Privacy Policy
Last updated: 19 August 2026
1. Who we are
reWRK Solutions Ltd, trading as Joseph Hammond-Hagan Coaching & Advisory (JHHCA), is the data controller for the personal data described in this notice.
Company name: reWRK Solutions Ltd
Trading name: Joseph Hammond-Hagan Coaching & Advisory (JHHCA)
Company number: 11748951, registered in England and Wales
Registered office: 71-75 Shelton Street, London WC2H 9JQ, United Kingdom
Website: josephhh.com
Contact for privacy questions: datacontroller@josephhh.com
General contact hello@josephhh.com
ICO registration number: (TBC)
We are not required to appoint a Data Protection Officer. Privacy questions should be sent to the address above.
This notice covers josephhh.com, our coaching and advisory work, our scorecard, and our email list. It does not cover other websites we link to.
2. The short version
We collect your name and email when you contact us, book a call, complete our scorecard, or join our email list. If you become a client, we also hold session notes and billing records. We do not sell your data. We use a small number of suppliers to run the website, bookings, the scorecard, and our emails, and some of them are outside the UK. You can ask us for a copy of your data or ask us to delete it at any time.
The rest of this notice gives the details the law requires.
3. What we collect, why, and on what legal basis
3.1 Website visitors
What
IP address, browser and device type, pages viewed, referring site, approximate location
Cookie preferences
Why
Keeping the site running, security, and understanding which pages are used
Recording what you agreed to
Lawful Basis
Legitimate interests: running and protecting our website. For analytics cookies, we rely on your consent (see the Cookie Notice)
Legal obligation under PECR
3.2 People who contact us
What
Name, email address, phone number if you give it, and whatever you write in your message
Why
Answering your enquiry
Lawful Basis
Steps taken at your request before entering a contract, or our legitimate interest in responding to people who contact us
3.3 People who book a discovery conversation
What
Name, email address, phone number, appointment time, time zone, and anything you write in the booking form
Why
Scheduling and running the call, sending reminders
Lawful Basis
Steps taken at your request before entering a contract
Bookings run through Acuity Scheduling, which is part of Squarespace. Acuity holds this data on our behalf.
3.4 People who complete our scorecard
What
Name, email address, your answers, your score, and the report generated for you
Why
Producing your results and sending them to you
Lawful Basis
Steps taken at your request
What
The same data, used to follow up with relevant coaching content and offers
Why
Marketing
Lawful Basis
Consent, given when you tick the box on the scorecard
The scorecard runs on ScoreApp at josephhh.scoreapp.com.
3.5 Email list subscribers
What
Name, email address, subscription date and source, opens and clicks
Why
Sending our newsletter and coaching content, and seeing what people read
Lawful Basis
Consent. Where you are an existing client or have enquired about our services, we may rely on the soft opt-in under PECR regulation 22 for emails about similar services
Every email has an unsubscribe link. Unsubscribing takes effect straight away and costs you nothing.
3.6 Coaching and advisory clients
What
Contact and billing details, contract, engagement scope, session dates
Why
Delivering the engagement and running our business
Lawful Basis
Performance of a contract
What
Session notes, goals, actions, and the working record of the engagement
Why
Coaching you properly across a multi-month engagement
Lawful Basis
Performance of a contract
What
Health, wellbeing, neurodivergence, or other sensitive information you choose to share in a session
Why
Coaching you safely and appropriately
Lawful Basis
For special category data under Article 9 we rely on your explicit consent, given in your engagement agreement. You can withdraw it, and we explain in section 8 what happens if you do
What
Invoices, payments, and accounting records
Why
Tax and company law
Lawful Basis
Legal obligation
3.7 Corporate and organisational clients
Where an organisation engages us to coach its people, we hold the sponsor's contact details and contract information under performance of a contract, and the participant's coaching data as described in 3.6.
What we report back to a sponsoring organisation is limited to attendance, engagement, and themes agreed in advance with the participant. We do not report the content of sessions. This is set out in the engagement agreement and confirmed with the participant at the start.
3.8 Where else your data comes from
Almost everything we hold comes from you. We may also see your public LinkedIn profile, information a sponsoring organisation gives us about you, and information a mutual contact gives us when introducing you.
4. Who we share your data with
We do not sell your personal data. We do not share it for anyone else's marketing. We use these suppliers, who process data on our instructions under a written contract:
Supplier
Squarespace
What They Do
Hosts josephhh.com and its contact forms
Where the Data Goes
Ireland and the United States
Supplier
Google (Google Workspace, Google Sheets, Google Analytics)
What They Do
Email, documents, our contact records, and website analytics
Where the Data Goes
United Kingdom, European Economic Area, and the United States
Supplier
ScoreApp
What They Do
Runs the scorecard and holds the responses
Where the Data Goes
United Kingdom and the European Economic Area
Supplier
Acuity Scheduling (Squarespace)
What They Do
Booking and scheduling
Where the Data Goes
Ireland and the United States
Supplier
MailerLite
What They Do
Sends our marketing and newsletter emails
Where the Data Goes
European Economic Area and the United States
Supplier
Substack
What They Do
Newsletter hosting and subscriptions
Where the Data Goes
United States
We also share data where the law requires it, where we need to establish or defend a legal claim, or with our insurers and professional advisers.
Coaching supervision. Coaches are expected to take their work to a qualified supervisor. We discuss client work in supervision using anonymised material: no name, no employer, no detail that would identify you. Our supervisor is bound by the same confidentiality duty we are.
5. Sending data outside the UK
Some of our suppliers are in the United States. Where personal data leaves the UK, we rely on one of the following:
UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework, where the supplier is certified under it
The International Data Transfer Agreement, or the EU Standard Contractual Clauses with the UK International Data Transfer Addendum
You can ask us for a copy of the safeguards that apply to a particular transfer. Write to the address in section 1.
6. How long we keep it
Data
Website enquiries that do not become clients
Retention
24 months from the last contact
Data
Discovery call bookings that do not become clients
Retention
24 months from the call
Data
Scorecard responses
Retention
24 months from completion, unless you become a client
Data
Email list data
Retention
Until you unsubscribe, then a suppression record only, so we do not email you again
Data
Session notes
Retention
7 years from the end of the engagement, in line with our insurers' requirements
Data
Client contracts and engagement records
Retention
7 years from the end of the engagement
Data
Invoices, payments, and accounting records
Retention
7 years from the end of the accounting period, as required by the Companies Act 2006 and HMRC
7. How we keep it safe
Access is limited to Joseph Hammond-Hagan and, where relevant, a named assistant under a confidentiality agreement.
Our systems use multi-factor authentication and unique passwords held in a password manager. Devices are encrypted. Working files, including our contact records, are stored in access-controlled Google Workspace storage rather than on unsecured local drives or via shared links.
Session notes are held separately from marketing and inquiry data.
If a breach occurs that puts your rights at risk, we will notify the ICO within 72 hours and, where required by law, notify you without undue delay.
8. Your rights
Under UK GDPR, you can ask us to:
Give you a copy of the personal data we hold about you
Correct anything inaccurate or incomplete
Delete your data, where we have no continuing reason to hold it
Restrict what we do with it while a dispute or correction is resolved
Transfer it to you or another provider in a machine-readable format, where we hold it on the basis of consent or contract
Stop processing based on legitimate interests, by objecting
Stop marketing, at any time, with no reason needed
Withdraw consent you have given, at any time. This does not affect anything we did before you withdrew it
To exercise any of these, write to datacontroller@josephhh.com. We respond within one month. If your request is complex, we may extend it by two months and will explain why. There is no charge.
Where you withdraw consent for us to hold special category data shared in sessions, we will delete or anonymise those notes. We may need to keep a minimal record that the engagement happened, for insurance and legal reasons.
We may ask you to confirm your identity before we act to ensure we are not disclosing your data to anyone else.
9. Complaints
Tell us first. Write to datacontroller@josephhh.com, and we will look into it.
You can also complain to the Information Commissioner's Office at any time:
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline: 0303 123 1113 ico.org.uk/make-a-complaint
10. Automated decision-making
We do not make decisions about you by automated means alone, and we do not profile you in a way that produces legal or similarly significant effects.
Our scorecard produces a score and a report from the answers you give. That is an automated calculation, not a decision about you. A human reads the result before we contact you about it.
11. Children
Our services are for adults. We do not knowingly collect data from anyone under 18. If you believe a child has given us their data, write to us, and we will delete it.
12. Changes to this notice
We update this notice when our services or suppliers change. The date at the top shows the current version. Material changes will be flagged on the website, and we will email you if the change affects how we use data you have already given us.
Data
Website analytics
Retention
As set out in the Cookie Notice