Privacy Policy
Fire Business Services Limited Trading as Richard Hughes-Jones www.richardhughesjones.com Company number: 08571953 Registered office: 55 Rectory Grove, Leigh-on-Sea, SS9 2HA, United Kingdom
Effective from: 22 June 2026
Introduction
This Privacy Policy explains what personal information is collected by Fire Business Services Limited (“we”, “us”, “our”), how we use it, and your rights in relation to it.
Fire Business Services Limited is the controller of your personal data for the purposes of the UK General Data Protection Regulation (UK GDPR). UK data protection law is set out in the UK GDPR, the Data Protection Act 2018, and the Data (Use and Access) Act 2025 (DUAA), which received Royal Assent on 19 June 2025 and whose principal data protection provisions commenced on 5 February 2026. References in this policy to specific Articles of the UK GDPR include any modifications made by the DUAA and any subsequent amendments.
The Information Commissioner’s Office (ICO) regulates UK data protection. Further information is at https://ico.org.uk.
If you have any questions about this policy or your personal information, please contact me@richardhughesjones.com.
1. The scope of this Privacy Policy
1.1 This Privacy Policy applies when you:
- engage in a coaching chemistry call
- book and pay for coaching services
- participate in a coaching session
- consent to the recording, transcription, or AI-supported processing of a coaching session
- share documents or information for coaching or analysis
- use any Custom GPT or other client-facing AI tool made available to you under a separate written agreement
- request or provide information to us
- visit our website
- sign up to our newsletter or agree to receive marketing communications
1.2 Cookies. We use cookies on our website. See Section 11 of this policy for details about which cookies are set and how to opt out.
2. What information do we collect about you, and how?
2.1 Coaching chemistry calls
When we discuss your coaching requirements, in person or by video call, we collect information based on what you choose to tell us. This may include personal information relating to your work, life, relationships, wellbeing, aspirations, or professional challenges. Coaching conversations may touch on special category personal data within the meaning of Article 9 UK GDPR (information about health, beliefs, sexual orientation, racial or ethnic origin, political opinion, trade union membership, or genetic or biometric data). The lawful bases on which we process this information are your consent under Article 6(1)(a) for personal data, and your explicit consent under Article 9(2)(a) for special category data.
Recording and transcription. With your consent, we record chemistry calls using Fathom and Granola, AI meeting assistants that produce a written transcript. Fathom announces its presence on the call as a notification that recording is taking place; the coach also confirms verbally at the start of the call that you are comfortable being recorded, and that verbal confirmation is the consent we rely on. We have Data Processing Agreements in place with both providers. You may decline recording, in which case the call proceeds without it.
Post-call processing. After the call, any identifiable material is processed only through commercial-tier AI tools (ChatGPT Business or Gemini for Google Workspace) where the provider contractually excludes customer data from training. We use these tools to remove or generalise identifying details from the transcript. The de-identified output may then be processed in Claude Pro or Claude Max to support our follow-up with you (for example, drafting a summary email of the call or considering whether the engagement is a good fit). We do not represent the de-identified output as full anonymisation under UK GDPR.
If the chemistry call leads to a coaching engagement, the recording, transcript, and any follow-up material become part of your client file and are governed by Sections 2.3 and 4 of this policy.
If the chemistry call does not lead to an engagement, the recording and transcript are deleted within 90 days of the call.
2.2 Booking and paying for coaching
We collect personal information such as your name, contact details, and payment information.
2.3 Participating in a coaching session
When you take part in a coaching session, we collect personal information as described in 2.1.
With your consent, coaching sessions are hosted and recorded by Zoom and may be transcribed using AI meeting assistants (Fathom and Granola). These tools process personal information contained in the conversation, including special category data you voluntarily share. The transcript is copied into a Google Doc and saved in a private client folder in our Google Workspace. Access is restricted to the coach and trusted associates, including the coach’s EA, who are bound by written confidentiality agreements.
Recording is optional. You may decline recording at the outset or withdraw consent at any time, in which case recordings and transcripts already captured will be deleted unless we are legally required to retain them. The coaching engagement does not depend on recording.
2.4 When you visit our website
We collect your IP address and information about your browser and device to help improve user experience. See Section 11 for more on cookies and website hosting.
2.5 When you sign up for our newsletter or provide information
You may provide information such as your name, email address, and other contact details.
2.6 When you agree to receive marketing information
Your personal information may be stored in our contact database. You may unsubscribe at any time using the “Unsubscribe” link or by contacting me@richardhughesjones.com.
2.7 Information you choose to share for coaching purposes
You may voluntarily share additional information and documents, including:
- transcripts of conversations
- documents relating to work performance
- 360° feedback reports
- psychometric or personality assessments
- annual reviews or appraisal documents
- written reflections or self-assessments
These documents may contain personal and special category data; we process them on the basis of your consent.
During an active coaching engagement, these documents are processed using the same AI tool flow described in Section 3.2: identifiable material via commercial-tier tools (ChatGPT Business or Gemini for Google Workspace), with Claude Pro or Max used only on de-identified output. The lawful basis is the consent you gave when signing the engagement letter: consent under Article 6(1)(a) for personal data, and explicit consent under Article 9(2)(a) for special category data. This covers session transcripts and other material that identifies you.
2.8 Third-party data in coaching transcripts
Coaching transcripts often contain personal information about people other than you: colleagues, family members, clients, team members named in the course of conversation. We process this information on the basis of legitimate interests under Article 6(1)(f), supported by the confidentiality framework that surrounds the coaching relationship. We rely on Article 14(5)(b) UK GDPR for the practical impossibility of notifying every named third party. Transcripts are not shared outside the coaching dyad: they are not posted publicly, shared with sponsors, used as case studies, or otherwise exposed to third parties beyond the coach.
3. How do we use your personal information?
3.1 Lawful bases
We process personal information only where permitted by UK data protection law. The lawful bases on which we rely are:
- Consent (Article 6(1)(a)) for recording, transcription, AI-supported reflective practice, any Custom GPT or client-facing AI tool made available to you, and marketing communications.
- Explicit consent (Article 9(2)(a)) for processing of special category data by AI tools.
- Contract performance (Article 6(1)(b)) for the delivery of coaching services you have booked.
- Legitimate interests (Article 6(1)(f)) for record-keeping, fee recovery, day-to-day email administration, supplier management, and protection of our business records, including in relation to third parties named in transcripts (Section 2.8).
- Legal obligation (Article 6(1)(c)) for tax, accounting, and other statutory record-keeping.
3.2 Recording, transcription, and AI use in the coach’s reflective practice
With your consent, we record coaching sessions and use the transcripts to support the coach’s reflective practice. The output stays with the coach. It is not shared with you, with anyone else, or used as a parallel conversation about you.
AI use in reflective practice operates in two stages.
Commercial-tier tools for identifiable material. Where the session transcript or other material identifies you, we process it using ChatGPT Business and Gemini for Google Workspace. These are commercial-tier accounts where, by contract, the provider does not use customer content to train its models. Both providers operate under Standard Contractual Clauses and the UK International Data Transfer Addendum for transfers of personal data to the United States.
Consumer-tier tools for reflective work on de-identified output. Before moving material into Claude Pro or Claude Max, we take reasonable steps via ChatGPT Business or Gemini for Google Workspace to remove or generalise identifying details. The commercial-tier step handles identifiable material; the Claude Pro or Max step is used only for reflective work on the de-identified output. We do not represent this as full anonymisation under UK GDPR.
3.3 Custom GPTs and other client-facing AI tools
By default, no Custom GPT or other client-facing AI tool is part of your coaching engagement.
Where we agree separately and in writing (typically in the engagement letter or a supplementary letter), we may develop a Custom GPT hosted inside the coach’s ChatGPT Business account and made accessible to you during your engagement. The engagement letter sets out the substantive terms in each case: the plan tier used, what content is loaded as knowledge, who has access, what the tool can and cannot do, retention during and after the engagement, and end-of-engagement deletion and handover. Where the engagement letter is silent on Custom GPTs, none are in use.
You may withdraw your consent at any time, after which the relevant Custom GPT and associated data will be deleted in accordance with the engagement letter.
3.4 Other coaching-delivery and administrative uses
We may use your information to:
- deliver and manage coaching services
- process bookings, invoicing, and payments
- send newsletters where you have subscribed
- send marketing communications where you have opted in
- respond to enquiries, requests, or complaints
- maintain professional records consistent with our regulatory, professional, and tax obligations
4. For how long do we keep your personal information?
We retain personal information only for as long as necessary for the purposes for which it was collected and to meet legal and accounting obligations. The substantive retention periods are:
- Chemistry call recordings and transcripts (where no coaching engagement follows): 90 days from the date of the call. If the engagement does begin, the material moves into your client file and is governed by the periods below.
- Raw recordings and transcripts of coaching sessions: up to 12 months after your final session. After that period, raw recordings and transcripts are deleted unless we have agreed a further engagement with you or there is another lawful reason to retain them.
- Summary notes, post-session email reflections, and coaching outcomes: up to six years for professional development and business record-keeping purposes.
- Booking, invoicing, and payment records: as required by HMRC and statutory accounting rules, typically six years from the end of the relevant financial year.
- Custom GPTs and associated content (where in use): for the duration of the engagement, deleted at end of engagement unless we have agreed otherwise in writing in the engagement letter.
- Newsletter subscriber data: until you unsubscribe.
- Marketing contact data: until you withdraw consent, or three years from the last meaningful interaction, whichever is sooner.
If you have questions about retention periods that fall outside the categories above, please contact me@richardhughesjones.com.
5. How and why do we share your personal information?
5.1 Service providers
We use trusted service providers to support our services. Each is bound by contract or by published Data Processing Agreement. The table below lists providers we actively use, with the plan tier where the tier is material to your data.
| Service provider | Website | Purpose | Plan tier |
|---|---|---|---|
| WordPress | https://wordpress.com | Website hosting | Standard |
| Zoom Video Communications, Inc. | https://zoom.us | Hosting and recording coaching sessions | Standard paid |
| Fathom AI Notetaker | https://fathom.video | Optional session recording, transcription, summaries | Standard paid; user-level training opt-out applied |
| Granola | https://granola.ai | Optional session recording, transcription, summaries | Standard paid; user-level training opt-out applied |
| Google Workspace (Google Drive, Google Docs, Gmail) | https://workspace.google.com | Transcript and note storage, email communication | Business Standard |
| Gemini for Google Workspace | https://workspace.google.com | AI-supported reflective practice on identifiable material | Commercial-tier; provider does not train on customer data |
| OpenAI (ChatGPT) | https://openai.com | AI-supported reflective practice on identifiable material; any Custom GPT made available to you under separate written agreement | ChatGPT Business; provider does not train on customer data |
| Anthropic (Claude) | https://claude.ai | AI-supported reflective practice on de-identified output | Claude Pro or Claude Max; training opt-out applied |
| Calendly | https://calendly.com | Scheduling | Standard paid |
| Xero | https://www.xero.com | Invoicing and accounting | Standard paid |
| Substack | https://www.substack.com | Newsletter distribution | Standard |
This list reflects the providers we actively use as of the effective date of this policy. We update it when providers change and notify you where the change is material.
Some providers in this table (notably Fathom and Granola) rely on their own LLM subprocessors, including OpenAI and Anthropic, to deliver transcript and summary generation. These subprocessor relationships are governed by each provider’s published Data Processing Agreement and subprocessor list.
5.2 Cloud storage
Some personal information is stored in secure cloud environments operated by the providers listed above.
5.3 Other sharing circumstances
We may share information where:
- you have given explicit consent
- it is required for legal proceedings
- it is necessary to exercise legal rights
- you have given consent for sharing in connection with partnered or jointly hosted events you have signed up to
5.4 International transfers
Several of the providers we use are based in the United States or process personal information there, including Zoom, Fathom, Granola, OpenAI, Anthropic, and (depending on configuration) parts of Google Workspace and Gemini for Google Workspace.
For these transfers we rely on:
- Standard Contractual Clauses (SCCs) as approved by the European Commission, incorporated into the relevant Data Processing Agreement; and
- The UK International Data Transfer Addendum to the EU SCCs, which modifies the EU SCCs for transfers under UK law.
Where the provider is also certified under the UK Extension to the EU-US Data Privacy Framework, we note that certification, but our reliance is on the SCCs and the UK Addendum above. We do not rely on the Data Privacy Framework as the sole transfer route.
We keep our international transfer arrangements under proportionate review consistent with the DUAA’s reasonable-and-proportionate standard and current ICO guidance.
5.5 Professional supervision
As part of responsible coaching practice, the coach may discuss client work with their professional supervisor. Identifying details are normally minimised, but the coach may use your name where it is appropriate and proportionate for supervision. The supervisor is bound by their own professional confidentiality. The lawful bases for this processing are legitimate interests under Article 6(1)(f) for ordinary personal data and explicit consent under Article 9(2)(a) for any special category data discussed, given by you when signing the engagement letter.
6. How do we keep your personal information secure?
We use up-to-date security measures to protect your personal information.
6.1 General security measures
- Encrypted storage
- Password-protected systems
- Use of password managers
- Access restricted to authorised personnel under written confidentiality agreements
6.2 Recording and transcript security
Where sessions are recorded, recordings and transcripts are stored within Zoom, the relevant notetaking tool, and Google Workspace. They are accessible only to the coach and trusted associates and are deleted when the retention period in Section 4 expires or upon your request.
6.3 Internet transmission
No internet transmission is completely secure; we take proportionate steps to protect your information.
7. Third-party sites
Our website may contain links to sites we do not control. You should review their privacy policies separately.
8. Your legal rights in relation to your personal information
You have rights under UK GDPR (as modified by the Data (Use and Access) Act 2025), including the right to:
- access the personal information we hold about you (Article 15)
- request correction of inaccurate information (Article 16)
- request deletion of your personal information, subject to lawful exceptions (Article 17)
- restrict or object to processing (Articles 18 and 21)
- request transfer of your information to another provider (Article 20)
- withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal (Article 7(3))
- rights related to certain forms of significant automated decision-making, including information, the ability to make representations, the right to human intervention, and the right to contest (Articles 22A to 22D)
- complain to the Information Commissioner’s Office (see Section 9 below)
Where coaching sessions have been recorded or where AI tools (including any Custom GPT made available to you) have been used, you may also request:
- deletion of recordings, transcripts, or GPT-related data
- withdrawal of consent for any future use
- confirmation of how your data has been processed by any third-party tool
To exercise these rights, please contact me@richardhughesjones.com. We will respond within one month under Article 12 UK GDPR. Where the request is complex or numerous, the period may be extended by up to two further months; we will tell you about any extension within the first month. Where we reasonably require further information from you to identify or scope the request, the period for response is paused from the date of our request to the date we receive your reply (Article 12A, as inserted into UK GDPR by section 76 of the Data (Use and Access) Act 2025); we will tell you about any such pause.
We honour deletion requests as far as the providers we use are technically able to support deletion. For ChatGPT Business and Gemini for Google Workspace, training on customer data is contractually excluded, so the question of model-weight retention does not arise. For Claude Pro and Claude Max we apply the training opt-out and process only de-identified output. For other providers, back-end deletion windows vary (typically up to 30 days for enterprise tiers).
9. Complaints
If you are unhappy with how we have handled your personal information, please contact me@richardhughesjones.com.
We operate a documented complaints-handling process consistent with section 164A of the Data Protection Act 2018, which commences on 19 June 2026 under section 103 of the Data (Use and Access) Act 2025. We will acknowledge any data protection complaint within 30 days of receipt; this acknowledgement is a separate duty from the substantive response, which we will provide without undue delay thereafter. You may submit a complaint by email; we maintain an internal log of complaints and how they were handled.
If your complaint is not resolved to your satisfaction through this process, you may escalate it to the Information Commissioner’s Office at https://ico.org.uk.
10. Changes to this Privacy Policy
We may update this policy periodically. Where changes are material, we will notify you appropriately, including by email where you are a current or recent coaching client.
11. Further specifications: cookies, newsletter & website
11.1 Cookies
This website uses cookies and similar technologies. Cookies are small text files placed on your device when you visit a website.
Strictly necessary cookies. WordPress, our hosting platform, sets cookies that are required to serve the website to you securely. These are always set and are not used to identify you.
Analytics cookies. We use Google Analytics to understand visitor numbers and how pages on the site are used. Google Analytics places two cookies (named _ga and _ga_<id>) that last up to two years; they help distinguish and count visitors. The data is processed by Google LLC under Google’s terms. See Google’s privacy policy at https://policies.google.com/privacy.
A notice on the site informs you that cookies are in use. If you would prefer not to be tracked by Google Analytics, you can opt out at any time by installing the Google Analytics opt-out browser add-on at https://tools.google.com/dlpage/gaoptout, or by blocking third-party cookies in your browser settings.
11.2 Newsletter
If you subscribe to the newsletter, your email address and any other information you provide will be used solely for the purpose of delivering the newsletter and managing your subscription. Subscriptions are based on your consent under Regulation 22 of the Privacy and Electronic Communications Regulations (PECR); for existing coaching clients, the soft opt-in under PECR may also apply for closely-related communications.
We use Substack to publish and distribute the newsletter. When you subscribe, your email address is processed by Substack in accordance with their privacy policy: https://substack.com/privacy.
Key points:
- Substack manages email delivery, subscriber management, analytics, and unsubscribe requests.
- Substack may collect certain usage and analytics information to help us understand newsletter performance.
- You may unsubscribe at any time using the link included at the bottom of every newsletter.
- You may request deletion of your Substack subscription data at any time by contacting us or by managing your settings directly through Substack.
- We do not share your email address or personal information with newsletter sponsors, and sponsors do not receive access to any personal data.
11.3 Website fonts and embedded content
This website may use web font files from Adobe. Servers hosting these font files may receive personal information such as your browser, network or device, and your IP address. You can view Adobe’s privacy policy on their website.
Some pages on this website contain embedded content from third parties (for example, YouTube videos). This site does not share user data with those parties. You should refer to those sites for their privacy policies.
This site may use Google reCAPTCHA to prevent spam and abuse in forms. Google only receives the data needed to provide this service. You can read Google’s privacy policy on their website.
11.4 Website activity
This website is hosted by WordPress. WordPress collects personal data when you visit this website, including your browser, network and device information, the pages you visit and links you click, and your IP address. WordPress uses this data to operate, protect, and improve its platform. WordPress analyses the data in a de-personalised form. You can read WordPress’s privacy policy for more information.
12. Contact
For any questions or concerns about this Privacy Policy or your personal information, please contact:
Richard Hughes-Jones Email: me@richardhughesjones.com