This policy explains how The KBB Collective collects and uses your personal data when you use our websites (including diagnostic.kbbcollective.co.uk and training.kbbcollective.co.uk), apply for or book a diagnostic call, or become a member. We keep it plain and short.
1. Who we are
Data controller: [CONFIRM: legal entity name, e.g. "XYZ Ltd, trading as The KBB Collective"]
Company number: [CONFIRM]
Registered address: [CONFIRM]
ICO registration number: [CONFIRM]
Privacy contact: [CONFIRM: email address, e.g. [email protected]]
We are not required to appoint a Data Protection Officer. Josh Delane is responsible for data protection questions.
2. What we collect
- Details you give us in our application form: your name, email address, phone number, business name or website, the type of KBB business you run, your approximate annual turnover band, and your main business challenge.
- Booking details when you schedule a call: the time you choose and any answers you give in the booking form.
- Call information: notes we make during your diagnostic, and any business figures you choose to share (for example marketing spend, conversion rates, margins). Calls are [CONFIRM: "not recorded" / "recorded only with your permission, which we ask for at the start of the call"].
- Membership details if you join: billing details, contract information, and what you share in coaching calls and the community.
- Technical and marketing data: your IP address, browser and device type, the pages you visit, the ad or link that brought you to us (for example UTM tags and the Facebook click ID), and cookie identifiers set by the tools listed in section 6.
We don't ask for special category data (such as health information), and we ask that you don't share it with us.
3. How we use it, and our lawful basis
| Purpose | Lawful basis (UK GDPR) |
|---|---|
| Reviewing your application, checking whether the diagnostic is a good fit, and contacting you about it by phone, SMS or email | Steps taken at your request before entering into a contract; and our legitimate interests in responding to enquiries |
| Sending you the £1 to Cash Machine worksheet and other resources you ask for | Legitimate interests (providing what you requested) |
| Running your diagnostic call and preparing your action plan | Legitimate interests; steps before a contract |
| Providing membership, coaching and community access, and taking payment | Performance of a contract |
| Sending follow-up emails about our coaching, training and events | Legitimate interests (business-to-business marketing) or your consent where the law requires it. You can opt out at any time. |
| Measuring and improving our advertising (e.g. the Meta Pixel) | Your consent to non-essential cookies, where required; otherwise our legitimate interests |
| Keeping accounts and meeting legal obligations | Legal obligation |
4. Marketing
We'll only send you marketing about our own coaching and services, and every email includes an unsubscribe link. You can also reply "STOP" to any SMS, or email us to opt out. Opting out doesn't affect messages about a call you've booked or a membership you hold.
5. Who we share it with
We never sell your data. We share it only with service providers who help us run the business, under contracts that require them to protect it:
- HighLevel: CRM, forms, funnel hosting, email and SMS
- Calendly: call scheduling
- Zoom: video calls
- Meta (Facebook & Instagram): advertising and measurement
- Google: web fonts and, where used, email and document storage
- [CONFIRM: payment provider, e.g. Stripe; accounting software; community platform]
- Our professional advisers (e.g. accountants, lawyers), and authorities where the law requires it
6. Cookies and tracking
Our pages use the Meta Pixel to measure which ads lead to applications and bookings, and to show our ads to relevant people. It sets cookies (such as _fbp and _fbc) and sends information about your visit and actions on our pages to Meta. We also use your browser's session storage to pass your name and contact details from the application page to the booking page, so you don't have to type them twice. This storage is cleared when you close the tab. Our booking calendar may set its own cookies.
You can block or delete cookies in your browser settings, and control ad personalisation in your Facebook and Instagram ad settings.
7. International transfers
Some of our providers (including HighLevel, Calendly, Zoom, Meta and Google) are based in, or store data in, the United States or other countries outside the UK. Where this happens we rely on recognised safeguards, such as the UK–US Data Bridge or the UK International Data Transfer Agreement / Addendum to the EU Standard Contractual Clauses.
8. How long we keep it
- Applications and enquiries that don't lead to membership: up to 24 months after our last contact with you, then deleted.
- Member records: for the length of your membership, then 6 years for tax and legal purposes.
- Marketing opt-outs: we keep a minimal record so we don't contact you again.
9. Your rights
Under UK data protection law you have the right to:
- access the personal data we hold about you
- have inaccurate data corrected
- have your data erased
- restrict or object to how we use it, including an absolute right to object to direct marketing
- receive your data in a portable format
- withdraw consent at any time, where we rely on it
To use any of these rights, email [CONFIRM: privacy contact email]. We'll respond within one month. It's free in most cases.
If you're unhappy with how we've handled your data, please contact us first. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint · 0303 123 1113.
10. Security
We use reputable providers with appropriate security, restrict access to people who need it, and protect our accounts with strong passwords and two-factor authentication.
11. Changes to this policy
We may update this policy from time to time. The "last updated" date at the top shows when it last changed.