Privacy Notice

Last updated:

This notice explains what personal data The Executive Coaching Alliance collects, why we collect it, how we look after it, and what rights you have over it. We have tried to write it in plain language. If anything is unclear, please get in touch.

1. Who we are

The Executive Coaching Alliance is a collective of independent executive coaches. The data controller is:

Daniel Margetts
The Executive Coaching Alliance
Email: our contact form
ICO registration number: [YOUR-ICO-NUMBER]

Daniel Margetts is registered with the UK Information Commissioner’s Office (ICO) as a data controller and is based in the Netherlands. Both EU GDPR and UK GDPR apply to our processing activities.

2. What data we collect and why

We collect three categories of personal data, each with a distinct purpose.

Coach profile data

When a coach joins the collective and creates their profile, we collect:

• Name, professional title and qualifications
• Contact email address and telephone number
• Website, LinkedIn and online booking page URLs
• Profile photo (via URL you provide)
• Professional biography, coaching philosophy and career summary
• Years of professional experience
• Coaching qualifications and certifications, including dates obtained
• Industry specialisms, coaching approaches, focus areas and seniority levels

This data is used to build your public-facing profile on the site and to contribute to the collective’s shared “Who We Are” and “Philosophy” content.

Legal basis: Performance of a contract — by accepting your invitation to join the collective, you enter into an arrangement with us under which publishing your profile is a core element. We process this data to fulfil that arrangement.

Account authentication data

We use Netlify Identity to manage coach login accounts. This processes your email address and a hashed password to authenticate you to the coach portal. We do not see or store your password in plain text.

Legal basis: Legitimate interests — secure access control is a necessary and proportionate measure to protect both your data and the integrity of the platform.

Enquiries through our contact form

If you send us a message using the Contact us form, we collect:

• Your name and email address
• Optionally, your phone number, organisation and job title
• Who the coaching is for, the topic of your enquiry, an approximate team size if relevant, and how you heard about us
• The content of your message

We use this only to respond to your enquiry. To do that, we may pass your enquiry to the coach or coaches in the Alliance best placed to help. Your message is delivered by email to our Microsoft 365 mailbox; it is not stored on the website. To limit abuse of the form, we keep a one-way hashed (non-reversible) version of the sending IP address for up to one hour.

Legal basis: Steps taken at your request before entering into a contract, and our legitimate interest in responding to people who contact us.

Retention: We keep enquiry emails for up to 12 months after our last correspondence, unless the enquiry leads to a coaching engagement, in which case the coach you work with becomes responsible for your data under their own privacy notice.

3. What we do not collect

We do not use cookies for tracking or analytics. We do not collect data from visitors to the public-facing site beyond what is standard in server access logs (IP address, browser type, pages visited), which are retained by Netlify for a short period for security purposes. Apart from enquiries you choose to send us through the contact form (described above), we do not collect any data from people who are not coaches in the collective.

4. Who we share your data with

We share personal data with the following third-party processors under written agreements:

Netlify, Inc.

Netlify hosts the website, stores coach profiles (in Netlify Blobs), and manages authentication (via Netlify Identity). Netlify is a US company. Your data is stored and processed on Netlify’s infrastructure under Standard Contractual Clauses (SCCs) approved by the European Commission and the UK adequacy framework. Netlify’s privacy policy is at netlify.com/privacy.

Anthropic, PBC

When an administrator triggers regeneration of the collective “Who We Are” and “Philosophy” sections, summaries of published coach profiles (including names and professional information) are sent to Anthropic’s API to generate the copy. Anthropic is a US company. This transfer is covered by Standard Contractual Clauses. Anthropic’s privacy policy is at anthropic.com/privacy.

Microsoft Ireland Operations Limited

Messages sent through our contact and join forms are delivered by email using Microsoft 365, and held in our Microsoft 365 mailbox. Microsoft processes this data under its Data Protection Addendum. Microsoft’s privacy statement is at privacy.microsoft.com.

We do not sell your data to any third party. We do not share it with any party other than those listed above.

5. International data transfers

Both Netlify and Anthropic are based in the United States. Transfers of personal data to them are made under Standard Contractual Clauses (Article 46(2)(c) EU GDPR; equivalent under UK GDPR). Microsoft 365 data is processed by Microsoft Ireland Operations Limited; where Microsoft transfers it outside the European Economic Area, this is covered by Standard Contractual Clauses and the EU-US Data Privacy Framework. If you would like a copy of the relevant transfer mechanism, please contact us.

6. How long we keep your data

We retain your profile data for as long as you are a member of the collective. If you leave, we will delete your profile from the platform within 30 days of your request. Authentication records held by Netlify Identity are deleted at the same time.

Backup or log data held by Netlify may persist for a short additional period in line with their own retention policies, over which we have limited direct control.

7. Your rights

Under EU GDPR and UK GDPR you have the following rights in relation to your personal data:

• Access — you can request a copy of the data we hold about you.
• Rectification — you can correct inaccurate data directly via your profile dashboard, or ask us to correct it.
• Erasure — you can ask us to delete your data. We will do so promptly unless we have a legal obligation to retain it.
• Restriction — you can ask us to pause processing of your data in certain circumstances.
• Portability — you can ask for a copy of your data in a machine-readable format.
• Objection — you can object to processing based on legitimate interests.

To exercise any of these rights, email us at our contact form. We will respond within one month.

8. Right to complain

If you are unhappy with how we have handled your data, you have the right to complain to a supervisory authority:

• UK: Information Commissioner’s Office (ICO) — ico.org.uk/make-a-complaint
• Netherlands / EU: Autoriteit Persoonsgegevens — autoriteitpersoonsgegevens.nl

We would always prefer to resolve any concern directly first, so please do contact us before escalating.

9. Security

Access to the coach portal is protected by email-verified accounts and signed authentication tokens. Profile data is stored server-side on Netlify’s infrastructure and is not accessible without a valid authenticated session. No payment data is collected or stored anywhere on this platform.

10. Changes to this notice

We may update this notice from time to time. When we do, we will update the date at the top of this page. If any change significantly affects how we process your data, we will notify members directly by email.

11. Contact

For any questions about this notice or about how we handle your data:

Daniel Margetts
our contact form