, WhatsApp & Other Messaging

We may collect personal data when you communicate with Rhianna Jones Co or its team through:

• email;

• WhatsApp;

• social media direct messages;

• Membership Site messaging;

• customer-support channels;

• voice notes; and

• other communication platforms.

This may include the content of messages and any documents, screenshots, images, audio, video or links you choose to send.

The relevant platform provider may also process information independently under its own privacy terms.

Communities & Group Environments

Where you participate in a WhatsApp group, Facebook Group, group coaching space, membership community or another shared environment operated by Rhianna Jones Co, we may collect information through your participation.

This may include:

• posts and messages;

• comments and reactions;

• questions;

• images, videos and files;

• profile information;

• participation or engagement information; and

• moderation or conduct-related information.

Information you choose to post in a shared environment may be visible to other participants.

Further information is provided in Group Coaching, WhatsApp, Facebook Groups & Communities.

Zoom & Other Video-Conferencing Platforms

We may collect personal data when you participate in coaching sessions, sales calls, strategy sessions, workshops, masterminds or other meetings through Zoom or another video-conferencing provider.

Depending on the meeting and settings used, this may include:

• your name or display name;

• email address;

• profile information;

• attendance information;

• audio and video;

• chat messages;

• information you voluntarily discuss;

• recordings; and

• transcripts or captions where those features are used.

Calls are not automatically treated as recorded merely because they take place through a video-conferencing platform.

Where recording, transcription or AI meeting-assistance tools are used, the additional provisions in Calls, Recordings, Transcripts & AI Notetakers apply.

Websites, Cookies & Online Activity

When you visit or interact with our websites, landing pages, checkout pages or other online services, certain information may be collected automatically by us or our technology providers.

This may include:

• IP address;

• device and browser information;

• operating system;

• approximate location;

• referring source;

• pages viewed;

• actions taken on a page;

• date and time of visits;

• cookie or similar identifiers;

• analytics information; and

• other technical information concerning your interaction with our services.

Some technologies are necessary for a website or service to function, while others may be used for analytics, personalisation or marketing where permitted.

Further information is provided in Cookies & Similar Technologies.

Payment Processors & Financial Providers

Where you make a purchase, payment providers may provide us with information relating to the transaction.

Depending on the provider and transaction, this may include:

• payer name;

• billing information;

• transaction identifier;

• amount and currency;

• payment status;

• limited payment-method information;

• failed or declined payment information;

• refunds;

• disputes or chargebacks; and

• fraud or risk information.

Complete payment-card details are generally processed directly by the relevant payment provider rather than being provided to Rhianna Jones Co.

Payment providers may process personal data independently in accordance with their own legal obligations and privacy policies.

Referrals & Other Third Parties

In some circumstances, we may receive personal data about you from another person or organisation.

This may include:

• referral or affiliate partners;

• a person who introduces or refers you to us;

• payment providers;

• technology or platform providers;

• professional advisers;

• service providers;

• publicly available professional or business sources; or

• another person acting with your authority.

We will only use information obtained from third parties where we have an appropriate lawful basis to do so.

Where required by applicable law, we will provide appropriate privacy information where personal data has been obtained indirectly rather than directly from you.

Publicly Available Information

Where reasonably relevant to our relationship with you, we may access information you have made publicly available, particularly business or professional information.

For example, where you submit a social media account, website or other public business asset for review, we may access the publicly available information necessary to provide that review.

We do not treat the fact that information is publicly accessible as automatically permitting us to use it for any purpose.

Any processing must still have an appropriate lawful basis and comply with applicable data-protection requirements.

Automated & Technical Collection

Certain personal data may be generated automatically when you use our systems or services rather than being actively submitted by you.

This may include:

• login records;

• account activity;

• Programme access information;

• website analytics;

• email interaction data where tracking is used;

• cookie information;

• device information;

• transaction events;

• security logs; and

• technical or diagnostic information.

Automated collection does not necessarily mean that we use automated decision-making within the meaning of UK GDPR.

Where we carry out solely automated decision-making which produces legal or similarly significant effects, we will provide any additional information and safeguards required by applicable law.

Information Generated by Us

Some personal data is created by Rhianna Jones Co as part of providing and administering our services.

This may include:

• coaching or session notes;

• feedback;

• content-review notes;

• business-audit findings;

• administrative records;

• customer-support records;

• attendance records;

• account or Programme status;

• records relating to complaints or disputes; and

• internal records reasonably necessary to manage our contractual relationship with you.

Information From Multiple Sources

In some circumstances, we may combine information obtained from different sources where reasonably necessary for a legitimate purpose.

For example, we may connect transaction information from a payment provider with your Programme account so that we can confirm payment and provide the correct access.

We will not combine personal data in a way which is incompatible with the purposes for which it was collected unless another lawful basis or other legal justification permits us to do so.

Data Minimisation

Regardless of how personal data is collected, we aim to collect and process only information which is adequate, relevant and reasonably necessary for the relevant purpose.

The fact that we are technically capable of accessing or collecting particular information does not mean that we will automatically do so.

5. Coaching Information & Special Category Data

Because Rhianna Jones Co provides coaching, mentoring and personal-development services, Clients may voluntarily disclose information about their personal circumstances, experiences, thoughts, emotions, relationships, wellbeing, business or other areas of their lives.

Some of this information will be ordinary personal data. Some information may constitute Special Category Data under the UK GDPR and therefore receives additional legal protection.

Ordinary Coaching Information

Information disclosed during coaching does not automatically become Special Category Data simply because it is personal, private or sensitive.

Ordinary coaching information may include information about:

• goals and ambitions;

• confidence and mindset;

• personal experiences;

• relationships and family circumstances;

• work and business;

• financial circumstances or goals;

• habits and behaviours;

• challenges and perceived barriers;

• personal development;

• business performance;

• decisions and action plans; and

• other matters voluntarily discussed as part of coaching.

We may process this information where reasonably necessary to provide coaching or Programme services, maintain appropriate coaching records, respond to communications, administer our contractual relationship or for another purpose described in this Privacy Policy.

The applicable Article 6 lawful basis will depend upon the purpose for which the information is being processed and is explained further in Our Purposes & Lawful Bases for Processing.

Special Category Data

Under UK data-protection law, certain categories of personal data receive additional protection.

Special Category Data includes personal data revealing or concerning an individual's:

• racial or ethnic origin;

• political opinions;

• religious or philosophical beliefs;

• trade union membership;

• genetic data;

• biometric data used for identification;

• physical or mental health;

• sex life; or

• sexual orientation.

Special Category Data may include factual information as well as certain information deliberately inferred about an individual.

Special Category Data in a Coaching Context

Rhianna Jones Co is a coaching business and not a healthcare provider. We do not ordinarily require Clients to provide medical or other Special Category Data simply in order to purchase our services.

However, because coaching conversations can involve personal experiences, Clients may voluntarily disclose Special Category Data.

For example, a Client may choose to discuss information relating to their:

• physical or mental health;

• disability or medical circumstances;

• religious or philosophical beliefs;

• racial or ethnic background;

• sexual orientation or sex life; or

• other Special Category Data relevant to something they wish to discuss.

Such information may appear in:

• coaching sessions;

• Strategy Sessions;

• questionnaires or forms;

• WhatsApp or other messaging support;

• emails;

• voice notes;

• coaching notes;

• community or group discussions;

• recordings or transcripts where applicable; or

• other communications with us.

We do not encourage Clients to provide Special Category Data which is unnecessary for the coaching or support they are seeking.

Additional Legal Requirements

Special Category Data is subject to stricter requirements than ordinary personal data.

Where Rhianna Jones Co processes Special Category Data, we must identify:

1. an appropriate lawful basis under Article 6 of the UK GDPR; and

2. a separate condition for processing under Article 9 of the UK GDPR.

An Article 6 lawful basis does not, by itself, permit us to process Special Category Data. Both requirements must be satisfied.

Where an Article 9 condition additionally requires a condition or safeguard under the Data Protection Act 2018, we will ensure that the applicable requirements are met before relying upon that condition.

Explicit Consent

In appropriate circumstances, we may rely upon the Client's explicit consent under Article 9(2)(a) to process particular Special Category Data.

Where we rely upon explicit consent, it will be:

• specific to the relevant processing;

• informed;

• freely given;

• affirmative and unambiguous;

• recorded appropriately; and

• capable of being withdrawn.

Explicit consent requires a clear statement and should identify the nature of the Special Category Data and the relevant purpose; it is a higher standard than simply accepting general Terms & Conditions.

Accordingly, accepting our Programme Terms or this Privacy Policy does not, by itself, constitute blanket explicit consent for us to process any and all Special Category Data for any purpose.

Where explicit consent is our Article 9 condition, the individual may withdraw that consent at any time.

Withdrawal does not make processing carried out lawfully before withdrawal unlawful.

Where withdrawal means we can no longer lawfully process information genuinely necessary to provide a particular optional service or feature, we will explain any practical consequences.

Other Article 9 Conditions

Explicit consent is not the only Article 9 condition which may potentially apply.

Depending upon the particular circumstances and purpose, another condition may apply where permitted by law.

For example, Special Category Data may sometimes need to be processed where it is necessary for the establishment, exercise or defence of legal claims under Article 9(2)(f).

This may become relevant where Special Category Data forms part of a complaint, contractual dispute, payment dispute, chargeback, legal correspondence or other legal matter.

Where we rely upon this condition, we will process only the information reasonably necessary and proportionate for the relevant legal purpose. The ICO confirms that the legal-claims condition can permit processing of Special Category Data where necessary to establish, exercise or defend a legal claim.

Other Article 9 conditions will only be relied upon where their specific legal requirements genuinely apply.

Serious Risk, Safeguarding & Vital Interests

Coaching is confidential within the limits explained in this Privacy Policy, but confidentiality does not mean that Special Category Data can never be processed or disclosed in exceptional circumstances.

Where information indicates a serious and immediate risk to someone's life or safety, or another exceptional safeguarding circumstance arises, we may need to consider whether processing or disclosure is permitted or required under applicable law.

Depending upon the circumstances, relevant legal grounds may include vital interests, safeguarding provisions or another applicable legal basis and Article 9 condition.

We will not treat a general concern or ordinary coaching disclosure as automatically justifying disclosure.

Any such processing will be considered on the particular circumstances and limited to what is reasonably necessary and legally permitted.

Substantial Public Interest Conditions

Certain processing may potentially be permitted under Article 9(2)(g) where it is necessary for reasons of substantial public interest and a specific condition under Schedule 1 of the Data Protection Act 2018 applies.

These conditions are narrowly defined and cannot be relied upon merely because processing would be commercially convenient or beneficial to Rhianna Jones Co.

Where we rely upon a Schedule 1 substantial-public-interest condition, we will meet the specific requirements of that condition, including maintaining an Appropriate Policy Document where required.

We Do Not Treat Coaching as Healthcare

Rhianna Jones Co does not provide medical treatment, psychological treatment, psychotherapy, diagnosis or healthcare through its coaching Programmes.

We will therefore not automatically rely upon the Article 9 health or social-care condition merely because health information happens to be discussed during coaching.

Where health-related information is processed, we will identify an Article 9 condition which genuinely applies to the particular processing.

Special Category Data Shared in Groups

Clients should exercise particular care when choosing to disclose Special Category Data in:

• WhatsApp groups;

• Facebook Groups;

• group coaching calls;

• masterminds;

• communities; or

• other shared environments.

Information voluntarily disclosed in those spaces may be seen or heard by other participants.

Although we may impose confidentiality and conduct expectations, Rhianna Jones Co cannot guarantee how another participant will independently handle information they receive.

Further information is provided in Group Coaching, WhatsApp, Facebook Groups & Communities.

Recordings, Transcripts & AI Tools

Where a recording, transcript, AI notetaker or similar technology captures Special Category Data disclosed during a session, the resulting recording or transcript may itself contain Special Category Data.

We will therefore consider the nature of the information, purpose of processing, applicable Article 6 basis and Article 9 condition, together with appropriate safeguards, when using such technologies.

We will not treat a Client's general participation in a Programme as blanket consent for Special Category Data to be used for AI training, marketing or unrelated purposes.

Data Minimisation

We aim not to collect Special Category Data unless it is reasonably necessary for a legitimate and lawful purpose.

Clients are encouraged not to provide detailed medical records, diagnoses or other highly sensitive information unless it is genuinely relevant to the interaction and appropriate to share with a coaching provider.

Where we receive Special Category Data which we do not reasonably need, we may delete, redact, restrict or avoid recording that information where appropriate.

Security & Access

We recognise that coaching information and Special Category Data can be particularly sensitive.

Access will therefore be limited, where reasonably appropriate, to Rhianna Jones Co personnel and authorised service providers who require access for a legitimate purpose.

Appropriate technical and organisational safeguards will be used having regard to the nature and sensitivity of the information.

Retention

Special Category Data will not be retained simply because it was disclosed to us.

We will consider whether continued retention is necessary for the purpose for which the information was collected, including where relevant:

• delivery and continuity of coaching;

• appropriate Client records;

• complaints or disputes;

• safeguarding;

• legal obligations; or

• establishment, exercise or defence of legal claims.

Where there is no continuing lawful need to retain identifiable Special Category Data, it will be deleted, anonymised or otherwise appropriately disposed of in accordance with our Data Retention provisions.

Your Choices

Where processing is genuinely optional, we will seek to preserve meaningful choice over whether Special Category Data is provided or used.

Clients may also ask us questions about how their Special Category Data is being processed or exercise applicable data-protection rights using the contact details provided in this Privacy Policy.

Where we rely upon explicit consent, consent can be withdrawn by contacting:

hello@rhiannajones.co

Withdrawal of consent does not necessarily require deletion where another legal ground requires or permits continued retention, for example where information is necessary for a legal claim.

Our Commitment

We will not use the fact that a Client has disclosed sensitive information during coaching as permission to use that information for unrelated purposes.

In particular, Special Category Data disclosed privately through coaching will not automatically be used for:

• marketing;

• testimonials;

• identifiable case studies;

• advertising;

• profiling for unrelated commercial purposes; or

• training public or third-party AI systems.

Any materially different use would require its own lawful justification and, where applicable, an appropriate Article 9 condition and additional notice or consent.

The appropriate Article 6 and Article 9 grounds applicable to our processing are explained further in Our Purposes & Lawful Bases for Processing.

6. Our Purposes & Lawful Bases for Processing

Under the UK GDPR, Rhianna Jones Co must have a valid lawful basis under Article 6 whenever we process personal data.

The lawful basis we rely upon depends on why we are processing the information. The same category of personal data may therefore be processed under different lawful bases for different purposes.

Where we process Special Category Data, an Article 6 lawful basis is not sufficient on its own. We must also identify an appropriate Article 9 condition, as explained in the Coaching Information & Special Category Data section.

The principal purposes for which we process personal data and the lawful bases we may rely upon are set out below.

Purpose

Lawful Basis

Responding to enquiries, applications and requests for information before purchase

Contract – taking steps at your request before entering into a contract; and/or Legitimate Interests – responding to enquiries and managing prospective Client relationships

Assessing applications or suitability for a Programme or service

Contract where necessary to take pre-contractual steps; and/or Legitimate Interests – ensuring our services are appropriately offered and administered

Processing purchases and enrolments

Contract – necessary to enter into and perform our Agreement with you

Providing coaching, Programmes, memberships, digital products and other purchased services

Contract – necessary to perform our Agreement with you

Providing and administering Membership Site or Programme access

Contract – necessary to deliver and administer the service purchased

Managing Client accounts, login access and account security

Contract and/or Legitimate Interests – administering services and protecting accounts, systems and Programme Content

Arranging and administering coaching calls, Strategy Sessions, workshops and other appointments

Contract – necessary to provide the relevant service

Maintaining attendance, cancellation, rescheduling and session records

Contract and/or Legitimate Interests – administering appointments and maintaining appropriate business records

Providing WhatsApp, email or other messaging support included within a Programme

Contract – necessary to provide the contracted support

Providing content reviews, social media reviews, business audits, feedback and other personalised services

Contract – necessary to provide the relevant service

Creating and maintaining reasonable coaching or session notes

Contract and/or Legitimate Interests – providing continuity of service and maintaining appropriate Client records

Operating group coaching, memberships and Rhianna Jones Co communities

Contract where participation forms part of a purchased service; and/or Legitimate Interests – administering, moderating and protecting our communities

Responding to Client questions, administrative requests and customer-support enquiries

Contract where connected with an existing Agreement; and/or Legitimate Interests – providing effective customer service

Processing payments and administering billing

Contract – processing amounts due under our Agreement; and Legal Obligation where financial records must be maintained

Maintaining invoices, transaction records, VAT records, accounting and tax information

Legal Obligation – complying with applicable tax, accounting and financial-record requirements

Managing failed or overdue payments

Contract and/or Legitimate Interests – administering and recovering properly due payments

Preventing and detecting fraud, payment abuse, unauthorised account access or misuse

Legitimate Interests – protecting our business, Clients, systems and Intellectual Property; and/or Legal Obligation where applicable

Investigating and responding to chargebacks and payment disputes

Legitimate Interests – protecting our financial and contractual interests and demonstrating the validity of transactions; and where applicable processing necessary for the establishment, exercise or defence of legal claims

Recovering unpaid amounts or referring matters for appropriate debt or legal recovery

Legitimate Interests and/or processing necessary for the establishment, exercise or defence of legal claims, subject to applicable law

Handling complaints, contractual disputes and legal correspondence

Legitimate Interests – managing complaints and protecting the rights of the parties; Legal Obligation where applicable; and/or processing necessary for legal claims

Establishing, exercising or defending legal claims

Legitimate Interests and/or another applicable Article 6 basis depending on the circumstances; additional Article 9 conditions will be identified where Special Category Data is involved

Protecting Rhianna Jones Co Intellectual Property and investigating unauthorised sharing or misuse

Legitimate Interests – protecting our proprietary materials, systems and commercial interests

Maintaining security, preventing cyber incidents and investigating suspicious activity

Legitimate Interests – protecting our systems, users and information; and Legal Obligation where applicable

Operating, maintaining and technically administering our websites and digital platforms

Legitimate Interests – operating secure and functional online services; and/or Contract where necessary to provide a purchased digital service

Using strictly necessary cookies and similar technologies

Legitimate Interests and/or another lawful basis as applicable under data-protection law, together with applicable requirements under electronic-communications law

Using non-essential analytics, advertising or marketing cookies

Consent where required under applicable electronic-communications and data-protection law

Analysing how our websites, Programmes and services are used

Legitimate Interests where the processing can lawfully occur without consent; otherwise Consent where required

Improving our Programmes, products, services, customer experience and business operations

Legitimate Interests – understanding and improving our services, provided those interests are not overridden by individuals' rights and freedoms

Creating genuinely anonymised or aggregated insights, statistics or business analysis

Where information has been genuinely anonymised, it is no longer personal data under UK GDPR. Any processing undertaken before anonymisation must have an appropriate lawful basis

Sending service, account, payment, contractual or other necessary administrative communications

Contract, Legal Obligation and/or Legitimate Interests, depending on the communication

Sending direct marketing communications

Consent where required and/or Legitimate Interests where direct marketing may lawfully be undertaken on that basis, subject to applicable electronic-marketing rules and the right to object

Recording and maintaining marketing preferences, consent and opt-out requests

Legal Obligation, Legitimate Interests and/or Consent, depending upon the record and purpose

Using testimonials, reviews, case studies, photographs, video or other identifiable Client material for marketing

Consent where consent is the appropriate basis and/or another appropriate lawful basis depending on the circumstances and nature of the material. We will obtain separate permission where required rather than treating acceptance of Programme Terms as blanket marketing consent

Using genuinely anonymised Client experiences, themes or results

Where the information is genuinely anonymised so the individual is no longer identifiable, UK GDPR does not apply to the resulting anonymised information. Processing undertaken to create that anonymised information must itself have an appropriate lawful basis

Recording calls, sessions, workshops or other interactions

The appropriate basis will depend on the purpose and circumstances and may include Consent, Contract or Legitimate Interests. Appropriate notice and any consent required by law will be provided

Creating transcripts, captions or meeting notes

Contract and/or Legitimate Interests where reasonably necessary for delivery, accessibility, administration or record keeping; Consent where required. Additional Article 9 requirements apply where Special Category Data is captured

Using AI-assisted tools for permitted administrative, analytical, content, support, transcription or operational purposes

Contract where necessary to provide a service; Legitimate Interests where reasonably necessary for efficient business operations; and/or Consent where required. Additional safeguards and Article 9 conditions apply where Special Category Data is processed

Complying with statutory, regulatory, court, law-enforcement or governmental requirements

Legal Obligation where we are required by law to process or disclose information

Protecting an individual's life or dealing with an exceptional serious and immediate safety situation

Vital Interests where the legal requirements for that basis are satisfied, together with an appropriate Article 9 condition where Special Category Data is involved

Managing a sale, restructuring, merger, acquisition or transfer of Rhianna Jones Co or its business/assets

Legitimate Interests – facilitating legitimate corporate transactions, subject to appropriate confidentiality and data-protection safeguards; and/or another applicable lawful basis

Contract

We rely on the contractual necessity basis where processing is objectively necessary to:

• enter into an Agreement with you at your request; or

• perform our contractual obligations to you.

For example, we need certain information to process your enrolment, provide Programme access, arrange contracted coaching sessions and administer your purchase.

We will not rely upon contract merely because processing is mentioned in our Terms & Conditions. The processing must actually be necessary for the relevant contractual purpose.

Legal Obligation

We may process personal data where necessary to comply with a legal obligation to which Rhianna Jones Co is subject.

This may include obligations concerning:

• tax and VAT;

• accounting and financial records;

• regulatory requirements;

• court orders;

• legally valid requests from authorities; and

• other statutory record-keeping or disclosure obligations.

Where we rely upon Legal Obligation, the obligation must arise from applicable law rather than simply from our own contractual terms.

Legitimate Interests

We may process personal data where it is necessary for a legitimate interest pursued by Rhianna Jones Co or, where appropriate, another person, provided that the interest is not overridden by your interests, fundamental rights or freedoms.

Our legitimate interests may include:

• operating and improving our business;

• providing effective Client support;

• maintaining appropriate Client and business records;

• protecting our systems and accounts;

• preventing fraud and misuse;

• protecting Intellectual Property;

• recovering properly due payments;

• defending legal rights;

• understanding and improving our services;

• maintaining appropriate security; and

• carrying out appropriate direct marketing where legally permitted.

Before relying upon Legitimate Interests where appropriate, we consider:

3. the legitimate purpose being pursued;

4. whether the processing is reasonably necessary for that purpose; and

5. the impact upon the individual's rights, interests and reasonable expectations.

Where an individual's rights or interests override ours, we will not rely upon Legitimate Interests for that processing.

Consent

Where we rely upon consent, consent will be requested in a manner appropriate to the processing and applicable legal requirements.

Consent must be freely given, specific, informed and indicated by a clear affirmative action.

You may withdraw consent at any time where consent is the basis upon which we are processing your personal data.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Withdrawing consent for one purpose does not necessarily affect processing undertaken for a separate purpose under another valid lawful basis.

Vital Interests

In exceptional circumstances, we may process personal data where necessary to protect the vital interests of an individual.

This basis is intended for situations involving essential interests such as someone's life and will not be used as a general justification for ordinary coaching or business processing.

Where Special Category Data is involved, a separate Article 9 condition must also apply.

Special Category Data

Where personal data constitutes Special Category Data, we will identify both:

• an appropriate Article 6 lawful basis for the processing; and

• an appropriate Article 9 condition.

Depending upon the particular circumstances, an Article 9 condition may include:

• explicit consent;

• processing necessary to protect vital interests where the applicable requirements are satisfied;

• information manifestly made public by the individual, where the strict requirements of that condition are satisfied;

• processing necessary for the establishment, exercise or defence of legal claims; or

• another Article 9 condition which genuinely applies under UK law.

Where a condition under the Data Protection Act 2018 or an Appropriate Policy Document is additionally required, we will comply with those requirements.

We do not assume that Special Category Data disclosed during coaching can automatically be processed for every other business purpose.

Criminal Offence Data

If we ever need to process personal data relating to criminal convictions or offences, we will only do so where an appropriate Article 6 lawful basis and the additional legal authority required under UK data-protection law apply.

We do not routinely request criminal-offence data as part of our coaching services.

Marketing & PECR

Direct electronic marketing and the use of cookies or similar technologies may also be governed by the Privacy and Electronic Communications Regulations (“PECR”) in addition to UK GDPR.

Accordingly, the existence of an Article 6 lawful basis does not automatically mean that we may send a particular marketing communication or place a particular non-essential cookie.

Where PECR requires consent, we will obtain the required consent.

Further information is provided in Marketing Communications and Cookies & Similar Technologies.

If Our Purpose Changes

If we wish to use personal data for a new purpose which is materially different from the purpose for which it was originally collected, we will consider whether the new processing is compatible with the original purpose.

Where required, we will:

• identify a new lawful basis;

• provide additional privacy information;

• obtain consent; or

• otherwise satisfy the applicable legal requirements

before beginning the new processing.

Nothing in this section permits Rhianna Jones Co to rely upon a lawful basis which does not genuinely apply to the particular processing activity.

7. Payments, Billing & Financial Information

Where you purchase a Programme, membership, digital product or other service from Rhianna Jones Co, we process personal data reasonably necessary to administer the transaction, maintain financial records and manage our contractual relationship with you.

Payment Information We Process

Depending on the transaction and payment method used, we may process information including:

• your name and contact details;

• billing address;

• Programme, product or service purchased;

• amount charged or payable;

• currency;

• VAT and other applicable charges or fees;

• payment date and billing schedule;

• payment-plan or instalment information;

• transaction and payment identifiers;

• payment status;

• limited information identifying the payment method used;

• invoices and receipts;

• failed, declined or overdue payment information;

• refunds and credits;

• payment reversals;

• chargebacks and disputes; and

• other information reasonably necessary to administer the transaction.

Card & Payment Details

Payments may be processed through third-party payment providers such as Stripe or another payment provider made available at checkout.

When you enter card, bank or other payment credentials through a payment provider, your full payment details may be collected and processed directly by that provider rather than by Rhianna Jones Co.

Rhianna Jones Co does not ordinarily need to receive or store complete card details such as your full card number or card security code.

Instead, the payment provider may provide us with more limited information relating to the transaction, such as:

• payment status;

• transaction identifier;

• payment method type;

• card brand;

• limited or masked card information, such as the final digits;

• expiry information where made available;

• billing information;

• fraud or risk indicators; and

• information concerning refunds, failed payments, disputes or chargebacks.

The precise information available to us depends upon the payment provider and payment method used.

Payment Providers

Payment providers may process personal data both to provide payment-processing services to us and for their own independent purposes, including:

• authenticating transactions;

• processing payments;

• fraud detection and prevention;

• security;

• regulatory compliance;

• anti-money-laundering requirements where applicable;

• handling disputes and chargebacks; and

• maintaining their own legally required records.

Depending upon the processing involved, a payment provider may act as our Data Processor, an independent Data Controller, or in another legally recognised capacity.

Where a provider acts as an independent Data Controller, its own privacy policy and data-protection practices will apply to its processing.

Recurring Payments & Payment Plans

Where you purchase a recurring membership, subscription or payment plan, the applicable payment provider may securely retain or tokenise payment credentials to enable future payments authorised under your Agreement.

Rhianna Jones Co may receive information confirming:

• scheduled payment dates;

• amounts due;

• successful payments;

• failed or declined payments;

• payment-method updates;

• cancellations;

• subscription or payment-plan status; and

• other information necessary to administer the agreed billing arrangement.

We do not use an existing payment mandate to collect unrelated amounts which you have not authorised or which are not otherwise properly due under your Agreement.

Failed & Overdue Payments

Where a payment fails, is declined or becomes overdue, we may process relevant personal data to:

• identify the affected account;

• notify you of the failed payment;

• enable you to update payment information;

• administer any permitted payment retry;

• determine the outstanding balance;

• communicate with you regarding payment;

• reconcile financial records; and

• recover amounts properly due under an Agreement.

Where reasonably necessary and legally permitted, information may also be shared with appropriate payment providers, professional advisers, debt-recovery providers or legal representatives for payment recovery.

Refunds

Where a refund, credit or payment adjustment is due, we may process transaction and payment information necessary to:

• verify the original transaction;

• determine the amount due;

• process or instruct the refund;

• maintain accurate financial records; and

• comply with accounting, tax and legal requirements.

Refunds will ordinarily be returned through the original payment method where appropriate and practicable.

Chargebacks & Payment Disputes

Where a chargeback, payment dispute or similar claim is raised, we may process and disclose information reasonably necessary to investigate, respond to or defend the claim.

This may include:

• transaction information;

• invoices and receipts;

• the Programme or service purchased;

• checkout records;

• applicable Terms & Conditions;

• electronic acceptance and consent records;

• Programme or Membership Site access records;

• session booking or attendance information;

• relevant communications;

• refund or cancellation records; and

• other evidence reasonably relevant to the disputed transaction.

This information may be provided to the relevant payment processor, bank, card issuer, dispute-resolution provider, professional adviser or other party reasonably involved in determining the dispute.

We will not disclose unrelated Client information merely because a payment dispute has been raised.

Fraud Prevention & Financial Security

We and our payment providers may process transaction, account, device, technical and behavioural information where reasonably necessary to detect, investigate or prevent:

• fraudulent transactions;

• stolen payment credentials;

• account takeover;

• unauthorised purchases;

• payment abuse;

• fraudulent chargebacks; or

• other financial or security misuse.

Further information is provided in Failed Payments, Fraud Prevention, Chargebacks & Debt Recovery.

Accounting, Tax & Financial Records

We are required to maintain certain financial and transaction records for accounting, taxation, VAT and other legal or regulatory purposes.

Accordingly, deletion of your Programme account or withdrawal of consent for another processing activity does not necessarily mean that we can immediately delete transaction or financial information which we are legally required to retain.

Financial records may include invoices, payment records, refunds, transaction details and other information necessary to demonstrate our business transactions and comply with applicable obligations.

Lawful Bases

Depending upon the particular processing activity, payment and financial information may be processed because it is necessary:

• to perform our contract with you;

• to comply with a legal obligation;

• for our legitimate interests, including administering payments, preventing fraud, recovering properly due amounts and maintaining appropriate financial records; or

• for the establishment, exercise or defence of legal claims where applicable.

Where financial records contain Special Category Data, an appropriate Article 9 condition will also be identified where required.

Security

We use established third-party payment providers so that sensitive payment credentials can be processed through systems designed for payment security rather than requiring Rhianna Jones Co to directly hold complete card information.

Access to payment and transaction information available to Rhianna Jones Co is limited where reasonably appropriate to those who require it for legitimate business purposes.

However, no payment or electronic system can be guaranteed to be completely secure.

Retention

Payment and financial information may be retained after your Programme, membership or service ends where reasonably necessary for:

• accounting and tax requirements;

• transaction reconciliation;

• payment administration;

• fraud prevention;

• chargebacks and payment disputes;

• complaints;

• debt recovery;

• legal claims; and

• other applicable legal or regulatory obligations.

We will not retain payment-related personal data indefinitely merely because it was once relevant to a transaction.

The applicable retention principles and periods are explained further in Data Retention.

Your Rights

Your data-protection rights apply to payment and financial information, subject to applicable legal limitations.

For example, a request for deletion does not require us to erase financial information which we are legally required to retain or which remains reasonably necessary for the establishment, exercise or defence of legal claims.

Further information is provided in Individual Rights and How to Exercise Your Rights.

8. Failed Payments, Fraud Prevention, Chargebacks & Debt Recovery

Rhianna Jones Co may process personal data where reasonably necessary to administer failed or overdue payments, prevent or investigate fraud, respond to payment disputes and recover amounts properly due under an Agreement.

We will only process and disclose information which is reasonably necessary and proportionate for the relevant purpose.

Failed & Overdue Payments

Where a payment fails, is declined, reversed or becomes overdue, we may process information including:

• your identity and contact details;

• Programme, membership or service purchased;

• amount paid and outstanding;

• payment-plan or subscription information;

• transaction identifiers;

• payment dates and status;

• limited payment-method information;

• failed-payment records;

• payment-provider responses;

• relevant communications; and

• contractual and checkout records.

We may use this information to identify the payment issue, contact you, administer payment retries permitted under your Agreement, update our records and recover amounts properly due.

Where our payment provider operates an authorised automatic retry process, relevant transaction information may be processed to attempt collection using the payment method associated with the applicable billing arrangement.

Payment Recovery

Where an amount remains properly due, we may use relevant personal data to:

• communicate with you regarding the balance;

• provide payment or account information;

• attempt authorised payment collection;

• reconcile the account;

• consider reasonable payment arrangements where offered;

• maintain records of payment-recovery activity; and

• take proportionate steps to recover the outstanding amount.

We will not use debt-recovery processes to pursue amounts which we know are not properly due.

Fraud Prevention & Detection

We may process personal data where reasonably necessary to detect, prevent or investigate suspected:

• payment fraud;

• identity or account misuse;

• stolen payment credentials;

• unauthorised transactions;

• fraudulent refund requests;

• fraudulent chargebacks;

• account sharing or takeover;

• misuse of Programme access; or

• other fraudulent or unlawful activity connected with our services.

Relevant information may include transaction, account, device, technical, access and communication data.

Payment processors and other financial providers may also independently conduct fraud, identity, security and risk checks in accordance with their own legal obligations and privacy practices.

Chargebacks & Payment Disputes

Where a Client raises a chargeback, card dispute, Stripe Dispute or other payment claim, we may process and provide information reasonably necessary to investigate and respond to that claim.

This may include:

• identity and transaction information;

• invoices and receipts;

• checkout records;

• the price and payment terms accepted;

• applicable Terms & Conditions;

• records of electronic acceptance;

• records of any cooling-off or immediate-access consent;

• Programme or Membership Site access records;

• downloads or usage records where available;

• session booking and attendance information;

• cancellation or refund requests;

• relevant Client communications;

• records of services provided; and

• other evidence directly relevant to the disputed transaction.

Relevant information may be shared with the payment processor, acquiring bank, card network, card issuer, Stripe or another provider involved in resolving the dispute.

We will not intentionally provide unrelated coaching information merely because a chargeback has been raised.

Coaching & Sensitive Information in Disputes

Where a dispute involves coaching or Programme participation, some relevant records may contain personal or sensitive information.

We will aim to use the minimum information reasonably necessary to establish the relevant facts.

Where possible, irrelevant coaching information will not be disclosed and information may be redacted or limited where appropriate.

Where Special Category Data genuinely needs to be processed for a legal claim or dispute, we will identify both an appropriate Article 6 lawful basis and an applicable Article 9 condition, such as processing necessary for the establishment, exercise or defence of legal claims, where the legal requirements are satisfied.

Debt Recovery & Collections

Where an undisputed or otherwise properly enforceable amount remains outstanding after reasonable payment-recovery attempts, we may refer the matter to an appropriate third party where reasonably necessary and legally permitted.

This may include:

• debt-recovery providers;

• solicitors or other legal representatives;

• professional advisers;

• payment providers; or

• courts or dispute-resolution bodies where proceedings become necessary.

Information disclosed will be limited, where reasonably practicable, to what is necessary for the relevant recovery or legal purpose.

This may include identity and contact information, the amount outstanding, payment history, contractual records, invoices, relevant communications and evidence demonstrating the basis of the debt.

A debt-recovery or legal provider may act as our Data Processor or as an independent Data Controller depending upon the nature of its role.

Legal Claims

We may retain and process relevant information where reasonably necessary to:

• establish our contractual position;

• respond to complaints or disputes;

• obtain legal advice;

• establish, exercise or defend legal claims;

• comply with court procedures or orders; or

• enforce a lawful judgment or settlement.

The fact that a Programme or coaching relationship has ended does not necessarily require us to delete information which remains reasonably necessary for an existing or reasonably anticipated legal claim.

Lawful Bases

Depending upon the circumstances, processing under this section may rely upon:

• Contract – where processing is necessary to administer payments properly due under an Agreement;

• Legitimate Interests – including protecting our business against fraud, administering outstanding accounts, recovering properly due amounts and defending our financial interests;

• Legal Obligation – where processing or disclosure is required by applicable law; and/or

• processing connected with the establishment, exercise or defence of legal claims.

Where Special Category Data is involved, an additional Article 9 condition will be identified where required.

Automated Fraud & Risk Tools

Payment providers may use automated systems to assess transactions for fraud, security or financial risk.

Such systems may consider information including transaction patterns, payment information, device information, location indicators or other risk signals.

Where Rhianna Jones Co itself uses automated decision-making which produces legal or similarly significant effects for an individual, we will comply with the additional transparency and safeguard requirements applicable under data-protection law.

We do not treat an automated fraud flag alone as evidence that a Client has acted fraudulently.

Accuracy & Disputed Amounts

We will take reasonable steps to ensure that information used for payment recovery or dispute purposes is accurate.

If you believe:

• a payment has already been made;

• an amount is incorrect;

• a payment was unauthorised;

• a debt does not exist;

• your account has been confused with another person’s; or

• information being used in connection with recovery is inaccurate,

you should contact us athello@rhiannajones.co so that the matter can be investigated.

Raising a genuine payment dispute or exercising a statutory right will not, by itself, be treated as fraudulent conduct.

Security & Access

Access to information relating to payment disputes, fraud investigations and debt recovery will be restricted where reasonably appropriate to personnel, providers and professional advisers who require the information for a legitimate purpose.

We will take reasonable steps to protect such information against unauthorised access, disclosure, alteration or loss.

Retention

Information connected with failed payments, fraud, chargebacks, disputes and debt recovery may be retained for longer than ordinary Programme administration records where reasonably necessary for:

• resolving an active matter;

• preventing repeated fraud or misuse;

• accounting and tax requirements;

• demonstrating transactions and contractual acceptance;

• responding to payment-provider requirements;

• recovering properly due amounts; or

• establishing, exercising or defending legal claims.

Information will not be retained indefinitely merely because a payment once failed or a dispute once occurred.

Further information is provided in Data Retention.

Your Rights

The data-protection rights described later in this Privacy Policy continue to apply to information processed under this section.

However, those rights may be subject to lawful limitations. For example, we may be entitled or required to retain information despite an erasure request where it remains necessary for legal obligations or the establishment, exercise or defence of legal claims.

Nothing in this section restricts your right to raise a genuine payment dispute, exercise applicable consumer rights, make a complaint or challenge information you believe to be inaccurate.

9. Coaching Notes, Session Records & Communications

Because Rhianna Jones Co provides coaching, mentoring, programmes and personalised support, we may create, receive and retain records relating to our work with Clients.

These records help us provide continuity of service, administer the Client relationship, maintain appropriate business records and protect the legitimate interests and legal rights of both Rhianna Jones Co and the Client.

Coaching & Session Notes

We may make reasonable notes during or following coaching sessions, Strategy Sessions, workshops, reviews or other Client interactions.

These may include:

• topics discussed;

• goals, challenges and priorities;

• actions or commitments discussed;

• progress and outcomes;

• relevant Client circumstances;

• coaching observations;

• follow-up points;

• resources or recommendations provided;

• matters to revisit in future sessions; and

• administrative information relevant to the Client relationship.

The extent of notes may vary depending on the Programme, service and nature of the interaction.

Coaching notes are maintained for coaching and business purposes and are not intended to constitute medical, psychological, therapeutic or clinical records.

Messages & Private Communications

Where a Programme or service includes or permits communication through WhatsApp, email, social media, Membership Sites or another messaging platform, we may retain relevant communications.

This may include:

• written messages;

• voice notes;

• questions and support requests;

• responses from Rhianna Jones Co or its team;

• images, screenshots, documents or links;

• feedback;

• relevant dates and times; and

• other information voluntarily provided through the communication.

We may refer to previous communications where reasonably necessary to understand the Client's circumstances, provide consistent support or respond to a later question, complaint or dispute.

Forms, Questionnaires & Client Submissions

We may retain information submitted through:

• onboarding forms;

• coaching questionnaires;

• applications;

• strategy forms;

• feedback forms;

• surveys;

• progress updates;

• business questionnaires;

• content submissions; and

• other Programme-related forms.

Information may be used to prepare for sessions, understand the Client's goals or circumstances, personalise support, provide requested feedback and administer the relevant Programme or service.

Business Audits, Content Reviews & Feedback

Where a Client submits materials for a business audit, social media review, content review or another personalised feedback service, we may process and retain:

• the materials submitted;

• screenshots, documents and links;

• relevant publicly available business content;

• our review notes;

• analysis;

• recommendations;

• feedback provided to the Client; and

• related communications.

These records may be retained where reasonably necessary to provide the service, maintain continuity, demonstrate what was provided or deal with subsequent questions or disputes.

Session Preparation & Follow-Up

We may review relevant Client records before a session or interaction in order to provide informed and consistent support.

We may also create follow-up records after a session concerning matters such as agreed actions, recommendations, resources, next steps or issues requiring further attention.

We aim to use only information reasonably relevant to the purpose of the interaction.

Internal Client-Management Records

We may maintain internal administrative records relating to the Client relationship, including:

• Programme and access information;

• session history;

• attendance;

• support provided;

• important administrative communications;

• contractual information;

• payment or account status;

• accommodations or arrangements agreed with the Client;

• complaints or concerns;

• relevant conduct or security matters; and

• other information reasonably necessary to administer the relationship.

Access to internal Client records will be limited where reasonably appropriate to Rhianna Jones Co personnel and authorised providers who require access for a legitimate purpose.

Sensitive Information Within Client Records

Coaching notes and communications may sometimes contain Special Category Data or other particularly sensitive information because of information voluntarily disclosed by a Client.

We do not treat the existence of a coaching relationship as blanket permission to record every sensitive detail disclosed.

We aim to apply data minimisation, including avoiding unnecessary recording of Special Category Data where detailed information is not required for the relevant purpose.

Where Special Category Data is processed, the requirements explained in Coaching Information & Special Category Data apply, including the requirement for an appropriate Article 6 lawful basis and Article 9 condition where required.

Confidentiality

Private coaching communications and records will not ordinarily be disclosed outside Rhianna Jones Co and authorised providers except where:

• necessary to provide or administer the service;

• the Client has authorised the disclosure;

• an appropriate professional adviser or provider requires access for a legitimate purpose;

• necessary for the establishment, exercise or defence of legal claims;

• required or permitted by law; or

• an exceptional safety or safeguarding situation provides a lawful basis for disclosure.

Where disclosure is necessary, we will aim to disclose only information reasonably relevant to the purpose.

Information deliberately shared by the Client in a group or community environment is addressed separately in Group Coaching, WhatsApp, Facebook Groups & Communities.

Recordings Are Different From Notes

The fact that we may make written coaching or administrative notes does not mean that a coaching session is being audio or video recorded.

Where a session is recorded, transcribed or processed through an AI meeting or transcription tool, the separate provisions in Calls, Recordings, Transcripts & AI Notetakers apply.

Reasons We May Retain Client Records

Coaching notes, communications and Programme records may be retained where reasonably necessary for:

• delivering and maintaining continuity of coaching or support;

• preparing for future sessions;

• administering the Programme or Client relationship;

• maintaining appropriate contractual and business records;

• responding to Client questions or complaints;

• demonstrating services provided;

• complying with legal, tax, accounting or regulatory obligations;

• addressing legitimate safeguarding or serious safety concerns where applicable;

• preventing or investigating fraud or misuse;

• administering or recovering properly due payments;

• responding to chargebacks or payment disputes;

• protecting Intellectual Property or account security; and

• establishing, exercising or defending legal claims.

Different records may therefore have different retention periods.

We will not retain detailed coaching information indefinitely merely because it may potentially be useful in the future.

Lawful Bases

Depending on the purpose, we may process coaching notes, session records and communications on the basis of:

• Contract – where reasonably necessary to provide or administer the service agreed with the Client;

• Legitimate Interests – including maintaining appropriate Client records, continuity of service, handling complaints and protecting our business and legal rights;

• Legal Obligation – where particular records must be processed or retained by law;

• Consent – where consent is appropriate or legally required; and/or

• another lawful basis applicable to the particular circumstances.

Where the records contain Special Category Data, a separate Article 9 condition must also apply.

Client Access & Data-Protection Rights

Coaching notes, internal records and communications which constitute personal data may fall within the scope of an individual's data-protection rights.

However, those rights are subject to applicable legal exemptions and the rights of other people. For example, responding to an access request may require us to consider information concerning third parties, legally privileged information or other applicable exemptions.

Further information is provided in Individual Rights and How to Exercise Your Rights.

Retention & Secure Disposal

Records will be retained only for as long as reasonably necessary for the purposes for which they are processed, taking account of contractual, operational, legal, accounting, dispute and claims-related requirements.

When records are no longer reasonably required, we will take appropriate steps to delete, anonymise or securely dispose of them in accordance with the Data Retention section of this Privacy Policy.

10. Group Coaching, WhatsApp, Facebook Groups & Communities

Rhianna Jones Co may operate or participate in group environments as part of certain Programmes, memberships, events or wider business activities.

These may include:

• group coaching calls;

• masterminds;

• workshops;

• WhatsApp groups;

• Facebook Groups;

• membership communities;

• social media groups;

• live online events; and

• other shared digital or in-person spaces.

Participation in a group environment is different from private 1:1 communication because information shared within the group may be visible, audible or otherwise accessible to other participants.

Information You Share in Groups

Where you voluntarily post, speak, upload or otherwise disclose information within a shared environment, that information is inherently being disclosed to the other people who have access to that environment.

Depending on the space, this may include:

• your name and profile information;

• messages, posts and comments;

• questions;

• coaching discussions;

• business information;

• personal experiences;

• images, videos or files;

• voice notes;

• reactions and engagement;

• information discussed verbally during group calls; and

• other information you choose to share.

You should therefore consider the nature and sensitivity of information before sharing it within a group environment.

WhatsApp Groups

Where you participate in a WhatsApp group operated in connection with Rhianna Jones Co, other group participants may, depending upon WhatsApp's functionality and your own privacy settings, be able to see information including:

• your telephone number;

• WhatsApp display name;

• profile photograph;

• profile information;

• messages and voice notes you send;

• images, documents, links or other content you share; and

• information relating to your participation in the group.

By choosing to participate and communicate within a WhatsApp group, you acknowledge that information made visible through the group may be accessible to other participants.

Rhianna Jones Co does not control the privacy settings of individual participants or all functionality provided by WhatsApp.

Where participation in a WhatsApp group is optional, you may choose not to participate. Where it forms part of a Programme, you may contact us if you have privacy concerns about participation so that we can consider whether a reasonable alternative is available.

Facebook Groups & Other Community Platforms

Where a community is hosted through Facebook or another third-party platform, information visible to other participants will depend upon:

• the platform's functionality;

• the type and privacy settings of the group;

• your own account and privacy settings; and

• the information you choose to share.

The relevant platform provider may independently collect and process information about your account, device, activity and use of its services under its own privacy terms.

Rhianna Jones Co does not control all processing carried out independently by those platforms.

Group Coaching Calls

During group coaching, masterminds, workshops or similar sessions, information you share verbally, through video or through chat may be heard or seen by other participants.

This may include personal information, business information and, where you choose to disclose it, sensitive or Special Category Data.

We may establish confidentiality expectations for group participants. However, Rhianna Jones Co cannot guarantee that another participant will keep information confidential or control how another participant independently records, remembers, uses or discloses information they have legitimately seen or heard.

Clients should therefore avoid disclosing information in a group environment which they would not reasonably wish other participants to know.

Special Category & Highly Sensitive Information

Particular care should be taken before voluntarily disclosing information concerning matters such as:

• physical or mental health;

• racial or ethnic origin;

• religious or philosophical beliefs;

• political opinions;

• trade union membership;

• sexual orientation or sex life; or

• other highly sensitive personal circumstances.

Where you voluntarily disclose Special Category Data within a group, that information will necessarily be communicated to the participants present or able to access the relevant content.

Our own processing of that information remains subject to the requirements explained in Coaching Information & Special Category Data.

Information About Other People

Participants must not share personal or confidential information about another identifiable person unless they have an appropriate right or lawful basis to do so.

For example, when discussing a Client, partner, family member, employee or another person during coaching, you should avoid unnecessary identifying information where the coaching objective can reasonably be achieved without it.

Rhianna Jones Co is not responsible for determining whether a participant has authority to disclose third-party information which that participant independently chooses to share.

Where we become aware of inappropriate disclosure, we may take reasonable steps to remove or restrict the information where practicable.

Screenshots, Recording & Redistribution

Participants must not, without appropriate permission:

• record private group coaching sessions;

• screenshot confidential discussions;

• download or reproduce another participant's personal information;

• redistribute messages, voice notes, images or videos from a private group;

• publish another participant's coaching disclosures; or

• otherwise use information obtained through a private Rhianna Jones Co community in a manner which breaches applicable law or community rules.

Rhianna Jones Co may take reasonable moderation or contractual action where it becomes aware of misuse.

However, technical prevention of every screenshot, recording, copy or disclosure by another participant cannot be guaranteed.

Rhianna Jones Co's Use of Community Information

We may process community information where reasonably necessary to:

• operate and administer the community;

• provide coaching or support;

• respond to questions;

• moderate discussions;

• enforce applicable community rules;

• investigate complaints or misconduct;

• protect participants;

• maintain security;

• administer Programme access; and

• establish, exercise or defend legal claims where necessary.

Participation in a community does not automatically give Rhianna Jones Co permission to take a Client's private or identifiable community post and use it as a testimonial, case study or marketing material.

Any identifiable promotional use will be handled in accordance with the Testimonials, Reviews, Case Studies, Images & Marketing section.

Community Moderation & Removal

We may process posts, messages, reports and other relevant information where reasonably necessary to investigate potential breaches of community rules or serious misconduct.

Where appropriate, we may:

• remove content;

• issue a warning;

• restrict participation;

• remove a participant from a community; or

• take other proportionate action permitted under the applicable Agreement.

Relevant moderation records may be retained where reasonably necessary to document the matter, manage repeated conduct, respond to complaints or protect legal rights.

Leaving a Community

Leaving or being removed from a group does not necessarily remove information previously shared within that group.

For example:

• previous WhatsApp messages may remain visible in other participants' chat histories;

• previous Facebook posts or comments may remain until deleted where deletion is available;

• information may remain within platform backups or records; and

• another participant may already have seen or retained information independently.

Where Rhianna Jones Co controls the relevant information and receives a valid data-protection request, we will consider that request in accordance with applicable law.

However, we may not have the technical ability or legal authority to delete information from another participant's device or from systems controlled independently by a third-party platform.

Third-Party Platform Responsibility

WhatsApp, Facebook and other community providers operate independently from Rhianna Jones Co.

Depending upon the processing involved, they may act as independent Data Controllers for information processed through their platforms.

Their own:

• privacy policies;

• terms;

• cookies;

• security measures;

• retention practices;

• international transfers; and

• data-protection arrangements

may therefore apply in addition to this Privacy Policy.

Recordings of Group Sessions

Group participation does not constitute blanket consent to audio or video recording.

Where Rhianna Jones Co records a group session, uses transcription or uses an AI meeting-assistance tool, appropriate information will be provided and any consent or other lawful basis required for that processing will be addressed.

Further information is provided in Calls, Recordings, Transcripts & AI Notetakers.

Confidentiality Cannot Be Guaranteed Between Participants

Rhianna Jones Co will take reasonable steps to establish appropriate confidentiality and conduct expectations in private communities.

However, because other participants are independent individuals, we cannot guarantee the actions of another participant once information has been voluntarily disclosed to them.

This does not remove Rhianna Jones Co's own obligations under data-protection law in relation to personal data for which we are responsible.

Lawful Bases

Depending upon the particular community and purpose, our processing may rely upon:

• Contract – where the community or group participation forms part of a Programme or service;

• Legitimate Interests – including operating, moderating, securing and protecting our communities and participants;

• Legal Obligation – where processing or disclosure is legally required;

• Consent – where consent is appropriate or required; and/or

• another lawful basis applicable to the particular circumstances.

Where our processing involves Special Category Data, an appropriate Article 9 condition will also be identified where required.

Data Minimisation

Although coaching communities are intended to create spaces in which Clients can participate openly, you remain in control of how much personal information you voluntarily disclose to other participants.

We encourage participants to share only the level of personal information reasonably necessary for the support, coaching or discussion they are seeking.

11. Zoom, Calls, Recordings, Transcripts & AI Notetakers

Rhianna Jones Co may use Zoom or other video-conferencing, calling, recording, transcription or meeting-assistance technologies in connection with coaching, Programmes, workshops, masterminds, sales calls, Strategy Sessions, team interactions and other business activities.

The personal data processed will depend upon the particular call, the technology being used and whether recording or transcription features are enabled.

Video & Audio Calls

When you participate in a Zoom or other online call, we may process information including:

• your name or display name;

• email address or account information;

• profile photograph;

• audio and video;

• information you voluntarily discuss;

• chat messages;

• files or links shared;

• attendance and participation information;

• date, time and duration of the call; and

• other information generated through your participation.

The relevant video-conferencing provider may also independently process technical, account and device information in accordance with its own privacy practices.

When Calls May Be Recorded

Some calls, workshops, trainings or sessions may be recorded where there is a legitimate reason to do so.

This may include recording for purposes such as:

• providing an agreed replay;

• delivering Programme Content;

• creating internal training or business records;

• quality assurance;

• accessibility;

• documenting a particular session where appropriate; or

• another purpose clearly communicated to participants.

Participation in a Rhianna Jones Co Programme, acceptance of Programme Terms or acceptance of this Privacy Policy does not constitute blanket consent to the recording of every call or session.

Where an identifiable individual will be recorded, we will provide appropriate notice and identify an appropriate lawful basis for that processing. Where consent is legally required or is the basis we choose to rely upon, appropriate consent will be obtained.

Notice of Recording

Where reasonably practicable and appropriate to the circumstances, participants will be informed that recording is taking place before or at the beginning of the relevant session.

Notice may be provided through:

• the Programme or event information;

• booking or registration information;

• email;

• an on-screen platform notification;

• a verbal announcement;

• a written notice within the meeting; or

• another appropriate method.

Where the nature or intended use of a recording changes materially from what participants were originally told, we will consider whether further notice, a different lawful basis or additional consent is required.

Group Calls & Privacy

Particular care is required when recording group coaching, workshops, masterminds or other multi-participant sessions.

A recording may capture:

• participants' names;

• faces;

• voices;

• chat messages;

• questions;

• business information;

• personal experiences;

• coaching disclosures; and

• potentially Special Category Data voluntarily disclosed during the session.

Participants should therefore be mindful of the information they choose to disclose during a recorded group session.

Where appropriate, we may provide options such as participating without video, changing a display name, avoiding unnecessary identifying information or submitting a question through another available method.

The availability of those options will depend upon the nature of the particular session and service.

Replays & Sharing Recordings

Where a recording is intended to be made available as a replay, participants will be informed where appropriate.

Access may be limited to:

• participants in the relevant Programme;

• members of a particular membership or community;

• Rhianna Jones Co personnel;

• authorised contractors or service providers; or

• another clearly identified audience.

A recording created for a private Programme or limited audience will not automatically be treated as permission to publish identifiable Client contributions publicly or use them for advertising.

Where we wish to use identifiable Client footage, audio or disclosures for a materially different promotional purpose, the provisions in Testimonials, Reviews, Case Studies, Images & Marketing will apply.

Transcripts & Automated Transcription

We may use transcription, captioning or note-generation functionality in connection with certain calls.

This may produce information including:

• written transcripts;

• captions;

• speaker identification;

• meeting summaries;

• action points;

• questions;

• notes; and

• other text generated from the conversation.

Transcription may be performed automatically by the meeting platform or by another third-party service.

Automated transcripts may contain errors and should not automatically be treated as an exact or authoritative record of what was said.

AI Notetakers & Meeting Assistants

We may use AI-assisted meeting tools for appropriate purposes such as:

• transcription;

• summarising meetings;

• generating notes;

• identifying action points;

• supporting session administration;

• improving accessibility; or

• reducing manual administrative work.

Where an AI notetaker or meeting assistant processes personal data, we will consider matters including:

• the purpose for using the tool;

• what information it receives;

• whether the processing is reasonably necessary;

• the applicable lawful basis;

• the provider's role as a Data Processor or independent Data Controller;

• confidentiality and security;

• international data transfers;

• retention;

• whether Special Category Data may be captured; and

• whether additional notice or consent is required.

The fact that an AI tool is available within a meeting platform does not mean that it will automatically be enabled for every call.

Special Category Data

Recordings and transcripts can become particularly sensitive because they may capture Special Category Data which a Client voluntarily discusses during coaching.

Where a recording, transcript or AI meeting tool processes Special Category Data, we will identify both:

• an appropriate Article 6 lawful basis; and

• an appropriate Article 9 condition

where required by UK data-protection law.

We will not treat general participation in coaching or acceptance of this Privacy Policy as blanket explicit consent to record and process Special Category Data.

Access to Recordings & Transcripts

Access will be limited where reasonably appropriate according to the purpose for which the recording or transcript was created.

Access may be provided to:

• Rhianna Jones Co;

• authorised team members;

• relevant Programme participants where a replay forms part of the service;

• technology providers processing the information on our behalf;

• professional advisers where legitimately necessary; or

• other recipients where legally required or appropriately authorised.

Access to a replay does not grant participants permission to download, reproduce, redistribute or publicly share another participant's personal information contrary to applicable Programme Terms, confidentiality requirements or law.

Third-Party Providers

Zoom and other recording, transcription or AI meeting providers may process information through their own infrastructure.

Depending upon the service, personal data may therefore be processed or stored outside the United Kingdom.

Where Rhianna Jones Co appoints a provider to process personal data on its behalf, we will take appropriate steps concerning processor arrangements, security and international-transfer safeguards where required.

Where a provider independently determines how and why it processes information, it may act as an independent Data Controller and its own privacy policy will also apply.

Further information is provided in Third-Party Processors & Other Recipients and International Data Transfers.

Retention

Recordings, transcripts and AI-generated meeting notes will be retained only for as long as reasonably necessary for their intended purpose.

The appropriate period may depend upon:

• whether the recording forms part of Programme Content;

• how long a replay has been promised;

• whether it is needed for ongoing service delivery;

• whether a transcript or note is required for legitimate Client administration;

• the sensitivity of the information;

• whether a complaint or dispute exists;

• legal or regulatory requirements; and

• whether the information remains necessary for the establishment, exercise or defence of legal claims.

Where a full recording is no longer required but limited information remains legitimately necessary, we may retain the necessary record while deleting the underlying recording where appropriate.

Further information is provided in Data Retention.

Recordings for Marketing

A Client appearing on a Programme call or recording does not automatically give Rhianna Jones Co permission to use that person's identity, image, voice, private coaching disclosure or contribution in advertising or promotional material.

Where identifiable material is to be used for testimonials, case studies, advertising or other promotional purposes, we will obtain the appropriate permission or establish another lawful basis where legally appropriate.

Participant Recording

Participants must not independently record, transcribe, screenshot or use AI notetakers on private coaching calls, group sessions or other confidential Programme interactions unless they have appropriate permission and doing so complies with applicable Terms and law.

This is particularly important where other Clients or third parties may be captured.

Lawful Bases

Depending upon the circumstances and purpose, our processing of call, recording and transcript data may rely upon:

• Contract – where reasonably necessary to deliver an agreed service;

• Legitimate Interests – where recording, transcription or note-taking is reasonably necessary for a legitimate operational purpose and individuals' rights do not override that interest;

• Consent – where consent is appropriate or required;

• Legal Obligation – where processing is required by law; and/or

• another applicable lawful basis.

Where Special Category Data is processed, a separate Article 9 condition will also be required.

Your Rights

Recordings, transcripts and meeting notes which contain your personal data may be subject to your data-protection rights.

Those rights are not absolute and may be affected by matters including:

• information relating to other participants;

• legal obligations;

• legal claims;

• applicable exemptions; and

• whether the information has been genuinely anonymised.

Further information is provided in Individual Rights and How to Exercise Your Rights.

12. AI-Assisted Processing

Rhianna Jones Co may use artificial intelligence (“AI”), machine-learning and AI-assisted software as part of its business operations and the delivery and administration of its services.

AI may be incorporated into standalone tools or into third-party platforms we already use, including communication, meeting, productivity, content, customer-support and administrative software.

The use of AI does not remove our responsibilities under applicable data-protection law.

How We May Use AI

We may use AI-assisted tools for purposes including:

• business administration;

• research and information organisation;

• drafting and editing;

• content creation and development;

• customer-support assistance;

• summarising information;

• analysing or organising business information;

• preparing for coaching or Client interactions;

• generating internal notes or action points;

• transcription and meeting assistance;

• processing forms or feedback;

• improving internal workflows;

• developing or improving our products and services;

• assisting with marketing and communications;

• technical or operational support; and

• other legitimate internal business purposes.

The particular tools and purposes used may change as technology and our business operations develop.

Personal Data & AI Tools

Some uses of AI may involve the processing of personal data.

For example, an AI-assisted tool may process:

• names or contact information;

• Client communications;

• questions or support requests;

• Programme information;

• business information;

• submitted forms;

• coaching or session information;

• meeting transcripts;

• feedback;

• administrative records; or

• other information relevant to the task being performed.

We will not treat the availability of AI technology as justification for providing an AI system with unrestricted access to Client information.

Personal data will only be processed through AI where we have an appropriate lawful basis and where the processing is reasonably necessary and proportionate for the relevant purpose.

Data Minimisation

We aim to minimise the amount of identifiable personal data provided to AI systems.

Where reasonably practicable, this may include:

• removing unnecessary names or identifying details;

• using anonymised or pseudonymised information;

• providing only the portion of a document or communication necessary for the task;

• restricting access to particular information;

• avoiding unnecessary inclusion of confidential information; and

• selecting appropriate privacy or data-control settings offered by the provider.

We will not input personal data into an AI system merely because doing so may be convenient.

Confidential Coaching Information

We recognise that information disclosed through coaching may be particularly private or confidential.

Where AI is used in connection with coaching information, we will consider:

• whether use of the information is genuinely necessary;

• whether identifiable information can reasonably be removed;

• the sensitivity of the information;

• the purpose of the processing;

• the provider's privacy and security arrangements;

• retention and use of submitted information;

• whether the provider may use information to develop or train its systems; and

• whether additional safeguards are appropriate.

The fact that information has been disclosed to Rhianna Jones Co during coaching does not constitute blanket permission for that information to be used through AI for unrelated purposes.

Special Category Data

AI tools may sometimes process Special Category Data where, for example, such information is contained within a Client communication, coaching record or meeting transcript.

Where we process Special Category Data using AI, we will identify:

• an appropriate Article 6 lawful basis; and

• an appropriate Article 9 condition

where required by applicable data-protection law.

We will take additional care when deciding whether AI processing is appropriate for particularly sensitive information.

Where the purpose can reasonably be achieved without providing Special Category Data to an AI system, we will aim to avoid doing so.

AI Training & Provider Use of Data

Different AI providers have different arrangements concerning whether information submitted to their services may be retained, reviewed or used to improve or train their models.

Where reasonably appropriate for business use involving personal or confidential data, we will consider available provider terms, business or enterprise privacy protections and data-control settings.

We do not intentionally provide identifiable private coaching information to public AI systems for the purpose of training publicly available AI models.

Where a provider processes information on our behalf, we will consider its role and the appropriate contractual and data-protection arrangements.

AI Notetakers, Transcription & Meeting Tools

AI may be used to assist with:

• meeting transcription;

• captions;

• summaries;

• action points;

• session notes; or

• meeting administration.

Where these tools process identifiable participants or information discussed during a call, the provisions in Zoom, Calls, Recordings, Transcripts & AI Notetakers also apply.

Participation in a Programme does not constitute blanket consent to AI transcription or recording of every Client interaction.

Human Oversight

AI-generated content can be inaccurate, incomplete, misleading or inappropriate.

Where appropriate to the nature and risk of the processing, Rhianna Jones Co will retain human involvement and oversight rather than treating AI-generated information as automatically accurate or determinative.

This may include reviewing AI-generated:

• summaries;

• notes;

• recommendations;

• classifications;

• drafts;

• analyses; or

• other outputs

before materially relying upon them.

The level of human review will depend upon the purpose and potential impact of the processing.

Automated Decision-Making

Rhianna Jones Co does not currently use solely automated decision-making which produces legal effects concerning an individual or similarly significantly affects them within the meaning of applicable UK data-protection law.

For example, we do not currently use an AI system to independently make final decisions about whether a person:

• may purchase or participate in a coaching Programme;

• should have their Programme access terminated;

• is entitled to a contractual refund;

• owes a disputed debt; or

• should be subject to significant contractual action,

without meaningful human involvement.

Third-party providers, particularly payment and fraud-prevention providers, may independently use automated systems as part of their services. Their own privacy information may apply to that processing.

If we introduce solely automated decision-making producing legal or similarly significant effects in the future, we will update our privacy information and provide the additional information, rights and safeguards required by applicable law.

Profiling

Some processing may involve automated analysis or categorisation which could constitute profiling under data-protection law.

For example, technology may help us understand:

• website or email engagement;

• customer or audience interests;

• marketing interactions;

• Programme usage; or

• fraud and security indicators.

Where profiling is used, we will ensure there is an appropriate lawful basis and comply with any additional requirements applicable to that processing.

We do not currently use profiling to make solely automated decisions producing legal or similarly significant effects concerning Clients.

Marketing & AI

AI may assist us with creating, editing, analysing or personalising marketing content.

Using AI to assist with marketing does not override the separate legal requirements governing direct marketing, cookies, profiling or use of personal data.

We will not treat private coaching disclosures as automatically available for AI-assisted marketing, testimonials or identifiable case studies.

The provisions in Marketing Communications and Testimonials, Reviews, Case Studies, Images & Marketing continue to apply.

Third-Party AI Providers

AI providers may process personal data on infrastructure operated outside Rhianna Jones Co.

Depending upon the particular service and processing activity, an AI provider may act as:

• our Data Processor;

• an independent Data Controller; or

• another legally recognised type of recipient.

Where a provider processes personal data on our behalf, we will take reasonable steps to use appropriate providers and contractual arrangements as required by applicable law.

Further information is provided in Third-Party Processors & Other Recipients.

International Transfers

Some AI providers may process or store information outside the United Kingdom.

Where this constitutes a restricted international transfer of personal data, we will use an appropriate lawful transfer mechanism or safeguard where required.

Further information is provided in International Data Transfers.

Security & Retention

Personal data processed through AI-assisted systems remains subject to our principles concerning security and retention.

Where reasonably within our control, we will consider matters including:

• provider security;

• access controls;

• retention settings;

• deletion options;

• confidentiality;

• data-use settings; and

• the sensitivity of information before using an AI service.

AI-generated summaries, transcripts, notes or other outputs containing identifiable information are themselves personal data and will be treated accordingly.

Your Rights

The use of AI does not remove your applicable data-protection rights.

Depending upon the processing, you may have rights concerning access, correction, erasure, restriction, objection and automated decision-making.

Further information is provided in Individual Rights and How to Exercise Your Rights.

Questions about our use of AI in relation to your personal data may be sent to:

hello@rhiannajones.co

13. Testimonials, Reviews, Case Studies, Images & Marketing

Rhianna Jones Co may receive testimonials, reviews, feedback, Client results, photographs, screenshots, audio, video or other material relating to experiences with our Programmes and services.

We recognise the difference between information which identifies a Client and information which has been genuinely anonymised so that the individual is no longer identifiable.

No Blanket Marketing Consent

Purchasing a Programme, participating in coaching, joining a community, attending a call or accepting our Terms & Conditions does not constitute blanket consent for Rhianna Jones Co to use your:

• name;

• photograph or image;

• voice or video;

• social media profile;

• private messages or communications;

• coaching disclosures;

• testimonial;

• identifiable results; or

• identifiable case study

for advertising or marketing purposes.

Where additional permission or consent is required for an identifiable promotional use, this will be obtained separately.

Testimonials & Client Feedback

You may voluntarily provide feedback, testimonials or reviews concerning your experience with Rhianna Jones Co.

Providing feedback for internal purposes does not automatically mean that we may publish it publicly.

Where we wish to use identifiable feedback as a testimonial, we will establish an appropriate lawful basis and obtain separate permission or consent where required.

Depending on what has been agreed, a published testimonial may include information such as:

• your name;

• business name or professional role;

• photograph;

• social media username or profile;

• written feedback;

• Client results;

• screenshots;

• audio; or

• video.

We will not intentionally expand an agreed testimonial use into materially different identifiable marketing use without considering whether additional permission is required.

Private Messages & Screenshots

Clients may send positive feedback or report results through:

• WhatsApp;

• email;

• social media direct messages;

• Programme communities;

• feedback forms; or

• other private communication channels.

The fact that a Client sends positive feedback privately does not automatically make that communication public marketing material.

Where we wish to publish an identifiable screenshot, message or extract, we will obtain appropriate permission where required.

Where a screenshot is used, we may remove or obscure unnecessary information such as telephone numbers, email addresses, profile information, unrelated messages or other identifying details.

Images, Audio & Video

Where we wish to use identifiable photographs, video clips, audio recordings or other media featuring a Client for marketing purposes, we will clearly distinguish that promotional use from ordinary Programme participation.

Appearing on a Zoom call, workshop, coaching session, event or Programme recording does not automatically give Rhianna Jones Co permission to extract that footage and use it in advertising.

Where appropriate, we will explain the intended use, such as use on:

• our websites;

• sales pages;

• social media;

• email marketing;

• advertising;

• presentations;

• promotional videos; or

• other marketing channels.

The provisions concerning the original recording of calls remain separately governed by Zoom, Calls, Recordings, Transcripts & AI Notetakers.

Case Studies

We may create case studies based on Client experiences, implementation, progress or results.

A case study may be either identifiable or genuinely anonymised.

Where a case study identifies you, or contains sufficient information for you reasonably to be identified, it remains personal data and we will establish an appropriate lawful basis for its use.

Where appropriate, separate permission or consent will be obtained before an identifiable case study is published for promotional purposes.

Genuinely Anonymised Case Studies

We may use genuinely anonymised information to describe:

• common Client experiences;

• coaching themes;

• implementation examples;

• Programme outcomes;

• business challenges;

• progress or results; or

• other insights arising from our services.

Information is not genuinely anonymised merely because we remove someone's name.

We will consider whether the individual could still reasonably be identified from other details, including their business, niche, location, circumstances, results, dates, images or combination of information.

Where information has been genuinely anonymised so that the individual is no longer identifiable, the resulting information is no longer personal data for UK GDPR purposes.

The processing undertaken before anonymisation must nevertheless have an appropriate lawful basis.

Further information is provided in Anonymised & Aggregated Information.

Special Category Data in Testimonials & Case Studies

Particular care will be taken where a testimonial, case study or other marketing material contains Special Category Data, such as information concerning health, racial or ethnic origin, religious beliefs or sexual orientation.

Permission to use someone's name or testimonial does not automatically provide the legal condition necessary to publish their Special Category Data.

Where identifiable Special Category Data is processed for marketing, we will identify both:

• an appropriate Article 6 lawful basis; and

• an appropriate Article 9 condition,

including explicit consent where that is the appropriate condition.

We will not treat information privately disclosed during coaching as permission to publish sensitive personal circumstances as part of a Client success story.

Results & Financial Information

Where a Client reports business, financial or other results, we may ask permission to use those results as part of a testimonial or case study.

Where results are identifiable personal data, the same privacy protections described in this section apply.

Where appropriate, we may present results anonymously or in aggregated form.

We will not intentionally publish private financial information which identifies a Client without an appropriate lawful basis and any additional permission required for the intended use.

Reviews on Third-Party Platforms

Clients may independently choose to leave reviews on third-party platforms, social media or other public websites.

Where you independently publish a review publicly, that information may also be processed by the relevant platform under its own privacy terms.

We may:

• read or respond to publicly available reviews;

• maintain reasonable records of reviews relating to our business;

• refer to or share reviews where legally permitted; and

• contact the relevant platform regarding fraudulent, unlawful or otherwise inappropriate reviews where justified.

The fact that a review is publicly available does not automatically permit us to use all information contained within it for any unrelated purpose.

Incentivised Testimonials or Reviews

Where we offer an incentive in connection with requesting feedback, a testimonial or review, we will not intentionally present an incentivised endorsement in a misleading manner.

Where applicable, any disclosure required by advertising, consumer-protection or platform rules will be made.

An incentive does not remove the individual's applicable privacy rights.

Withdrawal of Consent

Where we rely upon your consent for an identifiable testimonial, image, video, case study or other marketing use, you may withdraw that consent at any time by contacting:

hello@rhiannajones.co

Withdrawal of consent does not affect the lawfulness of processing carried out before withdrawal.

Where consent is withdrawn, we will stop future processing which depends upon that consent and take reasonable steps regarding material under our control.

However, withdrawal may not always make it technically possible to retrieve or erase material which:

• has already been lawfully distributed in physical form;

• has been independently copied or shared by third parties;

• remains within lawful archival or legal records; or

• is otherwise subject to a separate lawful basis for retention.

We will consider the particular circumstances and applicable law when responding.

Permission Can Be Limited

Where we request permission to use identifiable Client material, the permission may be limited by factors such as:

• the particular testimonial or material;

• the information which may identify the Client;

• the intended purpose;

• the channels on which it may appear; and

• any other agreed restrictions.

Consent to one particular use does not automatically constitute consent to every possible future use.

Editing Testimonials & Marketing Material

Where appropriate, we may make reasonable edits to testimonials or Client material for matters such as:

• spelling and grammar;

• formatting;

• length;

• accessibility;

• removal of irrelevant information; or

• protection of private information.

We will not intentionally edit a testimonial in a way which materially misrepresents the Client's experience or creates a false or misleading endorsement.

AI-Assisted Marketing

We may use AI tools to assist with matters such as organising, formatting, editing or preparing marketing material.

The use of AI does not expand the permission we have to use identifiable Client information.

For example, if we do not have an appropriate lawful basis to use a private Client message as a testimonial, processing that message through an AI tool does not create permission to publish it.

The provisions in AI-Assisted Processing continue to apply.

Retention

Testimonials, permissions, consent records and associated marketing materials may be retained for as long as reasonably necessary to:

• demonstrate the permission or lawful basis relied upon;

• administer active marketing materials;

• maintain accurate business records;

• respond to complaints or disputes; or

• establish, exercise or defend legal claims.

Where consent has been withdrawn, records demonstrating that consent was previously given and later withdrawn may still be retained where reasonably necessary to demonstrate compliance and ensure the material is not used again on the basis of that consent.

Your Rights

Where testimonials, reviews, images, videos, case studies or other marketing materials contain your personal data, your applicable data-protection rights continue to apply.

Those rights are explained further in Individual Rights and How to Exercise Your Rights.

Nothing in this section prevents a Client from giving an honest review, making a complaint or otherwise exercising their legal rights.

14. Anonymised & Aggregated Information

Rhianna Jones Co may use information derived from Client experiences, Programme participation, coaching themes, feedback, business information or results in an anonymised or aggregated form for legitimate business purposes.

Where information has been genuinely anonymised so that an individual is no longer identifiable, it is no longer personal data for the purposes of UK data-protection law.

What We Mean by Anonymised Information

Anonymisation involves removing or altering identifying information so that an individual cannot reasonably be identified, either directly or indirectly, from the information that remains.

Removing a Client's name alone does not necessarily make information anonymous.

When assessing whether information is genuinely anonymised, we may consider whether an individual could reasonably be identified from factors such as:

• business or brand name;

• niche or profession;

• location;

• age or other characteristics;

• distinctive personal circumstances;

• specific Programme participation;

• dates or timelines;

• unusually specific business or financial results;

• photographs, screenshots or social media information; or

• a combination of details which could identify the individual.

Where an individual remains reasonably identifiable, we will continue to treat the information as personal data.

Aggregated Information

We may combine information relating to multiple individuals to identify broader patterns, statistics, trends or insights.

For example, we may analyse aggregated information concerning:

• Programme participation;

• common coaching challenges;

• frequently discussed themes;

• content or marketing trends;

• Client implementation;

• Programme engagement;

• customer experience;

• business or coaching outcomes;

• feedback; and

• use of our products and services.

Where aggregated information cannot reasonably be linked back to an identifiable individual, it will not constitute personal data.

How We May Use Anonymised or Aggregated Information

We may use genuinely anonymised or aggregated information for purposes including:

• improving our Programmes, products and services;

• developing new resources or training;

• internal business analysis;

• identifying common Client needs or challenges;

• understanding Programme effectiveness;

• research and statistical analysis;

• training Rhianna Jones Co personnel;

• creating educational examples;

• developing frameworks or methodologies;

• producing anonymised case studies;

• illustrating general Client experiences or trends; and

• marketing or communicating genuine aggregated outcomes where appropriate.

Coaching Experiences & Case Studies

We may use themes, lessons or experiences arising through our coaching work where they have been genuinely anonymised.

For example, we may discuss a common coaching challenge or use an anonymised scenario to illustrate a teaching point without identifying the Client involved.

Where the circumstances are sufficiently distinctive that the Client could reasonably be identified despite removal of their name, we will not treat the information as genuinely anonymous.

Identifiable case studies and testimonials are instead governed by Testimonials, Reviews, Case Studies, Images & Marketing.

Results & Statistics

We may aggregate Client or Programme information to produce statistics or general statements concerning matters such as participation, implementation, outcomes or Client experiences.

Where we publish aggregated statistics, we will take reasonable steps to avoid presenting the underlying information in a way which enables individual Clients to be identified.

Where a result is attributable to a particular identifiable Client, it remains personal data and will be handled accordingly.

Special Category Data

Particular care will be taken where the source information contains Special Category Data or other highly sensitive information.

Anonymisation may be used as a privacy safeguard, but information will not be treated as anonymous where the individual can still reasonably be identified.

Until information has been genuinely anonymised, all applicable UK GDPR requirements continue to apply, including the requirement for an appropriate Article 6 lawful basis and, where applicable, an Article 9 condition.

Anonymisation Is Itself Processing

Creating anonymised information from identifiable Client information involves processing personal data.

We will therefore have an appropriate lawful basis for the processing undertaken to create the anonymised information.

Depending upon the circumstances, this may include our Legitimate Interests in analysing and improving our services, developing our business and creating appropriately anonymised insights, provided those interests are not overridden by the individual's rights and freedoms.

Pseudonymised Information Is Not the Same as Anonymous Information

Information is pseudonymised where identifying information has been replaced, removed or separated but the individual could still be identified using additional information.

For example, replacing a Client's name with a Client number while retaining a separate record linking that number to the individual would ordinarily constitute pseudonymisation rather than anonymisation.

Pseudonymised information remains personal data and continues to be protected under applicable data-protection law.

AI & Anonymised Information

Where appropriate, we may use genuinely anonymised or appropriately minimised information with AI-assisted tools for purposes such as analysis, research, content development or improving business processes.

We will not describe information as anonymous merely because a name has been removed before it is provided to an AI system.

The provisions in AI-Assisted Processing continue to apply where identifiable or pseudonymised personal data is involved.

Re-Identification

Rhianna Jones Co will not intentionally attempt to re-identify individuals from information which has been genuinely anonymised, except where necessary to test or protect the effectiveness of our anonymisation processes and where such processing is lawful and appropriately controlled.

We will also take reasonable steps, where appropriate, to reduce the risk of recipients being able to re-identify individuals from anonymised or aggregated information we disclose.

Data-Protection Rights

UK GDPR rights apply to personal data, including pseudonymised information where an individual remains identifiable.

Those rights generally do not apply to information which has been genuinely and irreversibly anonymised because that information is no longer personal data.

However, we will not use anonymisation as a means of avoiding an individual's rights while we still hold information which reasonably enables us to identify them.

Our Standard

Where we describe information as anonymous, anonymised or aggregated, our intention is that the information cannot reasonably be used to identify the individual concerned.

If there remains a reasonable means of identifying the individual, we will continue to treat the information as personal data and apply the protections described throughout this Privacy Policy.

15. Third-Party Processors & Other Recipients

Rhianna Jones Co uses third-party platforms and service providers to operate its business, deliver Programmes and coaching services, process payments, communicate with Clients and manage its systems.

Depending upon the particular processing activity, these providers may act as Data Processors on our behalf, independent Data Controllers, or in another capacity recognised by applicable data-protection law.

We do not provide every provider with access to every category of personal data. Personal data is shared or made accessible only where reasonably necessary for the relevant service or purpose.

Our Current Providers

At the date of this Privacy Policy, Rhianna Jones Co uses the following principal third-party platforms and providers:

Provider

How We Use It / Data That May Be Processed

Systeme.io

Website and landing-page functionality, checkout and sales processes, forms, scheduling, email marketing, customer and lead management, automations, Programme and membership delivery. Depending on your interaction with us, Kartra may therefore process identity, contact, marketing, Programme, account, form, transaction, scheduling and communications data. The selected provider may itself use subprocessors to provide its services.

Systeme.io

Website and online-content functionality. Technical, device, cookie, website-interaction and information voluntarily submitted through relevant website functionality may be processed depending upon our configuration and plugins.

Stripe

Payment processing, recurring billing/payment plans where applicable, refunds, failed-payment management, fraud prevention, disputes and chargebacks. The selected payment provider may receive payment credentials directly which Rhianna Jones Co does not ordinarily receive in full.

Outlook Office

Business email and communications, including enquiries, Client communications, customer support and administrative correspondence.

Google Drive

Storage and management of business and Client records, documents, submitted materials and other files. This may include coaching or Programme records where appropriate. The selected storage provider’s published information should be checked for its current security and encryption arrangements.

Whatsapp

Client messaging, Programme support and group/community communication. Depending upon the service and settings, The selected messaging provider may process telephone numbers, profile information, messages and technical information. Other group participants may also see information voluntarily shared within groups, as explained elsewhere in this Privacy Policy.

Zoom

Video calls, coaching sessions, Strategy Sessions, workshops, meetings and, where enabled and appropriately notified, recording, transcription and any AI-assisted meeting functionality enabled through the selected provider.

Facebook Live

Live-streaming, video delivery and related recording/transcription functionality. Personal data may be processed where an individual participates in or appears within content delivered through the platform.

Fathom

AI-assisted meeting transcription, summaries, notes and meeting administration where used. Depending upon the relevant meeting, this may involve audio, transcripts, participant details, communications and information discussed during calls.

Facebook, Instagram, TikTok

Social media communications, business pages/accounts, communities, advertising and audience engagement. The selected social-media provider may independently process information concerning use of its platforms.

Meta Pixal

Website advertising measurement, attribution, audience and campaign analysis and related advertising functionality, subject to applicable cookie/consent requirements.

Anthropic

AI-assisted business activities including research, drafting, content development, administration, analysis and other internal operational purposes. Personal data may be processed where reasonably necessary, subject to the safeguards described in AI-Assisted Processing.

Zapier

Automation and integration between business systems. Where an automated workflow involves personal data, The selected automation provider may process or transfer that information between the relevant connected services.

Systeme.io

Certain integrations, workflows or connected applications may interact with data held within or originating from our business systems. Depending upon the particular integration, this may involve lead, contact, communications, marketing or customer-management information.

Systeme.io may integrate with Stripe and may use subprocessors in providing its services, so information processed through that platform may also pass through authorised underlying infrastructure or service providers.

SMS & Future Communication Channels

Rhianna Jones Co does not currently use SMS as a routine Client or marketing communication channel.

We may introduce SMS or another communication channel in the future.

If we do, personal data such as names, telephone numbers, communication preferences and message information may be processed through the relevant provider. We will comply with applicable UK GDPR and electronic-marketing requirements and update this Privacy Policy where the introduction of a provider materially changes our processing.

Payment Providers

Stripe may receive payment information directly when you make a purchase.

Rhianna Jones Co does not ordinarily receive or store complete card credentials. Instead, we may receive transaction information, payment status and limited payment-method information necessary to administer the purchase.

Stripe processes personal data in providing services to businesses and their end customers, while Stripe's UK privacy information expressly explains that it processes personal information for payment services and may itself act as Data Controller for relevant processing.

Further information is provided in Payments, Billing & Financial Information and Failed Payments, Fraud Prevention, Chargebacks & Debt Recovery.

Email & File-Storage Services

We use Outlook and Google Drive for business communications, file storage and Client/business administration.

Information stored through these services may include emails, documents, Client records, coaching information, submitted materials and other information relevant to our business relationship with you.

The selected provider’s published information should be checked to confirm its current encryption, security and advertising-use arrangements.

Where smart or AI-assisted functionality is enabled, additional processing may occur according to the selected provider’s settings. Available controls governing smart features should be configured appropriately.

Video, Recording, Transcription & AI Meeting Providers

We currently use Zoom and Fathom in connection with video, live-streaming, meetings, recordings, transcription or AI-assisted meeting functionality.

Where these services process identifiable Client information, we will apply the principles described in Zoom, Calls, Recordings, Transcripts & AI Notetakers.

Use of a Programme or participation in a call does not constitute blanket consent to every form of recording, transcription or AI processing.

Social Media & Meta Technologies

We use Facebook, Instagram and TikTok as part of our business activities.

Social media platforms generally process personal data independently when individuals use their services, including information concerning profiles, devices, interactions and platform activity.

We also use Meta Pixel for advertising and measurement purposes.

Where Meta Pixel or another non-essential tracking technology requires consent under applicable law, it will be subject to our cookie-consent arrangements.

Further information is provided in Cookies & Similar Technologies.

AI Providers

We currently use Anthropic together with AI functionality incorporated into Fathom.

We do not treat the use of an AI provider as permission to disclose unrestricted Client information.

Where AI systems process personal data, the requirements and safeguards described in AI-Assisted Processing apply, including data minimisation, consideration of confidential and Special Category Data, appropriate lawful bases and human oversight where appropriate.

Integrations & Automated Data Flows

Some of our platforms communicate with one another through integrations and automated workflows.

This may include Systeme.io, Zapier and other systems.

For example, an action within one system may automatically create or update a contact record, send an internal notification, trigger a communication or transfer relevant information to another system used to fulfil that business process.

We aim to configure integrations so that only information reasonably necessary for the relevant workflow is transferred.

The existence of an integration does not mean that all information held within one system is automatically provided to every connected system.

Professional Advisers & Business Support

We may also disclose personal data where reasonably necessary to:

• accountants and bookkeepers;

• solicitors and legal advisers;

• insurers;

• tax advisers;

• debt-recovery providers;

• payment-dispute providers; and

• other professional advisers or business-support providers.

These recipients may act as independent Data Controllers where they determine how personal data must be processed in accordance with their own professional or legal responsibilities.

Government, Courts & Regulatory Authorities

Where required or permitted by law, personal data may be disclosed to bodies including:

• HM Revenue & Customs;

• courts and tribunals;

• law-enforcement authorities;

• the Information Commissioner's Office;

• other regulators; and

• other competent governmental or public authorities.

Where appropriate, we will consider the legitimacy and scope of a request before disclosing personal data.

Data Processors

Where a provider acts as a Data Processor on behalf of Rhianna Jones Co, we will use appropriate contractual and organisational safeguards as required by applicable law.

This may include requiring processors to:

• process personal data only on appropriate instructions;

• maintain confidentiality;

• implement appropriate security measures;

• appropriately manage subprocessors;

• assist with relevant data-protection obligations; and

• delete or return information where required.

Independent Data Controllers

Some providers independently determine how and why they process certain personal data.

This may particularly apply to payment providers, social media platforms, professional advisers, financial institutions and other organisations subject to their own legal obligations.

Where another organisation acts as an independent Data Controller, its own privacy policy and data-protection obligations will also apply.

Subprocessors

Our providers may themselves use subprocessors, cloud infrastructure and other suppliers to provide their services.

For example, a provider's published Data Processing Addendum may identify a number of subprocessors used within its infrastructure.

We are not necessarily in a direct contractual relationship with every subprocessor used by one of our providers.

Where applicable, our processor arrangements require subprocessors to be managed in accordance with applicable data-protection requirements.

International Processing

Several of the providers listed above operate internationally. Personal data may therefore be processed or accessed outside the United Kingdom.

An overseas location does not automatically make a transfer unlawful. Where UK data-protection law treats a transfer as restricted, an appropriate transfer mechanism or safeguard will be used where required.

This is addressed fully in International Data Transfers.

We Do Not Sell Personal Data

Rhianna Jones Co does not sell Client or lead personal data to unrelated third parties in exchange for payment.

We also do not sell private coaching information or provide it to unrelated businesses so that they can independently market their products or services to Clients.

This does not prevent lawful use of service providers, payment processors, advertising technologies, professional advisers or other recipients described in this Privacy Policy.

Data Minimisation & Changes to Providers

We aim to disclose or make available only the personal data reasonably necessary for each provider or recipient to perform the relevant function.

Our technology stack may change over time. We may replace a provider, add functionality or introduce a new provider where reasonably necessary for our business.

We will keep this Privacy Policy under review and update it where changes to our providers materially affect the way personal data is processed.

16. International Data Transfers

Rhianna Jones Co is established in the United Kingdom, but some of the third-party platforms and service providers we use operate internationally.

As a result, personal data may sometimes be stored, accessed, processed or transferred outside the United Kingdom, including in countries whose data-protection laws may differ from those applicable in the UK.

When International Transfers May Occur

International processing may occur through providers used for purposes including:

• payment processing;

• website and Programme hosting;

• cloud storage;

• email and communications;

• messaging;

• video conferencing and live streaming;

• scheduling;

• forms and questionnaires;

• accounting;

• customer and lead management;

• automation and integrations;

• analytics and advertising;

• AI-assisted processing;

• transcription and meeting assistance; and

• social media.

As explained in Third-Party Processors & Other Recipients, our current technology providers include Systeme.io, Stripe, Outlook, Whatsapp, Zoom, Athropic, Facebook, Instagram and TikTok.

The use of an international provider does not necessarily mean that personal data is transferred outside the UK in every instance. The location of processing may depend upon the provider, service, infrastructure, account configuration and subprocessors involved.

UK Adequacy Regulations

Where personal data is transferred from the UK to a country or organisation covered by applicable UK adequacy regulations, we may rely upon that adequacy decision where appropriate.

An adequacy decision means that the UK Government has determined that the relevant destination provides an adequate level of protection for personal data.

Transfers Where There Is No Adequacy Decision

Where personal data is transferred to a destination which is not covered by applicable UK adequacy regulations, we will use an appropriate lawful transfer mechanism where required.

Depending upon the circumstances, this may include:

• the UK's International Data Transfer Agreement (“IDTA”);

• the UK Addendum to the EU Standard Contractual Clauses;

• another approved contractual transfer mechanism;

• an applicable UK-approved certification, framework or other safeguard; or

• another mechanism permitted under UK data-protection law.

Where required, we will also consider whether additional technical, contractual or organisational safeguards are appropriate having regard to the circumstances of the transfer.

UK–US Data Bridge

Where a recipient in the United States participates in an applicable UK-recognised data-transfer framework and the legal requirements are satisfied, we may rely upon the relevant UK adequacy arrangements, including the UK Extension to the EU-US Data Privacy Framework, commonly referred to as the UK-US Data Bridge.

We will not assume that a US provider is covered merely because it is based in the United States. The relevant provider and processing must satisfy the requirements of the applicable framework.

Provider Safeguards

Where we appoint a provider which may process personal data internationally, we may consider matters including:

• where personal data is stored or accessed;

• the provider's contractual commitments;

• applicable Data Processing Agreements;

• transfer mechanisms;

• subprocessors;

• security standards;

• encryption;

• access controls;

• confidentiality;

• retention arrangements; and

• other appropriate technical and organisational measures.

Where a provider acts as an independent Data Controller, that provider is responsible for its own international-transfer obligations in respect of processing for which it determines the purposes and means.

Subprocessors

Some providers use subprocessors located in different countries.

This means personal data may be processed through infrastructure or service providers other than the company with which Rhianna Jones Co directly contracts.

Where a provider acts as our Data Processor, its appointment and use of subprocessors must be managed in accordance with applicable data-protection requirements and our relevant contractual arrangements.

We do not necessarily have a direct contractual relationship with every subprocessor used within a provider's infrastructure.

AI, Cloud & Technology Providers

International transfers are particularly relevant to cloud-based, AI, communications and technology services because these providers may operate infrastructure across multiple jurisdictions.

Where personal data is processed through services such as AI tools, cloud storage, video conferencing, transcription or automation platforms, we will apply the safeguards described in this section together with the additional protections described in AI-Assisted Processing and Third-Party Processors & Other Recipients.

Special Category & Sensitive Information

Where an international transfer involves Special Category Data or other particularly sensitive Client information, we will consider the sensitivity of the information when determining appropriate safeguards.

An international transfer does not reduce the requirements applicable to Special Category Data.

Where required, an appropriate Article 6 lawful basis and Article 9 condition must still apply.

Exceptions

UK data-protection law provides limited exceptions which may permit certain international transfers where the usual safeguards are unavailable and specific legal requirements are satisfied.

These exceptions are intended for particular circumstances and will not be relied upon routinely as a substitute for appropriate international-transfer arrangements.

Where an exception is relied upon, we will ensure that the applicable legal requirements are satisfied.

Security

We take reasonable steps to ensure that international processing does not unnecessarily reduce the protection afforded to personal data.

However, no international transfer or electronic storage system can be guaranteed to be completely secure.

Our wider security arrangements are explained in Data Security.

Changes to Processing Locations

Providers may change their infrastructure, subprocessors or processing locations over time.

We therefore keep our principal providers and international-transfer arrangements under review and will update this Privacy Policy where a change materially affects how personal data is processed.

Further Information

You may contact us if you would like further information about the safeguards applicable to an international transfer of your personal data.

Where appropriate and subject to applicable confidentiality, security and legal restrictions, we can provide information concerning the relevant transfer mechanism or how you may obtain further information about it.

Please contact:

Rhianna Jones Co

Email:hello@rhiannajones.co

17. Data Security

Rhianna Jones Co takes the security of personal data seriously and uses appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, access or misuse.

The measures we use will depend upon factors including the nature, sensitivity and volume of the information, the way it is processed, the technology involved and the risks presented by the processing.

Technical Security Measures

Depending upon the relevant system and information, technical safeguards may include:

• password-protected accounts and systems;

• multi-factor authentication where available and appropriate;

• encryption provided by our technology and cloud providers;

• secure payment-processing systems;

• access controls and permissions;

• secure cloud-based storage;

• security and software updates;

• anti-malware and device-security measures;

• authentication and account-security controls;

• backups and recovery measures where appropriate;

• monitoring or security functionality provided by our platforms; and

• restricting unnecessary downloading, duplication or local storage of personal data.

Complete payment-card credentials are ordinarily processed directly by payment providers such as Stripe or PayPal rather than being stored directly by Rhianna Jones Co, as explained in Payments, Billing & Financial Information.

Organisational Security Measures

Our organisational safeguards may include:

• limiting access to personal data to people who reasonably require it for their role;

• maintaining confidentiality expectations for team members and contractors;

• using reputable service providers;

• reviewing access when roles or working relationships change;

• applying data-minimisation principles;

• maintaining appropriate Client and business records;

• considering privacy and security when introducing new systems or providers;

• maintaining procedures for responding to data-protection requests and incidents;

• securely deleting or disposing of information when it is no longer required; and

• taking additional care with coaching information, Special Category Data and other particularly sensitive information.

Access to Client Information

Access to Client information is not automatically available to everyone working with Rhianna Jones Co.

Where reasonably practicable, access is limited according to what an individual or provider requires to perform the relevant function.

For example, a team member dealing with administration may not require access to detailed private coaching information simply because they work within the business.

Coaching & Sensitive Information

We recognise that coaching records, private communications and Special Category Data may warrant a higher level of care than ordinary administrative information.

Where appropriate, we may use measures such as:

• minimising the sensitive information recorded;

• limiting who can access it;

• avoiding unnecessary duplication;

• redacting or anonymising information;

• limiting information disclosed to third parties; and

• considering the sensitivity of information before using new technology or AI-assisted systems.

The provisions in Coaching Information & Special Category Data and AI-Assisted Processing also apply.

Third-Party Security

A significant proportion of our business technology is provided through specialist third-party platforms, including the providers identified in Third-Party Processors & Other Recipients.

Where appropriate, we consider the security and data-protection arrangements of providers before or during their use.

Where a provider acts as our Data Processor, appropriate contractual protections will be used as required by applicable data-protection law.

However, Rhianna Jones Co does not directly control every aspect of the infrastructure, security or operations of independent third-party platforms.

Team Members & Contractors

Where employees, contractors or other authorised personnel have access to personal data, access should be limited to information reasonably required for their responsibilities.

Appropriate confidentiality and data-protection expectations apply to personnel handling personal data on behalf of Rhianna Jones Co.

Access may be removed or changed when it is no longer required.

Remote Working & Devices

As an online business, personal data may be accessed remotely where reasonably necessary to operate Rhianna Jones Co and provide its services.

We take reasonable steps to protect information accessed through computers, mobile devices and online accounts, including appropriate authentication, device and account-security measures.

Personnel must take reasonable care to prevent personal data from being viewed, accessed or disclosed by unauthorised persons.

Data Breaches & Security Incidents

Despite appropriate safeguards, no organisation can completely eliminate the possibility of a data breach or security incident.

Where we become aware of a suspected personal-data breach, we will take reasonable steps to:

• investigate what happened;

• contain or mitigate the incident where possible;

• assess the nature and extent of the personal data involved;

• assess the potential risk to affected individuals;

• document the breach as required; and

• take appropriate remedial action.

Where a personal-data breach is likely to result in a risk to individuals' rights and freedoms, we will notify the Information Commissioner's Office (“ICO”) where required by law, including within the applicable statutory timeframe.

Where a breach is likely to result in a high risk to an affected individual's rights and freedoms, we will also notify the affected individual without undue delay where required by law.

Your Role in Security

Clients and users also have an important role in protecting their information.

You should:

• keep Programme and account login credentials confidential;

• use appropriate passwords;

• avoid sharing account access with other people;

• protect devices used to access our services;

• take care when sharing sensitive information in group environments; and

• notify us promptly if you believe your account, personal information or communications with us have been compromised.

If you believe there may have been unauthorised access to your Rhianna Jones Co account or information, please contact us athello@rhiannajones.co.

No System Is Completely Secure

While we take reasonable and appropriate measures to protect personal data, no method of electronic transmission, online communication or digital storage can be guaranteed to be completely secure.

We therefore do not promise or represent that personal data is, or can be, protected against every possible security incident.

Our obligation is to implement security measures appropriate to the risks presented by the processing and to respond appropriately where an incident occurs.

Ongoing Review

Security risks and technology change over time.

We may therefore review and update our technical and organisational safeguards, providers, access arrangements and internal practices where reasonably necessary to maintain an appropriate level of protection for the personal data we process.

18. Data Retention

Rhianna Jones Co retains personal data only for as long as reasonably necessary for the purposes for which it was collected, including providing our services, maintaining appropriate business and contractual records, complying with legal obligations, resolving disputes, recovering payments and establishing, exercising or defending legal claims.

The end of a Programme, membership or coaching relationship does not necessarily mean that all personal data relating to that relationship will be immediately deleted.

Different categories of information have different legitimate retention requirements.

Our Retention Schedule

The periods below describe our general retention approach. A record may be retained for a shorter or longer period where there is a legitimate and lawful reason to do so.

Type of Information

General Retention Period / Approach

Enquiries and prospective Client records where no purchase is made

Generally up to 2 years from the last meaningful interaction, unless continued retention is reasonably necessary or the individual remains subscribed to marketing

Client identity, contact, enrolment and Programme records

Generally for the duration of the Client relationship and up to 6 years after it ends, where required for contractual records, complaints, disputes or legal claims

Contracts, Terms acceptance and electronic acceptance records

Generally 6 years after the relevant contractual relationship ends, or longer where a dispute or legal requirement justifies continued retention

Coaching and session notes

Generally for the duration of the coaching relationship and up to 6 years after it ends, subject to periodic review and earlier deletion where detailed information is no longer reasonably necessary

WhatsApp, email and other Client communications

Relevant communications may generally be retained for the Client relationship and up to6 years afterwards where required for service records, contractual matters, complaints, disputes or legal claims. Routine or unnecessary communications may be deleted earlier

Forms, questionnaires and applications relating to an active Client

For as long as reasonably required to provide the service and generally up to 6 years following the end of the relevant Client relationship where they form part of the contractual or service record

Business audits, content reviews and personalised feedback records

For as long as reasonably required to provide the service and thereafter where reasonably necessary to maintain an appropriate record of the service provided, generally no longer than 6 years after the relevant relationship ends

Programme access and usage records

For the duration of access and afterwards where reasonably necessary for administration, security, contractual evidence, fraud prevention, chargebacks or legal claims, generally up to 6 years following the relevant transaction or relationship

Transaction, invoice, VAT, accounting and tax records

Generally at least 6 years or such other period as required by applicable UK tax and accounting law, calculated from the relevant statutory accounting/tax period

Payment-plan and billing records

For the duration of the payment arrangement and generally up to 6 years afterwards where necessary for financial, contractual or legal records

Failed-payment and payment-recovery records

Until the matter is resolved and thereafter generally for up to 6 years, where reasonably necessary to demonstrate payment history, contractual obligations or recovery activity

Chargebacks and payment disputes

For the duration of the dispute and generally up to 6 years after resolution, or longer where litigation, enforcement or another legal requirement remains relevant

Debt-recovery and legal-collection records

For the duration of recovery or proceedings and generally up to 6 years following resolution, final payment, judgment or other relevant conclusion, subject to applicable legal requirements

Complaints and disputes

For the duration of the matter and generally up to 6 years after it is resolved, where reasonably necessary to maintain evidence and protect the rights of the parties

Fraud and security records

For as long as reasonably necessary to investigate the matter, protect our systems and prevent repeated misuse, taking account of the nature and seriousness of the incident

Marketing contact information

For as long as you remain appropriately subscribed or we otherwise have a lawful basis to send marketing. We will stop sending marketing where you unsubscribe or validly object

Marketing suppression / opt-out records

We may retain limited information, such as an email address and opt-out status, for as long as reasonably necessary to ensure that a person who has opted out is not inadvertently added back to marketing

Cookie and analytics information

According to the lifespan of the relevant cookie or analytics technology and applicable consent settings, as explained in Cookies & Similar Technologies

Testimonials and identifiable case studies

For the period for which we have an appropriate lawful basis to use the material. Where consent is relied upon and withdrawn, future consent-based use will cease, subject to the qualifications explained in Testimonials, Reviews, Case Studies, Images & Marketing

Testimonial/marketing consent records

May be retained after marketing use ends where reasonably necessary to demonstrate what permission was given, its scope and any subsequent withdrawal

Genuinely anonymised information

May be retained indefinitely, because information which has been genuinely anonymised so that an individual is no longer identifiable is no longer personal data

Call recordings

Retained only for as long as reasonably necessary for the purpose communicated when the recording was made. Recordings intended as Programme Content or replays may be retained for the applicable access period; other recordings may be deleted sooner

Transcripts and AI-generated meeting notes

For as long as reasonably necessary for the relevant coaching, administrative, accessibility or record-keeping purpose. They may be retained separately from the underlying recording where there is a legitimate reason to retain the written record

Community posts and group communications

According to the purpose of the community and functionality of the relevant platform. Some information may remain visible in historical group records or on participants' devices after a person leaves

Internal Client-management records

Generally for the Client relationship and up to 6 years afterwards where reasonably necessary for contractual, administrative, dispute or legal purposes

Data-protection requests and correspondence

Generally up to 6 years after the request is concluded where reasonably necessary to demonstrate how the request was handled and our compliance with data-protection obligations

Data-breach and security-incident records

Retained for an appropriate period having regard to the nature of the incident, regulatory requirements, potential claims and our accountability obligations

Why Some Information Is Retained After Your Programme Ends

Termination, cancellation, expiry or completion of a Programme does not automatically require Rhianna Jones Co to erase every record concerning the Client.

We may legitimately need to retain certain information after the service ends for purposes including:

• tax, VAT and accounting requirements;

• maintaining evidence of the Agreement entered into;

• demonstrating the Terms accepted at checkout;

• maintaining records of services provided;

• responding to complaints;

• resolving contractual disputes;

• fraud prevention;

• payment administration and recovery;

• responding to chargebacks;

• debt recovery;

• protecting Intellectual Property;

• safeguarding where legitimately applicable;

• complying with legal or regulatory requirements; and

• establishing, exercising or defending legal claims.

Where only part of a record remains necessary, we may delete, redact, anonymise or restrict other information rather than retaining the complete record.

The General Record Retention Period

A number of our business and Client records may generally be retained for up to 6 years after the relevant relationship, transaction or dispute.

This reflects, among other considerations, the potential period during which contractual claims may arise under the laws of England and Wales.

This does not mean that every piece of Client information will automatically be retained for 6 years.

For example, unnecessary duplicate files, routine administrative messages, temporary working documents or detailed information which no longer serves a legitimate purpose may be deleted earlier.

Coaching Notes & Sensitive Information

We recognise that coaching notes and communications may contain considerably more personal information than an invoice or basic contractual record.

We therefore consider the nature and sensitivity of coaching information when determining whether continued retention is necessary.

Where detailed coaching information is no longer reasonably required but a basic record of the Client relationship remains necessary, we may retain the necessary administrative or contractual record while deleting, redacting or anonymising more detailed coaching information.

Special Category Data will not be retained simply because it was once disclosed during coaching.

Active Complaints, Disputes & Legal Claims

Where a complaint, chargeback, payment dispute, debt-recovery matter, regulatory investigation or legal claim is ongoing or reasonably anticipated, relevant records may be retained beyond an otherwise applicable standard retention period.

They may be retained until the matter has been finally resolved and for any additional period reasonably necessary to deal with appeals, enforcement, limitation periods or related legal obligations.

We will not use the possibility of a hypothetical future dispute as justification for retaining all Client information indefinitely.

Marketing After the Client Relationship Ends

Ending a Programme does not necessarily remove someone from our marketing communications where we continue to have a lawful basis to send them.

You may unsubscribe from marketing communications at any time.

Where you unsubscribe, we may retain a limited suppression record rather than completely deleting your contact information so that we can remember and respect your opt-out.

Information Held by Third Parties

Our ability to delete information may depend partly upon the systems through which it is processed.

Third-party providers may retain:

• backups;

• security logs;

• transaction records;

• legally required records; or

• information they process independently as Data Controllers

for periods determined by their own legal obligations and retention policies.

For example, payment providers, financial institutions and social media platforms may have independent reasons for retaining certain information even after Rhianna Jones Co no longer requires its own copy.

Group & Community Information

Where information has been shared with other participants through WhatsApp, Facebook, group coaching or another community, deleting our own copy does not necessarily remove copies already legitimately received or retained by other participants.

Similarly, some third-party platforms may preserve historical messages or posts according to their own functionality and retention arrangements.

Further information is provided in Group Coaching, WhatsApp, Facebook Groups & Communities.

Anonymisation

Where we no longer require information in identifiable form but the underlying information remains useful for legitimate statistical, analytical, educational or business purposes, we may genuinely anonymise it.

Once information has been genuinely anonymised so that an individual can no longer reasonably be identified, it is no longer personal data and may be retained without the UK GDPR retention restrictions applying to personal data.

Pseudonymised information remains personal data and continues to be subject to this Privacy Policy.

Deletion & Secure Disposal

When personal data reaches the end of its appropriate retention period and there is no continuing lawful reason to retain it, we will take reasonable steps to:

• securely delete it;

• destroy it;

• anonymise it; or

• otherwise remove it from active use as appropriate.

Deletion from active systems may not always result in immediate deletion from encrypted backups or disaster-recovery systems. Where information remains temporarily within backups, it will remain subject to appropriate security measures and will not ordinarily be restored or used except where necessary for legitimate backup or recovery purposes.

Retention Reviews

We may periodically review retained information to determine whether it remains necessary.

When determining an appropriate retention period, we may consider:

• the purpose for which the information was collected;

• whether that purpose remains active;

• the nature and sensitivity of the information;

• the potential risk associated with continued retention;

• contractual requirements;

• applicable limitation periods;

• tax and accounting obligations;

• complaints or disputes;

• regulatory requirements;

• fraud and security considerations; and

• whether the relevant purpose could reasonably be achieved using anonymised information instead.

Your Right to Request Erasure

You may have the right to request deletion of your personal data in certain circumstances.

The right to erasure is not absolute.

For example, we may be entitled or required to retain information where processing remains necessary for:

• compliance with a legal obligation;

• the establishment, exercise or defence of legal claims; or

• another purpose permitted under applicable data-protection law.

Where we cannot comply fully with an erasure request, we will explain the applicable reason where required.

Further information is provided in Individual Rights and How to Exercise Your Rights.

19. Marketing Communications

Rhianna Jones Co may communicate with Clients, prospective Clients, leads and other individuals about our Programmes, products, services, events, content and other relevant opportunities.

We distinguish between service and administrative communications, which may be necessary to manage our relationship with you, and optional direct marketing communications.

Purchasing Does Not Mean Blanket Marketing Consent

Purchasing a Programme, membership, product or service, creating an account, participating in coaching or accepting our Terms & Conditions does not constitute blanket consent to receive marketing communications.

Where consent is required for direct marketing, we will obtain that consent separately and in accordance with applicable law.

Where direct marketing may lawfully be sent without consent, we will ensure that another appropriate lawful basis and any applicable requirements under the Privacy and Electronic Communications Regulations (“PECR”) are satisfied.

Service & Administrative Communications

Where you purchase from us or otherwise enter into a contractual relationship with Rhianna Jones Co, we may send communications which are reasonably necessary to provide or administer that relationship.

These may include:

• purchase and payment confirmations;

• receipts and invoices;

• Programme access information;

• login and account information;

• session confirmations and reminders;

• scheduling or rescheduling information;

• Programme updates;

• information about changes which affect your purchased service;

• support responses;

• failed-payment or billing communications;

• renewal or cancellation information;

• contractual or legal notices;

• security communications; and

• other important administrative information concerning your account or purchase.

These communications are not treated as optional marketing merely because they are sent by email or another electronic channel.

Where a communication is genuinely necessary to perform our Agreement, comply with a legal obligation or appropriately administer the Client relationship, you may continue to receive it even if you have unsubscribed from marketing.

We will not deliberately disguise promotional marketing as an essential service communication.

Direct Marketing

Marketing communications may include information concerning:

• Rhianna Jones Co Programmes;

• coaching and mentoring services;

• memberships;

• digital products;

• masterclasses, workshops and events;

• new offers or launches;

• promotions or discounts;

• relevant educational content;

• opportunities to work with us; and

• other Rhianna Jones Co products or services which may reasonably be of interest.

Depending upon the circumstances and applicable law, we may rely upon Consent or Legitimate Interests as our Article 6 lawful basis for direct marketing.

Electronic marketing must also comply with applicable PECR requirements.

Email Marketing & Existing Customers

In certain circumstances, UK electronic-marketing rules permit marketing emails or similar electronic communications to existing customers without obtaining a separate opt-in at the point of every communication.

Where we rely upon the applicable existing-customer or “soft opt-in” rules, we will only do so where the legal requirements are satisfied, including where:

• we obtained your contact details in the course of a sale or negotiations for a sale;

• the marketing concerns our own similar products or services;

• you were given an appropriate opportunity to refuse or opt out when your details were collected; and

• you are given a clear and simple opportunity to opt out in each subsequent marketing communication.

We will not assume that every person who has interacted with Rhianna Jones Co automatically falls within the soft opt-in.

Prospective Clients & Leads

Where you have not purchased from us, we may send electronic direct marketing where you have provided appropriate consent or where another lawful route genuinely applies.

Submitting an enquiry, application, form or booking request does not automatically provide unlimited permission for unrelated future marketing.

Information provided for an enquiry may nevertheless be used to respond to and appropriately follow up that enquiry where we have a lawful basis to do so.

Social Media Marketing

We may communicate or advertise through platforms such as Facebook, Instagram and LinkedIn.

Where you interact with our business through a social media platform, the platform may independently process information about your account and activity.

We may also use advertising functionality provided by those platforms, including audience and measurement technologies, subject to applicable data-protection and cookie requirements.

Further information is provided in Third-Party Processors & Other Recipients and Cookies & Similar Technologies.

Advertising Pixels & Advertising Audiences

We currently use Meta Pixel in connection with advertising, measurement and attribution.

Depending upon your consent choices and our configuration, Meta technologies may process information concerning interactions with our websites or marketing.

Where the use of Meta Pixel or another non-essential tracking technology requires consent, it will not be treated as authorised merely because you purchased a Programme or accepted our Terms.

Where we use personal data to create, match or manage advertising audiences, we will ensure that there is an appropriate lawful basis and that applicable transparency and electronic-communications requirements are addressed.

Marketing Preferences

Where available, you may choose which marketing communications you wish to receive.

We may maintain records of:

• marketing consent;

• the date and method by which consent was obtained;

• marketing preferences;

• communications sent;

• unsubscribe requests;

• objections to direct marketing; and

• suppression status.

These records help us demonstrate compliance and respect your communication preferences.

Unsubscribing

You may unsubscribe from email marketing at any time by:

• using the unsubscribe mechanism provided within the relevant marketing email; or

• contactinghello@rhiannajones.co.

Where you object to the processing of your personal data for direct marketing purposes, we will stop processing your personal data for that direct marketing.

There is no requirement for you to explain why you wish to opt out.

Suppression Records

When you unsubscribe, we may retain limited information on a suppression list rather than completely deleting your email address from all systems.

This allows us to remember that you have opted out and helps prevent you from being accidentally re-added to marketing communications.

A suppression record will not itself be used as permission to resume marketing.

Unsubscribing Does Not Affect Your Programme

Choosing not to receive marketing communications does not affect your right to access a Programme, product or service you have already purchased.

Likewise, cancelling a Programme or membership does not necessarily constitute an unsubscribe from marketing where we otherwise have a lawful basis to continue sending it.

You may manage the two separately.

WhatsApp & Direct Messages

Where WhatsApp, social media direct messaging or another electronic messaging service is used for promotional communications, we will consider the applicable UK GDPR and PECR requirements in the same way as other forms of electronic direct marketing.

A telephone number provided for Programme support, account administration or coaching communication will not automatically be treated as blanket consent for unrelated WhatsApp marketing.

SMS

We do not currently use SMS as a routine marketing channel.

If SMS marketing is introduced in the future, we will ensure that telephone numbers are used in accordance with applicable UK GDPR and PECR requirements, including consent or other applicable electronic-marketing rules.

AI-Assisted Marketing

We may use AI-assisted tools to help create, organise, analyse or personalise marketing activities.

AI use does not alter the lawful basis required for the underlying processing and does not create marketing permission where none otherwise exists.

Private coaching information will not automatically be used for marketing merely because an AI system is capable of processing it.

Further information is provided in AI-Assisted Processing.

Testimonials Are Separate

Consent to receive marketing is separate from permission to appear in our marketing.

Subscribing to our mailing list does not give us permission to use your name, photograph, Client results, private messages or identifiable case study as promotional material.

Similarly, giving permission for a testimonial does not automatically subscribe you to marketing communications.

Further information is provided in Testimonials, Reviews, Case Studies, Images & Marketing.

Lawful Bases & PECR

Depending upon the circumstances, our processing for marketing may rely upon:

• Consent;

• Legitimate Interests, where legally appropriate; and/or

• another applicable lawful basis.

Where electronic direct marketing is subject to PECR, we will also comply with the applicable PECR requirements.

Having a lawful basis under UK GDPR does not by itself override a requirement to obtain consent under PECR.

Your Absolute Right to Object to Direct Marketing

Under UK data-protection law, you have the right to object at any time to processing of your personal data for direct marketing purposes, including profiling to the extent that it relates to such direct marketing.

Where you exercise that right, we will stop processing your personal data for the relevant direct-marketing purpose.

This does not prevent us from continuing to process information for separate lawful purposes, including providing your Programme, processing payments, maintaining legally required records or sending necessary administrative communications.

20. Cookies & Similar Technologies

Rhianna Jones Co uses cookies and similar technologies on its websites, landing pages and other online services.

Cookies are small files or pieces of information placed on or accessed through your device when you visit a website. Similar technologies may include pixels, tags, scripts, local storage and other technologies which enable information about a device or interaction to be stored, accessed or communicated.

How We Use Cookies

Depending upon the website, page and technologies in use, cookies and similar technologies may be used for purposes including:

• enabling websites and pages to function;

• maintaining security;

• remembering settings or preferences;

• facilitating login or Membership Site functionality;

• supporting checkout and payment processes;

• understanding website usage and performance;

• measuring marketing and advertising performance;

• understanding how visitors arrive at and interact with our websites;

• attributing conversions or purchases to marketing activity; and

• supporting advertising and audience measurement.

Strictly Necessary Cookies

Some cookies and similar technologies are necessary for our websites or services to operate correctly.

These may be required for purposes such as:

• security;

• authentication;

• account access;

• checkout functionality;

• payment processing;

• remembering privacy choices; or

• providing functionality specifically requested by you.

Where applicable law permits strictly necessary technologies to operate without consent, we may use them without asking you to opt in.

They will not be treated as strictly necessary merely because they are commercially useful to us.

Analytics & Performance Technologies

We may use analytics or performance technologies to understand how people interact with our websites, pages and services.

Depending upon the technology and configuration, information processed may include:

• pages visited;

• interactions with pages;

• referral sources;

• device or browser information;

• approximate location information;

• timestamps;

• identifiers; and

• other technical or usage information.

Where consent is required for these technologies under applicable law, they will only be used after the required consent has been obtained.

Advertising & Tracking Pixels

We currently use Meta Pixel in connection with advertising, measurement, attribution and related marketing activities.

Depending upon our configuration and your consent choices, Meta Pixelmay enable information concerning interactions with our websites to be communicated to Meta.

This may help us understand matters such as whether advertising resulted in a website visit, enquiry or purchase and may support advertising-audience functionality.

Meta may also process information it receives in accordance with its own privacy arrangements.

The fact that you purchase a Programme, submit a form or accept our Terms & Conditions does not constitute blanket consent to non-essential advertising cookies or tracking technologies.

Where consent is required, it will be obtained through our cookie consent mechanism.

Third-Party Technologies

Cookies and similar technologies may be provided by Rhianna Jones Co or by third-party services integrated into our websites and systems.

Our current online infrastructure includes Systeme.io, together with integrations and technologies described in Third-Party Processors & Other Recipients.

Third-party functionality embedded within a website may sometimes result in the relevant provider processing technical or usage information.

Where such processing requires consent, we will apply the appropriate consent requirements.

Cookie Consent

Where UK law requires consent before a cookie or similar technology can be stored on or accessed from your device, we will request that consent through an appropriate cookie banner, consent-management tool or other mechanism.

Where consent is required:

• non-essential technologies should not be activated before the required consent is obtained;

• consent must involve a clear affirmative choice;

• refusing non-essential cookies should not prevent access to functionality which does not genuinely depend upon them; and

• you must be able to withdraw or change your consent.

Your cookie choices are separate from acceptance of our Programme Terms and from consent to receive marketing communications.

Managing or Withdrawing Your Choices

Where available, you can manage your cookie preferences through the cookie settings or consent mechanism provided on our website.

You may also be able to control or delete cookies through your browser settings.

Blocking certain cookies may affect the operation or functionality of some parts of our websites, particularly where those technologies are necessary to provide functionality you have requested.

Withdrawing consent does not affect the lawfulness of processing carried out before consent was withdrawn.

UK GDPR & PECR

The use of cookies and similar technologies may be governed by both:

• the UK GDPR and Data Protection Act 2018, where personal data is processed; and

• the Privacy and Electronic Communications Regulations (“PECR”), which contain specific requirements concerning storing information on, or accessing information from, a user's device.

Having a lawful basis under UK GDPR does not automatically remove a consent requirement which applies under PECR.

Where personal data obtained through cookies or similar technologies is subsequently processed, we will also identify an appropriate UK GDPR lawful basis for that processing.

Cookie Retention

Different cookies have different lifespans.

Some operate only for the duration of a browsing session, while others may remain on a device for a defined period unless deleted earlier.

We will not intentionally retain cookies or information derived from them for longer than reasonably necessary for their stated purpose.

Specific information concerning the cookies and similar technologies currently used, including their purposes and durations where applicable, will be provided through our Cookie Policy and/or cookie consent mechanism.

Changes to Cookies & Technology

The technologies used on our websites may change as our websites, marketing systems and service providers develop.

We may therefore add, remove or replace cookies and similar technologies.

Our Cookie Policy and consent mechanism should be kept updated to reflect the technologies actually in use.

Further Information

For more detailed information about the individual cookies and similar technologies used on our websites, including available information about their providers, purposes and durations, please refer to our separate Cookie Policy and the cookie settings available through our website.

21. Individual Rights

Under UK data-protection law, you have a number of rights in relation to your personal data.

These rights are not absolute in every circumstance. Whether a particular right applies may depend upon factors including the type of information, the purpose for which it is being processed, the lawful basis relied upon and any applicable legal exemptions.

Where you exercise a right, Rhianna Jones Co will consider your request in accordance with applicable data-protection law.

Right of Access

You may have the right to request confirmation as to whether we process your personal data and to receive a copy of personal data we hold about you, together with certain information about how it is processed.

This is commonly known as a Data Subject Access Request (“DSAR”).

A request may potentially cover personal data contained within records such as:

• Client and account records;

• emails and relevant communications;

• coaching or session records;

• forms and questionnaires;

• payment and transaction records; and

• other systems in which your personal data is held.

The right of access does not automatically entitle you to every document in its original form. It is a right to your personal data and associated information.

Information concerning other individuals, legally privileged information and other information covered by an applicable exemption may be withheld or redacted where permitted or required by law.

Right to Rectification

You have the right to ask us to correct personal data which is inaccurate.

You may also have the right to have incomplete personal data completed, taking account of the purposes for which it is being processed.

If you believe information we hold about you is inaccurate or incomplete, please contact us so that we can review and, where appropriate, correct it.

Right to Erasure

In certain circumstances, you may have the right to request deletion of your personal data. This is sometimes referred to as the “right to be forgotten.”

The right to erasure is not absolute.

For example, we may be entitled or required to retain information where it remains necessary for:

• compliance with a legal obligation;

• tax, VAT or accounting records;

• resolving an active complaint or dispute;

• payment recovery;

• fraud prevention where legitimately applicable; or

• the establishment, exercise or defence of legal claims.

Accordingly, cancellation or completion of a Programme does not automatically create a right to immediate deletion of every record relating to the Client.

Where only some information must continue to be retained, we may delete other information while preserving the records which remain lawfully necessary.

Right to Restriction of Processing

In certain circumstances, you may have the right to request that we restrict the processing of your personal data.

This may apply, for example, while:

• the accuracy of information is being contested;

• an objection to processing is being considered;

• processing is unlawful but you request restriction rather than deletion; or

• we no longer require the information for our purposes but you require it for the establishment, exercise or defence of legal claims.

Where processing is restricted, we may continue to store the information and process it in circumstances permitted by law.

Right to Object

You may have the right to object to processing where we rely upon Legitimate Interests or certain other lawful bases.

Where you object, we will consider your circumstances and whether we have compelling legitimate grounds to continue the processing which override your interests, rights and freedoms, or whether continued processing is necessary for the establishment, exercise or defence of legal claims.

Absolute Right to Object to Direct Marketing

You have the right to object at any time to processing of your personal data for direct-marketing purposes, including profiling to the extent that it relates to direct marketing.

Where you object to direct marketing, we will stop processing your personal data for that purpose.

You do not need to provide a reason.

We may retain limited information on a suppression list so that we can remember and respect your marketing objection.

Stopping marketing does not prevent us from sending necessary Programme, account, payment, contractual, security or other administrative communications.

Right to Data Portability

In certain circumstances, you may have the right to receive personal data you have provided to us in a structured, commonly used and machine-readable format and to transmit that information to another Data Controller.

This right generally applies where:

• processing is based upon Consent or Contract; and

• processing is carried out by automated means.

Where technically feasible and legally applicable, you may also have the right to request that information be transmitted directly to another Data Controller.

Data portability does not apply to every category of information we hold and does not necessarily include information created by Rhianna Jones Co rather than provided by you.

Right to Withdraw Consent

Where we rely upon your Consent to process personal data, you may withdraw that consent at any time.

Where Special Category Data is processed on the basis of Explicit Consent, you may similarly withdraw that explicit consent.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

It also does not require us to stop processing the same information for a separate purpose where another valid lawful basis independently applies.

For example, withdrawing consent to use a testimonial for future marketing would not necessarily require us to delete an invoice which we are legally required to retain.

Rights Concerning Automated Decision-Making

UK data-protection law provides additional protections concerning certain decisions made solely by automated means which produce legal effects concerning an individual or similarly significantly affect them.

As explained in AI-Assisted Processing, Rhianna Jones Co does not solely automated decision-making producing legal or similarly significant effects within the meaning of applicable UK data-protection law.

If this changes, we will provide appropriate information about the processing and the applicable safeguards and rights.

Depending upon the circumstances, these may include rights to obtain human intervention, express your point of view and challenge a decision.

Rights Concerning Profiling

Where profiling involves your personal data, you may have applicable rights depending upon the lawful basis, purpose and consequences of that processing.

You have an absolute right to object to profiling to the extent that it relates to direct marketing.

Any profiling connected with solely automated decisions producing legal or similarly significant effects would also be subject to the additional protections required by applicable law.

How to Exercise Your Rights

You may exercise an applicable data-protection right by contacting:

Rhianna Jones Co

 Email:hello@rhiannajones.co

You do not normally need to use any particular wording or form.

Please provide enough information for us to understand which right you wish to exercise and what information your request concerns.

Verifying Your Identity

We have a responsibility not to disclose personal data to the wrong person.

Where reasonably necessary, we may therefore request information to confirm your identity before fulfilling a request.

We will only request information reasonably necessary for verification and will not intentionally use identity verification as a means of obstructing a legitimate request.

Where someone makes a request on your behalf, we may also take reasonable steps to verify their authority to act for you.

Response Times

We will respond to valid data-protection requests without undue delay and ordinarily within one month of receiving the request.

Where permitted by law, this period may be extended by up to a further two months where a request is particularly complex or where multiple requests have been made.

If an extension is required, we will inform you within the initial one-month period and explain the reason for the delay.

Where we reasonably require additional information to identify you or clarify the information requested, applicable legal rules concerning the response period will apply.

Fees

You will not normally be charged for exercising your data-protection rights.

Where a request is manifestly unfounded or excessive, particularly because it is repetitive, we may where permitted by law:

• charge a reasonable fee reflecting the administrative costs involved; or

• refuse to act on the request.

Where we refuse to act or charge a fee, we will explain our decision as required by law.

Rights of Other People

Your data-protection rights do not automatically override the privacy, confidentiality or legal rights of other individuals.

For example, a coaching record, group discussion or email chain may contain personal data concerning multiple people.

Where necessary, we may redact third-party information or take other appropriate steps before responding to a request.

Complaints to Us

If you have concerns about how Rhianna Jones Co has collected, used, stored, disclosed or otherwise processed your personal data, we encourage you to contact us so that we have an opportunity to investigate and respond.

Please contact:

hello@rhiannajones.co

You are not required to complain to us before exercising your right to contact the relevant supervisory authority.

Right to Complain to the ICO

You have the right to make a complaint to the Information Commissioner's Office (“ICO”), the UK supervisory authority for data protection.

The ICO provides information about data-protection rights and its complaints process through its official website.

Information Commissioner's Office – Make a Complaint (https://ico.org.uk/make-a-complaint/)

Making a complaint to Rhianna Jones Co does not remove or restrict your right to complain to the ICO or pursue any other remedy available under applicable law.

22. How to Exercise Your Rights

If you wish to exercise any of the data-protection rights described in Individual Rights, you can contact Rhianna Jones Co directly.

How to Make a Request

Requests should be sent to:

Rhianna Jones Co

 Email: hello@rhiannajones.co

You do not need to use a particular form or legal terminology.

To help us locate the relevant information and respond efficiently, please provide:

• your full name;

• the email address or other contact details associated with your relationship with us;

• the right you wish to exercise or what you would like us to do;

• sufficient information to identify the personal data concerned; and

• any other information reasonably necessary to understand the request.

You are not required to provide information which is irrelevant to your request.

Identity Verification

We have a responsibility to ensure that personal data is not disclosed, changed or deleted at the request of an unauthorised person.

Where we have reasonable doubts concerning the identity of the person making a request, we may ask for additional information reasonably necessary to confirm their identity.

The level of verification required will depend upon factors including the nature and sensitivity of the information requested and the information we already hold.

We will not request excessive identification information or use identity verification to unnecessarily delay or obstruct the exercise of your rights.

Requests Made on Your Behalf

You may authorise another person to exercise your data-protection rights on your behalf.

Where a representative makes a request, we may ask for reasonable evidence that they have authority to act for you and may also take appropriate steps to verify your identity.

Response Time

We will respond to valid requests without undue delay and ordinarily within one month of receiving the request.

Where permitted by applicable data-protection law, we may extend the response period by up to a further two months where necessary because of the complexity or number of requests.

If an extension is required, we will inform you within the initial one-month period and explain why additional time is required.

Where we reasonably require additional information to verify your identity or clarify a request, the applicable statutory rules concerning the response period will apply.

Clarifying a Request

If a request is unclear or particularly broad, we may ask you to clarify the information or processing activities to which your request relates.

We will not require unnecessary narrowing of a request simply for our own convenience.

Where appropriate, we may provide information about the personal data or systems we process to help you clarify the scope of your request.

Fees

You will normally not be charged for exercising your data-protection rights.

Where a request is manifestly unfounded or excessive, particularly because it is repetitive, we may, where permitted by law:

• charge a reasonable fee based upon the administrative costs of responding; or

• refuse to act on the request.

If we intend to charge a fee or refuse a request, we will explain the reason as required by law.

Where We Cannot Fully Comply

Data-protection rights are not absolute.

There may be circumstances where we cannot comply with all or part of a request because:

• information must be retained to comply with a legal obligation;

• information remains necessary for the establishment, exercise or defence of legal claims;

• disclosure would adversely affect the rights and freedoms of another person;

• legal privilege applies;

• an applicable statutory exemption applies; or

• another lawful reason permits or requires continued processing.

Where we cannot comply with a request, or can comply only partially, we will explain the relevant reason where required by law and inform you of any applicable rights to complain or seek a remedy.

Requests Involving Other People

Some records may contain personal data relating to more than one individual.

This may arise particularly in:

• group coaching;

• WhatsApp or Facebook Groups;

• email chains;

• recordings or transcripts;

• coaching discussions involving other people; or

• complaints and disputes.

Where responding to your request could disclose another person's personal data, we will consider both individuals' rights and may redact, restrict or withhold certain information where appropriate and legally permitted.

Erasure Requests & Existing Records

A request for deletion does not automatically require immediate deletion of every record associated with you.

We may need to retain limited information for purposes including:

• tax and accounting obligations;

• contractual records;

• fraud prevention;

• payment recovery;

• active complaints or disputes;

• chargebacks;

• legal obligations; or

• the establishment, exercise or defence of legal claims.

Where only part of the information remains necessary, we may delete information which is no longer required while retaining the minimum information which remains lawfully necessary.

Our retention approach is explained in Data Retention.

Marketing Requests

You do not need to submit a formal data-protection request simply to stop receiving marketing emails.

You may unsubscribe using the unsubscribe mechanism contained within the relevant marketing communication or contact:

hello@rhiannajones.co

Where you object to direct marketing, we will stop processing your personal data for that purpose.

We may retain limited information on a suppression list to ensure that your opt-out continues to be respected.

Withdrawal of Consent

Where we rely upon your consent, you may withdraw that consent by contacting:

hello@rhiannajones.co

Where a more direct mechanism is available — such as marketing preferences or an unsubscribe function — you may also use that mechanism.

Withdrawal will not affect processing which was lawful before consent was withdrawn or processing which continues under a separate valid lawful basis.

Keeping Your Information Accurate

You may contact us at any time if you believe personal data we hold about you is inaccurate or incomplete.

Where appropriate, we will correct or complete the information and consider whether any relevant recipient should also be informed of the correction.

Complaints

If you are dissatisfied with how we have handled your personal data or responded to a rights request, you may contact us at:

hello@rhiannajones.co

You also have the right to complain to the Information Commissioner's Office (“ICO”), and you do not have to raise the matter with us first.

Information Commissioner's Office – Make a Complaint (https://ico.org.uk/make-a-complaint/)

Nothing in this Privacy Policy is intended to restrict any data-protection right or remedy available to you under applicable law.

23. Data Protection Complaints & the ICO

Rhianna Jones Co takes concerns about the handling of personal data seriously.

If you believe that we have not handled your personal data appropriately or have failed to comply with applicable data-protection law, you have the right to raise a data-protection complaint with us.

You also have the right to complain to the Information Commissioner's Office (“ICO”), the UK's independent supervisory authority for data protection.

Complaining to Rhianna Jones Co

A data-protection complaint may concern matters including:

• how we collected or obtained your personal data;

• how we have used or disclosed it;

• the lawful basis relied upon;

• the accuracy of information we hold;

• how long information has been retained;

• the security of your personal data;

• a suspected personal-data breach;

• direct marketing;

• cookies or tracking technologies;

• the handling of Special Category Data;

• AI-assisted processing;

• an international data transfer;

• how we responded to a data-protection rights request; or

• another concern about our compliance with data-protection law.

You do not need to use legal terminology or identify a particular provision of the UK GDPR or Data Protection Act in order to make a complaint. The ICO expressly recognises that individuals do not need to quote legislation when raising a data-protection complaint.

How to Make a Complaint

Please send data-protection complaints to:

Rhianna Jones Co

 Email:hello@rhiannajones.co

Please provide enough information for us to understand:

• who you are;

• what has happened;

• what personal data or processing you are concerned about;

• when the relevant events occurred, where known; and

• what you would like us to investigate or address.

You may also provide relevant supporting information or correspondence.

We may request additional information where reasonably necessary to understand the complaint, investigate it or verify your identity.

How We Will Handle Your Complaint

When we receive a data-protection complaint, we will take appropriate steps to consider and respond to it.

Depending upon the circumstances, this may include:

• acknowledging the complaint;

• identifying the relevant processing activity;

• reviewing relevant records and systems;

• making appropriate internal enquiries;

• obtaining information from relevant personnel or providers;

• considering the applicable lawful basis and data-protection requirements;

• assessing whether corrective action is required;

• keeping you appropriately informed; and

• communicating the outcome of our consideration.

Under current UK requirements, organisations must acknowledge receipt of a data-protection complaint within 30 days, take appropriate steps to respond without undue delay, keep the complainant informed about progress, and communicate the outcome without undue delay.

Complaints & Rights Requests Can Be Separate

A data-protection complaint may also contain a request to exercise one of your individual rights.

For example, you may complain about how information has been handled while also asking us to provide access to, correct or erase personal data.

Where appropriate, we will identify and deal with the different elements under the applicable legal requirements.

The procedures for exercising your individual rights are explained in Individual Rights and How to Exercise Your Rights.

Complaining to the ICO

You have the right to raise concerns with the Information Commissioner's Office (“ICO”) about our processing of your personal data.

The ICO recommends that individuals generally give the organisation concerned an opportunity to address the issue first. However, your ability to contact the ICO is not dependent upon Rhianna Jones Co agreeing with your complaint or providing the outcome you wanted.

You can find the ICO's current complaints process here:

Information Commissioner's Office – Make a Complaint (https://ico.org.uk/make-a-complaint/)

The ICO may assess a complaint and determine the appropriate extent of its involvement. Its current framework provides for complaints to be considered individually, with some requiring further enquiries and others being recorded without a more detailed investigation.

ICO Contact Details

The Information Commissioner's Office can currently be contacted at:

Information Commissioner's Office

 Wycliffe House

 Water Lane

 Wilmslow

 Cheshire

 SK9 5AF

Helpline: 0303 123 1113

Current contact and complaint information should be checked through the ICO's official website because its procedures and contact arrangements may change.

No Retaliation for Exercising Your Rights

Rhianna Jones Co will not terminate a Client's Programme access, withhold a purchased service or otherwise disadvantage an individual simply because they have made a legitimate data-protection complaint or exercised a legal data-protection right.

This does not prevent us from taking action independently permitted under an applicable Agreement for unrelated matters such as non-payment, contractual breach, abusive conduct or misuse of our services.

Records of Complaints

We may retain appropriate records concerning data-protection complaints and how they were handled for purposes including:

• investigating and responding to the complaint;

• demonstrating compliance with our legal obligations;

• identifying recurring data-protection issues;

• improving our practices;

• responding to the ICO or another competent authority; and

• establishing, exercising or defending legal claims.

Complaint records will be handled in accordance with the retention principles described in Data Retention.

Other Legal Remedies

Making a complaint to Rhianna Jones Co does not prevent you from contacting the ICO or exercising another right or remedy available to you under applicable law.

Similarly, contacting the ICO does not necessarily prevent you from pursuing other legal remedies which may be available.

Nothing in this Privacy Policy is intended to restrict your statutory data-protection rights.

24. Children & Young People

Rhianna Jones Co's paid coaching, mentoring, memberships, digital Programmes and other Client services are intended for individuals aged 18 or over, unless we expressly state otherwise in relation to a particular service.

Our services are not designed or marketed as services for children.

Paid Programmes & Services

You must generally be at least 18 years old to purchase or enter into an Agreement for our paid coaching, Programmes, memberships or services.

Where a particular service is expressly made available to someone under 18, we will consider the additional contractual, safeguarding and data-protection requirements applicable to that individual before processing their personal data.

Nothing in this Privacy Policy should be interpreted as representing that our ordinary paid services are available to children merely because UK data-protection law contains rules governing children's personal data.

Incidental Website Access

Our websites, social media content and publicly available online materials may potentially be viewed by people under 18 even though our paid services are intended for adults.

The fact that someone under 18 can technically access a public website or social media page does not mean that Rhianna Jones Co intentionally offers its paid coaching or Programmes to them.

However, UK children's-data requirements can apply to online services that are likely to be accessed by children, even where children are not the intended audience. We will therefore consider those requirements where they are applicable to a particular online service we provide.

Personal Data Received From Someone Under 18

We may occasionally receive personal data relating to someone under 18 incidentally.

For example, a young person may:

• visit our website;

• interact with publicly available social media content;

• submit an enquiry or form;

• contact us by email or another communication channel; or

• be mentioned by an adult Client during coaching or other communications.

Where we become aware that we are processing a child's personal data, we will consider the nature of the information, the purpose of processing, the child's age and circumstances and the requirements of applicable data-protection law.

Children have data-protection rights in their own right, and their personal data requires particular protection.

Information About Children Shared by Adult Clients

Adult Clients may sometimes voluntarily disclose information concerning their children, family members or other young people during coaching, forms, communications or Programme participation.

Where that information identifies a child, it may constitute the child's personal data even though the child provided none of the information directly.

We therefore aim to apply data-minimisation principles and encourage Clients not to provide unnecessary identifying information about children where the coaching or business purpose can reasonably be achieved without it.

Where such information includes Special Category Data, the additional requirements described in Coaching Information & Special Category Data apply.