This notice explains how Kyanite Solutions Ltd, trading as Kyanite Coaching, looks after your personal information — from your first enquiry, through booking and support, to after your work with Kyanite ends.
1. Who we are
Kyanite Solutions Ltd (company number 17248080, registered in England and Wales) is the data controller for the personal information described in this notice — the organisation that decides why and how it's used.
Kyanite Solutions Ltd trades as Kyanite Coaching, Kyanite Burnout, Kyanite ADHD and Kyanite Executive, and this notice covers all of them.
Kyanite has not appointed a Data Protection Officer — this isn't legally required for a business of Kyanite's size and activities. Questions about your information should go to privacy@kyanitesolutions.co.uk.
2. What this notice covers
This notice explains how Kyanite handles your personal information from your first enquiry, through booking, registration and intake, all the way through service delivery and, where relevant, after your engagement ends. It covers all Kyanite Coaching support (Everyday Life, ADHD, Burnout, and Founders & Senior Leaders), Kyanite Executive, group sessions, organisation-funded Executive arrangements, accessibility adjustments, safeguarding and welfare situations, complaints, your data protection rights, security incidents, and invoicing. It does not cover Kyanite's website generally, cookies, or analytics — see "Using this website" below and our Cookie Policy.
3. Information we collect
Depending on how you use Kyanite's services, this can include:
Identity and contact information — your name, preferred name, email address and telephone number.
Booking and service information — your appointments, which service route you've chosen, and whether you prefer Teams or telephone.
Communication and accessibility information — your communication preferences and anything that helps you work effectively with Kyanite.
What brings you to Kyanite — what's brought you to Kyanite, the pressures and priorities you've described, the support you're looking for, and agreed actions and relevant context from your sessions.
Special-category information — health, disability, neurodivergence or other protected information, where you choose to share it because it's relevant to the support you want. You don't need to tell Kyanite about a diagnosis or medical history unless you want to — only what's actually relevant to the support you're asking for.
Client-record information — the concise record Kyanite keeps to provide and manage your support properly.
Executive administrative information — your role, organisation and, where applicable, who is paying for your engagement.
Financial and administrative information — invoices, payments and related records.
Email preferences — whether you've asked to receive occasional emails from Kyanite, and when you asked.
Group session interest — which Kyanite group sessions you've asked to hear about, and which times usually suit you.
Governance information — records relating to a complaint, a rights request, a safeguarding matter, or a security incident, where applicable.
4. How we use your information, and our legal basis
UK data protection law requires Kyanite to have a valid legal reason ("lawful basis") for every use of your information, decided in advance for each purpose — not chosen after the fact because it's convenient. Kyanite does not treat consent as a blanket basis for everything; the table below sets out the actual basis for each purpose.
| Responding to your enquiry and any steps you ask for before starting with Kyanite |
Necessary to take steps at your request before entering into an agreement with you |
| Telling you about Kyanite group sessions you've registered interest in — dates, prices and how to join |
Necessary to take steps at your request before entering into an agreement with you |
| Registration, booking, and providing the coaching support you've asked for |
Necessary to perform our agreement with you |
| Accounting, tax and other legal record-keeping |
Necessary to comply with a legal obligation |
| Appropriate business governance — for example establishing, exercising or defending a legal claim, proportionate record-keeping after an engagement ends, and security |
Our legitimate interests, balanced against your rights (see "Your right to object" in Section 8) |
| Sending you occasional emails with practical tools and updates — only if you've asked for them |
Your consent. You can withdraw it at any time using the unsubscribe link in any email, or by contacting Kyanite (Section 16). Saying no, or unsubscribing later, never affects your support. |
Where Kyanite relies on "legitimate interests", that means a specific, identifiable business reason — such as being able to defend Kyanite's position if a legal dispute ever arose — weighed against your rights and what you'd reasonably expect, not just a general justification.
5. Special-category information
Information about your health, disability, neurodivergence or similar is treated as "special category" information under data protection law and needs extra protection. Using it requires both an ordinary legal basis (Section 4) and a separate condition specifically for special-category data. Where you choose to share this kind of information so that Kyanite can tailor your support appropriately, Kyanite relies on your explicit consent for that specific purpose. You can withdraw this consent at any time by telling Kyanite (privacy@kyanitesolutions.co.uk) — this doesn't affect anything already done before you withdrew it, and it doesn't automatically make an earlier action unlawful.
6. Confidentiality and safeguarding
| Kyanite normally keeps what clients tell us confidential. In exceptional circumstances, relevant information may need to be used or shared where necessary to protect the client or another person from serious harm, meet a legal obligation, or respond appropriately to a safeguarding concern. Where appropriate and safe to do so, Kyanite would normally seek to discuss this with the client first. |
Where this kind of sharing is genuinely necessary to protect someone's wellbeing, Kyanite relies on a legal basis recognised specifically for safeguarding under data protection law, together with the appropriate special-category condition where health or similar information is involved. This route exists for genuine safeguarding situations — not every difficult conversation or moment of distress meets that bar, and Kyanite only relies on it where it's actually necessary for that purpose.
7. If your employer or organisation is paying
For Kyanite Executive engagements funded by an employer or organisation, that organisation paying for your support does not automatically give it access to your conversations, your intake answers, or your client record. Kyanite may share the administrative information genuinely necessary for funding and invoicing — for example that sessions took place and when. Any further reporting to your sponsoring organisation is only ever what's been clearly agreed with you in advance, and is always subject to the safeguarding and legal exceptions described in Section 6. Your organisation paying for your engagement doesn't make it "the client" in place of you.
8. Who we share your information with
Kyanite uses a small number of technology providers to run its booking and intake systems. In outline: when you submit information through Kyanite's website, it's received and processed by a secure function running on Kyanite's website hosting provider, which passes it on to Kyanite's Microsoft 365 environment, where the permanent record of what you've submitted is kept. Kyanite's hosting provider processes and transmits your submission as part of this journey — it is not where your information is intentionally kept on an ongoing basis.
If you've asked to receive Kyanite's emails, your name and email address are held by MailerLite, the email service Kyanite uses to send them. MailerLite acts only on Kyanite's instructions, under a data processing agreement.
Depending on the situation, Kyanite may also share information with:
Other service or technology providers who process information on Kyanite's behalf, under appropriate data protection terms.
Professional advisers or insurers, where necessary — for example if a legal or insurance matter arises.
Regulators or authorities, where Kyanite is legally required to share information with them.
Emergency services or other appropriate parties, where justified under Section 6 (Confidentiality and safeguarding).
Your right to object: where Kyanite relies on legitimate interests as its legal basis (Section 4), you have the right to object to that processing on grounds relating to your particular situation — see Section 9.
9. Transfers of information outside the UK
Kyanite's Microsoft 365 environment, where your ongoing client record is kept, is located in the United Kingdom. Kyanite's website hosting provider — used only to receive your submission and pass it on, not to store it long-term — may process information outside the UK; where this happens, Kyanite uses an appropriate legal mechanism designed to protect the information, such as applicable UK adequacy regulations or approved contractual safeguards, and checks that the specific protection in place is appropriate to the type of information involved, including any special-category information. Contact Kyanite (Section 16) for more detail about a specific transfer.
If you've asked for Kyanite's emails: MailerLite stores your name and email address in the European Union (with Google Cloud). MailerLite's contracting company, MailerLite, Inc., is based in the United States, so any access from outside the UK is protected by approved contractual safeguards — the UK Addendum to the standard contractual clauses — which are part of MailerLite's data processing agreement.
10. How long we keep your information
| Client and coaching records |
7 years |
The end of your relationship with Kyanite |
| Safeguarding records |
7 years (or longer if a matter is still open) |
The end of your relationship, or the safeguarding matter closing, whichever is later |
| Complaints (service or conduct) |
7 years |
The complaint closing |
| Data protection complaints |
7 years |
The complaint closing |
| Data protection rights requests |
3 years |
The request closing |
| Security or data breach records |
6 years |
The matter closing |
| An intake you started but didn't complete |
30 days |
The date you started it |
| A discovery call or enquiry that doesn't lead to working together |
12 months |
The date of the call (or of your enquiry, if no call took place) |
| Your registration of interest in group sessions, if you don't go on to join one |
12 months |
The date you registered (sooner if you ask to be taken off the list) |
| Invoices and financial records |
6 years |
The end of the relevant financial year |
| Your name and email address, if you've asked for Kyanite's emails |
Until you unsubscribe — after that, only a minimal record that you've unsubscribed, so you aren't emailed again |
The date you subscribed |
Kyanite can keep a specific piece of information for longer than these periods where there's a genuine, ongoing legal, regulatory or insurance reason to — for example an active complaint or legal claim — but this is decided case by case, not applied as a blanket extension to everything in your file.
11. Your rights
Depending on which legal basis applies to a particular use of your information, you may have the right to:
Ask for a copy of the information Kyanite holds about you (access).
Ask Kyanite to correct inaccurate information (rectification).
Ask Kyanite to delete your information in some circumstances (erasure) — Kyanite will explain how a request like this is handled, including where a genuine reason exists to keep something for longer.
Ask Kyanite to limit how your information is used (restriction).
Ask for your information in a portable format, where it applies (portability).
Object to processing based on Kyanite's legitimate interests (Section 4) — this is a genuine right, not a formality, and Kyanite will stop that processing unless it can show a compelling legitimate reason to continue, or the processing is needed for a legal claim.
Withdraw your consent at any time, where consent is the basis being relied on (Sections 4 and 5) — for example by unsubscribing from Kyanite's emails — this doesn't affect anything already done before you withdrew it.
Kyanite will respond to any rights request within the timescales set by UK data protection law.
12. How to complain
If you're unhappy about how Kyanite has handled your personal information, please tell Kyanite directly first — Kyanite has a complaints process and will explain how it works. Kyanite will acknowledge a data protection complaint within 30 days of receiving it. That 30-day period is for acknowledging your complaint, not for resolving it — Kyanite will then investigate properly, keep you updated on progress, and let you know the outcome without unreasonable delay.
You also have the right to complain to the Information Commissioner's Office (ICO) at any time, whether or not you've raised it with Kyanite first: ico.org.uk, or 0303 123 1113.
13. Automated decisions and AI
Kyanite does not use automated decision-making or profiling to decide whether you can use Kyanite's services or what support you should receive — decisions like these are always made by a person (Kyanite's director), never by a computer. Kyanite does not put identifiable client records, intake answers or session information into general-purpose AI tools. If this ever changes, this notice will be updated before any such change is made.
14. Where information comes from, if not directly from you
Most of the information Kyanite holds about you comes directly from you. Where a Kyanite Executive engagement is arranged by your employer or sponsoring organisation, Kyanite may receive some administrative information from them — for example your name, role and contact details, and funding arrangements — before you provide anything yourself.
15. Keeping this notice up to date
Kyanite reviews this notice at least annually, and sooner if the law changes, Kyanite's services change, or Kyanite starts using a new supplier or system in a way that affects how your information is handled. The version number and date at the top of this notice tell you which version you're looking at.
Using this website
This notice covers your relationship with Kyanite as a client. When you simply browse this website:
- Technical data — our website host records standard technical information such as IP address, browser type and pages visited, to keep the site running securely.
- Cookies — this site does not use analytics or tracking cookies. See our Cookie Policy for the small amount of browser storage it does use.
- Payments — where you pay online, payment is processed by Stripe. Stripe handles your card details; Kyanite does not hold your full card details.
Questions about any of this can go to privacy@kyanitesolutions.co.uk.
16. Contact us
privacy@kyanitesolutions.co.uk — for any question about your information, including to exercise the rights described in Section 11.
