Privacy Policy
1.1 This website, https://www.madalainemunro.com, is run by Madalaine Munro, a sole trader, whose business address is 37 Carters Way, United Kingdom ("We", "Us" and "Our").
1.2 We are the data controller for the personal information described in this policy. This means We decide how and why it is used, and We are responsible for keeping it safe.
1.3 We are registered with the Information Commissioner's Office (ICO) under registration number
1.4 If you have any questions about this policy or your personal information, please email info@madalainemunro.com.
1.5 This policy applies to Our website, Our free resources and newsletter, and the coaching, therapeutic and educational programmes We offer ("Programmes"). It should be read alongside Our Website Terms of Use and Our Standard Terms and Conditions.
2. What information we collect
2.1 Depending on how you interact with Us, We may collect:
Contact details: your name, email address, phone number and, where needed, your postal address.
Account details: your login details and activity on the Platform (IVOREY) if you join a Programme.
Payment details: what you bought, when, and how you paid. Card payments are handled by Stripe, so We never see or store your full card number.
Application and booking details: what you tell Us on application forms, discovery calls and booking forms, such as your relationship history and what you want support with.
Session information: what you share during coaching or therapy sessions, group calls and voice notes, and the notes We take during and after sessions.
Communications: emails, WhatsApp messages, voice notes and other messages you send Us.
Marketing preferences: whether you have signed up for Our newsletter or free resources, and which emails you open or click.
Website data: your IP address, browser and device type, the pages you visit and how you found Our Site, collected through cookies (see Clause 8).
2.2 Sensitive information. Because of the nature of Our work, you may share information about your physical or mental health, your sex life or your sexual orientation. The law calls this special category data, and We give it extra protection, as set out in Clause 3.3.
2.3 We collect most of this information directly from you. Some comes from the services We use, such as Stripe confirming a payment or Meta telling Us that you responded to one of Our adverts.
2.4 Our services are only for adults. We do not knowingly collect information from anyone under 18.
3. How and why we use your information
3.1 We only use your personal information when the law allows it. The table below sets out each use and its lawful basis under the UK GDPR.
What We use it for
Lawful basis
Providing sessions, Programmes and access to the Platform
Contract: We need it to provide what you have booked
Taking payments, issuing receipts and managing instalment plans
Contract
Keeping financial records and filing tax returns
Legal obligation
Replying to your enquiries and messages
Legitimate interests: running Our business and answering you
Sending Our newsletter and marketing emails
Consent, which you can withdraw at any time
Sending important service emails, such as changes to a Programme
Contract or legitimate interests
Running and improving Our Site, and keeping it secure
Legitimate interests
Showing you relevant adverts through Meta (Facebook and Instagram)
Consent, given through Our cookie banner
Dealing with complaints, disputes or legal claims
Legitimate interests or legal obligation
3.2 Where We rely on legitimate interests, We have weighed them against your rights and expectations. You can object at any time (see Clause 7).
3.3 Sensitive information. We only use information about your health, sex life or sexual orientation to provide your sessions and Programmes safely and well. We do this with your explicit consent, which We ask for when you book or join a Programme. You can withdraw that consent at any time, although We may then be unable to keep working with you. We may also use it without consent where the law allows, for example to protect you or someone else from serious harm.
3.4 We never sell your personal information, and We do not use sensitive information for marketing or advertising.
3.5 We do not make decisions about you using only automated means.
4. Who we share your information with
4.1 We only share your information with trusted service providers who help Us run Our business. They may only use it to provide their service to Us, and they must keep it secure.
Provider
What they do for Us
IVOREY
Hosts Our Programmes, courses, client accounts and Our newsletter emails
Stripe
Processes card payments and instalment plans
Google (Gmail, Google Drive, Google Calendar)
Email, file storage and booking sessions
Zoom
Online sessions and group calls
Messages and voice notes between sessions, where you choose to use it
Meta (Facebook and Instagram)
Advertising, where you have agreed to marketing cookies
Our accountant [and bookkeeper]
Keeping Our financial records and tax returns
4.2 We may also share information with an ads specialist or other freelancer who helps Us, but only what they need, and only under a written agreement.
4.3 We will share information if the law requires it, if We need to protect your safety or someone else's, or if We need to establish or defend a legal claim.
4.4 Group Programmes are confidential spaces. We ask every member not to share anything about other members outside the group, but We cannot control what other members do.
5. International transfers
5.1 Some of Our providers, including Google, Stripe, Zoom and Meta, store or process data outside the UK, mainly in the United States. Where this happens, We make sure there are proper safeguards, such as the UK Extension to the EU–US Data Privacy Framework or the ICO's International Data Transfer Agreement or Addendum.
6. How long we keep your information, and how we keep it safe
Information
How long We keep it
Client records and session notes
7 years after We stop working together, then securely deleted
Payment and financial records
6 years after the end of the tax year they relate to, as the law requires
Enquiries from people who do not become clients
12 months
Newsletter subscriptions
Until you unsubscribe, then removed from Our list
Website and cookie data
Up to 13 months, or as set out in Clause 8
6.1 We keep your information secure with password-protected accounts, two-factor authentication where available, and access limited to Us and the providers listed in Clause 4. Session notes are stored in Google Drive, which is protected by two-factor authentication, and only We can access them.
6.2 No online system is completely secure. If a data breach is likely to put your rights at risk, We will tell you and the ICO as the law requires.
7. Your rights
7.1 Under data protection law, you have the right to:
Be informed about how your information is used, which is what this policy is for.
Access a copy of the information We hold about you.
Correct anything that is inaccurate or incomplete.
Have it deleted, unless We need to keep it, for example for tax records.
Restrict how We use it.
Object to Us using it, including for marketing at any time.
Move it to another provider in a commonly used format.
Withdraw consent at any time, where We rely on consent.
7.2 To use any of these rights, email info@madalainemunro.com. It is free, and We will reply within one month. If your request is complex, We may need up to two months more, and We will tell you if so. We may ask you to confirm your identity first.
7.3 If you are unhappy with how We have handled your information, please contact Us first so We can try to put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
8. Cookies
8.1 Cookies are small text files that a website saves on your device. They help a site work, remember your choices and show how people use it.
8.2 We use these types of cookies:
Type
What it does
Needs your consent?
Strictly necessary
Makes Our Site and the Platform work, for example keeping you logged in and processing payments securely
No
Functional
Remembers your choices, such as your cookie settings
No
Analytics
Shows Us how visitors use Our Site so We can improve it, for example [Google Analytics]
Yes
Marketing
Lets Meta show you Our adverts and tells Us how well they work, using the Meta Pixel, which is installed on some pages of Our Site
Yes
8.3 When you first visit Our Site, a banner asks which cookies you are happy for Us to use. We only set analytics and marketing cookies if you agree. You can change your mind at any time through [the cookie settings link at the bottom of every page].
8.4 You can also block or delete cookies in your browser settings. If you block strictly necessary cookies, parts of Our Site and the Platform may not work.
8.5 Some cookies are set by third parties, such as Stripe, IVOREY, Google and Meta. Their own privacy policies explain how they use the information.
9. Changes to this policy
We may update this policy from time to time. The latest version will always be on Our Site, with the date it was last updated at the top. If We make a significant change, We will let current clients know by email.