How Jacqueline Leake collects, uses and protects personal information

Controller: Jacqueline Leake

Website: www.jacquelineleake.com

Last updated: 12 August 2026

This notice explains what personal information I collect, why I use it, who I share it with, how long I keep it and the rights you have. It applies to website visitors, subscribers, prospective clients, clients, training participants and other people who interact with my business.

I use artificial intelligence tools in parts of my work, but I do not use solely automated decision-making that produces legal or similarly significant effects about you. Human judgement remains part of my work. More detailed information about my use of AI is available in my AI and Data Use Notice, available through my website or on request.

1. Who is responsible for your information?

Jacqueline Leake is the controller responsible for the personal information described in this notice.

Contact details

Email: jacqueline@jacquelineleake.com
Postal address: 41 Station Road, Higham on the Hill, Nuneaton CV13 6AG
ICO registration number: ZA270534

Please tell me if your contact information changes so that I can keep my records accurate.

2. The information I collect and why I use it

The information collected depends on how you interact with me. I only collect information that is relevant to the activity concerned.

Enquiries and communications

Information: Your name, contact details, the content of messages, social media communications and relevant background information you choose to provide.

Purpose: To respond to you, keep appropriate records, provide requested information and establish, exercise or defend legal claims.

Lawful basis: Legitimate interests, namely operating my business, responding to communications and protecting my legal position. Steps requested before entering into a contract may also apply.

Bookings, discovery calls and meetings

Information: Your name, email address, organisation, booking details, calendar information, meeting attendance, and information you share during a call.

Purpose: To arrange and deliver calls, understand your requirements, prepare follow-up actions and maintain an appropriate record of the discussion.

Lawful basis: Steps requested before entering into a contract; performance of a contract; and legitimate interests in administering meetings and maintaining accurate business records.

Meeting recordings and transcripts

Information: Audio, video, transcripts, summaries, attendance information and meeting notes created through Google Meet and Fathom.

Purpose: To create accurate notes, deliver agreed follow-up, support client work, improve service quality and avoid relying solely on handwritten notes.

Lawful basis: Legitimate interests, where recording is necessary and proportionate, and consent where required. Participants are notified that Fathom is present and can raise concerns or request an alternative.

Client and project information

Information: Contact and identity information, contracts, project briefs, documents, business information, correspondence, deliverables and information needed to provide the service.

Purpose: To enter into and perform contracts, deliver training and consultancy, build or configure AI tools, manage projects, provide support and protect legal rights.

Lawful basis: Performance of a contract; steps before a contract; legitimate interests; and legal obligation where relevant.

Payments and financial administration

Information: Billing details, invoices, transaction references, payment status and limited payment information received from payment providers. I do not normally receive or store your full card number.

Purpose: To take payment, issue invoices, maintain accounting records, manage refunds and comply with tax and accounting duties.

Lawful basis: Performance of a contract and legal obligation.

Newsletter and direct marketing

Information: Your name, email address, business information, marketing preferences, sign-up source, consent record and engagement with messages.

Purpose: To send requested newsletters, resources, service information and relevant marketing, and to understand whether communications are useful.

Lawful basis: Consent for newsletter sign-ups and individual subscribers; legitimate interests where permitted for existing customers and corporate business contacts. The Privacy and Electronic Communications Regulations also apply.

Website and analytics

Information: IP address, device and browser information, approximate location, pages visited, referral source, interaction data, identifiers and cookie choices.

Purpose: To operate and secure the website, understand use, improve content, measure campaigns and, where you consent, deliver or measure advertising.

Lawful basis: Legitimate interests for essential security and administration; consent for non-essential analytics and advertising technologies unless a lawful exception applies.

Testimonials, reviews and event content

Information: Your name, business, testimonial, review, image, audio or video where agreed.

Purpose: To demonstrate experience, promote services and share training or event content.

Lawful basis: Consent or legitimate interests, depending on the context and what a person would reasonably expect.

Complaints and rights requests

Information: Identity and contact information, complaint or request details, supporting evidence, correspondence and the outcome.

Purpose: To investigate and respond, verify identity where necessary, demonstrate compliance and protect legal rights.

Lawful basis: Legal obligation and legitimate interests.

3. Special category information

Some personal information receives additional legal protection. This includes information about health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric identification data, sex life and sexual orientation.

My services do not normally require this information. However, a person may occasionally mention it during a meeting, include it in correspondence or provide it within a document. Please avoid sharing special category information unless it is genuinely relevant.

If it is provided unexpectedly and is not needed, I will, where practicable, minimise, redact or delete it. If it is necessary to retain or use it, I will identify an appropriate condition under Article 9 of the UK GDPR. This may include obtaining explicit consent or using the information where necessary for the establishment, exercise or defence of legal claims.

4. Information about other people

Please do not give me personal information about another person unless you are authorised to do so and it is necessary for the relevant work. If client material contains information about third parties, the client remains responsible for ensuring that it has a lawful basis to provide that information and has given any required privacy information.

5. How I collect information

I may collect personal information:

• directly from you when you contact me, book a call, subscribe, attend training, buy a service, complete a form or work with me;
• through Google Meet, Fathom, TidyCal, MailerLite and other services used to arrange and deliver business activities;
• automatically through cookies and similar technologies when you use the website;
• from payment, accounting and business administration providers;
• from organisations that introduce or commission work; and
• from public professional sources such as business websites, LinkedIn and Companies House, where it is reasonable and relevant to business communication or due diligence.

When I obtain your information from another source, I provide privacy information within the period required by law, unless an exception applies.

6. AI-assisted processing

I may use AI services, including OpenAI, Anthropic Claude, Perplexity and Wispr Flow, to assist with drafting, analysis, research, transcription, summarisation, content development and the creation or configuration of AI tools. Airtable may also be used to organise project or business information.

I apply data minimisation and avoid entering personal information into an AI service when it is not needed. Where client information is required for agreed work, I use suitable account controls and service settings, consider the sensitivity of the material, and remain responsible for reviewing the output. AI output can be incomplete or inaccurate and is not treated as an authoritative decision about a person.

I do not use solely automated processing to make decisions about you that produce legal or similarly significant effects. If that changes, this notice and the relevant process will be updated before that processing begins.

7. Marketing

You can unsubscribe from marketing emails at any time by using the unsubscribe link in the message or emailing me. Withdrawing marketing consent does not affect service, transaction or legal communications.

For individuals, sole traders and certain partnerships, I send electronic marketing where I have consent or where the requirements of the customer soft opt-in are met. For limited companies and other corporate subscribers, consent is not always required under PECR, but named business contacts still have data-protection rights and every marketing message provides a way to opt out.

I maintain a suppression record when someone opts out so that I can respect the request. I do not sell personal information or share it with another organisation for that organisation’s independent marketing without permission.

8. Cookies, analytics and advertising

The website uses essential technologies needed for security and operation. It also uses or may use Google Analytics, the Meta Pixel, an embedded TidyCal booking calendar and MailerLite forms or pop-ups.

Non-essential analytics and advertising technologies are not used until the required choice has been made, unless the use meets a specific legal exception. You can change your choices using the website’s cookie controls. Details of individual technologies, providers, purposes and durations are set out in the Cookie Policy available through the website footer.

9. Who receives personal information

I use service providers where they are reasonably necessary to run the website and business or deliver agreed work. Depending on your interaction with me, these may include:

• Google, for Google Workspace, email, cloud storage, Google Meet and Google Analytics;
• Fathom, for meeting recording, transcription, summaries and notes;
• TidyCal, for bookings and embedded appointment scheduling;
• Stripe, for card payments and payment administration;
• Xero, for accounting and financial administration;
• MailerLite, for mailing lists, forms, pop-ups, landing pages and email campaigns;
• Airtable, for organised business and project records;
• OpenAI, Anthropic, Perplexity and Wispr Flow, where AI-assisted processing is appropriate;
• Meta, for the Meta Pixel and advertising measurement where you consent;
• website hosting, WordPress, Elementor, IT support and security providers;
• professional advisers such as accountants, insurers and lawyers; and
• public authorities or regulators where disclosure is required or permitted by law.

Where a supplier acts as my processor, it may only process the information for the contracted purpose and under appropriate data-protection terms. Some suppliers also process limited information as independent controllers for matters such as fraud prevention, account security or their own legal obligations.

10. International transfers

Some suppliers process or make personal information accessible outside the United Kingdom, including in the United States. An international transfer can include remote access from another country, not only the physical movement of a file.

Where the UK GDPR restricted-transfer rules apply, I use an available lawful transfer mechanism. Depending on the supplier and transfer, this may include:

• UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework where the particular US recipient is actively certified for the relevant information;
• the UK International Data Transfer Agreement;
• the EU Standard Contractual Clauses together with the UK International Data Transfer Addendum; or
• another safeguard or limited exception permitted by the UK GDPR.

Where contractual safeguards are used, I assess the transfer as required and consider whether additional technical or organisational measures are needed. You can ask for more information about the safeguard relevant to your information.

11. How long I keep information

I keep personal information only for as long as it is reasonably needed for the purpose for which it was collected, including legal, accounting, reporting and dispute-resolution requirements. The usual periods are set out below.

These are normal periods, not guarantees that every record will be kept for the full period. Information may be deleted sooner when it is no longer needed, or retained longer where required for a dispute, legal hold, safeguarding concern or other lawful reason.

12. Security

I use appropriate technical and organisational measures designed to protect personal information against accidental or unlawful loss, alteration, disclosure, access or destruction. Measures include access controls, secure accounts, appropriate device and account security, supplier due diligence, backups where appropriate and limiting access to people who have a genuine business need.

No online service can be guaranteed completely secure. If a personal data breach occurs, I assess it and notify the Information Commissioner’s Office and affected people where the law requires this.

13. Your rights

Depending on the circumstances, you may have the right to:

• be informed about how your personal information is used;
• ask for access to your personal information;
• ask for inaccurate information to be corrected;
• ask for information to be erased;
• ask for use of information to be restricted;
• object to processing based on legitimate interests and object at any time to direct marketing;
• receive certain information in a portable format;
• withdraw consent at any time where processing relies on consent; and
• raise a complaint about the use of your information.

These rights are not absolute and do not all apply in every situation. To exercise a right, email jacqueline@jacquelineleake.com. I may ask for information needed to confirm your identity, but I will not request disproportionate identification.

There is normally no fee. A reasonable fee may be charged, or a request may be refused, where the law permits this, including where a request is manifestly unfounded or excessive. I normally respond without undue delay and within one month. Where clarification is reasonably required, the response period may be paused while I wait for it.

14. Data protection complaints

If you are concerned about how I have collected, used, stored or shared your personal information, or about how I have handled a rights request, please contact me at jacqueline@jacquelineleake.com.

My Data Protection Complaints Notice explains how to make a complaint, how it will be acknowledged and investigated, and how you will be told the outcome. It is available through my website or on request.

You can also complain to the Information Commissioner’s Office, the UK’s independent data protection regulator. You do not have to contact me before contacting the ICO, although I welcome the opportunity to address a concern.

ICO website: ico.org.uk/make-a-complaint  |  Helpline: 0303 123 1113

15. Children

My website and services are intended for adults and business users. I do not knowingly collect personal information from children through the website. If you believe a child has provided personal information to me, please contact me so that I can investigate and take appropriate action.

16. Third-party websites

The website may link to third-party websites, applications or services. Those organisations are responsible for their own privacy information and practices. Please read their privacy notices when you follow an external link or use an embedded service.

17. Changes to this notice

I review this notice at least annually and when my services, suppliers or legal obligations change. The date at the top and foot of the notice shows when it was last updated. If a change materially affects how I use information already collected, I will take reasonable steps to bring it to the attention of the people affected.

Useful official guidance

ICO: Right to be informed

ICO: Data (Use and Access) Act 2025 guidance

ICO: International transfers

ICO: Storage and access technologies

ICO: Electronic mail marketing