Brightpath Partners Ltd — Customer Privacy Notice
This privacy notice tells you what to expect us to do with your personal information.
By providing us with your data, you warrant that you are over 18 years of age.
Contact details
Brightpath Partners Ltd
Telephone: 07720 839059
Email: hello@brightpathpartners.co.uk
It is very important that the information we hold about you is accurate and up to date. Please let us know if your personal information changes at any time by emailing us at hello@brightpathpartners.co.uk.
What information we collect, use, and why
Personal data means any information capable of identifying an individual. It does not include anonymised data.
We collect or use the following information to provide services:
Names and contact details
Addresses
Website user information (including user journeys and cookie tracking)
Photographs or video recordings
We collect or use the following information for service updates or marketing purposes:
Names and contact details
Marketing preferences
Location data
Recorded images, such as photos or videos
Website and app user journey information
Lawful bases and data protection rights
Under UK data protection law, we must have a "lawful basis" for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO's website.
Which lawful basis we rely on may affect your data protection rights, which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO's website:
Your right of access — You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share it with. There are some exemptions, which means you may not receive all the information you ask for.
Your right to rectification — You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
Your right to erasure — You have the right to ask us to delete your personal information.
Your right to restriction of processing — You have the right to ask us to limit how we can use your personal information.
Your right to object to processing — You have the right to object to the processing of your personal data.
Your right to data portability — You have the right to ask that we transfer the personal information you gave us to another organisation, or to you.
Your right to withdraw consent — When we use consent as our lawful basis, you have the right to withdraw your consent at any time.
If you make a request, we must respond to you without undue delay and in any event within one month. To make a data protection rights request, please contact us using the details at the top of this notice.
Our lawful bases for collecting and using your data
Our lawful bases for collecting or using personal information to provide services are:
Consent — we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. You have the right to withdraw your consent at any time.
Contract — we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply, except the right to object.
Our lawful bases for collecting or using personal information for service updates or marketing purposes are:
Consent — as above.
Legitimate interests — we're collecting or using your information because it benefits you, our organisation or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. Our legitimate interest is to properly target marketing information to relevant people, so they only receive what's appropriate to their needs and situation.
For more information on our use of legitimate interests as a lawful basis, please contact us using the details above.
Our lawful ground for processing your personal data to send you marketing communications is either your consent or our legitimate interests (namely, to grow our business).
Under the Privacy and Electronic Communications Regulations, we may send you marketing communications if (i) you made a purchase or asked for information from us about our goods or services, or (ii) you agreed to receive marketing communications — and in each case you have not since opted out. Under these regulations, if you are a limited company, we may send you marketing emails without your consent; however, you can still opt out at any time.
Before we share your personal data with any third party for their own marketing purposes, we will get your express consent.
You can ask us to stop sending you marketing messages at any time by adjusting your marketing preferences, following the opt-out links on any marketing message, or emailing us at hello@brightpathpartners.co.uk. If you opt out of marketing communications, this opt-out does not apply to personal data provided as a result of other transactions, such as purchases.
Where we get personal information from
We collect data about you when you provide it to us directly — for example, by filling in forms on our site, subscribing to our newsletter, booking a call, or emailing us. We also collect certain data automatically as you use our website, through cookies and similar technologies (see our cookie policy). We may also receive analytics and campaign data from providers such as Google, and advertising platforms such as LinkedIn and Facebook where we run ads.
How long we keep information
We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including satisfying any legal, accounting or reporting requirements.
When deciding the correct retention period, we consider the amount, nature and sensitivity of the data, the potential risk of harm from unauthorised use or disclosure, the purposes of processing, whether these can be achieved by other means, and legal requirements.
For tax purposes, the law requires us to keep basic information about our customers (including contact, identity, financial and transaction data) for six years after they stop being customers.
In some circumstances we may anonymise your personal data for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.
Who we share information with
We may share your personal data with:
Service providers who provide IT and system administration services
Professional advisers including lawyers, bankers, auditors and insurers
Government bodies that require us to report processing activities
Third parties to whom we sell, transfer or merge parts of our business or assets
We require all third parties to whom we transfer your data to respect its security and to treat it in accordance with the law. We only allow them to process your personal data for specified purposes and in accordance with our instructions.
Data processors
These data processors provide the following activities for us: Squarespace (website hosting and analytics), Squarespace Payments/Stripe (payment processing), Kit (email marketing), ScoreApp (assessments and quizzes), TidyCal (booking), Coachvox (AI coaching tool) and Coachnova (coaching management).
We may also share information with our professional and legal advisers and consultants.
Sharing information outside the UK
Where necessary, we transfer personal information outside the UK. When we do, we comply with UK GDPR and make sure appropriate safeguards are in place. The transfers we make are set out below.
Kit — Email marketing platform — United States of America (and elsewhere). The transfer relies on the UK Extension to the EU-U.S. Data Privacy Framework and on Standard Contractual Clauses within the provider's Data Processing Addendum.
Squarespace — Website hosting and analytics provider — United States of America. The transfer relies on the UK Extension to the EU-U.S. Data Privacy Framework and on UK Standard Contractual Clauses.
Squarespace Payments (powered by Stripe) — Payment processor (financial and transaction data) — United States of America. The transfer relies on the UK Extension to the EU-U.S. Data Privacy Framework and on Standard Contractual Clauses.
TidyCal (operated by Sumo Group Inc. / AppSumo) — Appointment booking tool — United States of America. The transfer relies on the Data Privacy Framework and on the safeguards within the provider's Data Processing Agreement.
Coachvox — AI coaching tool (Mini ChrisP) — Outside the UK/EEA, including the United States of America. Appropriate safeguards are in place to protect the data in accordance with UK GDPR, as set out in the provider's privacy policy.
ScoreApp — Assessment/quiz tool — Outside the UK/EEA ("third countries"). The transfer is protected by Standard Contractual Clauses approved by the European Commission, between the provider and its third-party processors.
Coachnova — Coaching management tool — Republic of Ireland (within the EEA). The Republic of Ireland is covered by UK adequacy regulations, which recognise it as providing an adequate level of data protection.
How to complain
If you have any concerns about our use of your personal information, you can make a data protection complaint to us at hello@brightpathpartners.co.uk.
If you remain unhappy with how we've used your data after raising a complaint with us, you can also complain to the ICO:
Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint
AI Addendum — Privacy Notice for Use of AI Technology
Introduction
We respect your privacy and are committed to protecting your personal data. This addendum explains how Brightpath Partners Ltd processes personal data when using AI tools, in compliance with the UK GDPR and the Data Protection Act 2018.
AI tools in use
We use AI tools to support our business operations, including CRM and email workflows, content drafting and marketing copy, internal knowledge management and meeting notes, and analytics and reporting. We also use AI in delivering our services, including AI-based coaching tools and session note-taking, summarising and analysis.
AI tools used in delivering our services (these may process your personal data): Coachvox (our AI coaching assistant, Mini ChrisP) and Coachnova (coaching session management). These providers may retain limited logs of interactions for a short period for security and abuse monitoring. We have data processing agreements with them, and your data is not used to train their models.
General-purpose AI tools: We may use general AI assistants (such as ChatGPT, Claude and Gemini) for internal business tasks like drafting and research. We do not input identifiable client information into these general-purpose tools.
What data we collect
In using Coachvox and Coachnova, we may process:
Contact details: full name, email address, telephone number, etc.
Professional information: job title, employer details.
Financial information: any financial information you may disclose in a chat or coaching session, such as salary or financial circumstances.
Other data: information provided through correspondence, uploaded documents and other content you provide.
Usage data: login credentials, account preferences, and interaction history with these tools.
Technical data: IP address, device/browser type, and log information collected automatically for security and performance.
Sensitive data
Our services are not designed to process special categories of personal data (such as health information, political opinions, religious beliefs or biometric data). We ask that you do not upload or submit such information, and we disclaim responsibility where this guidance is not followed.
How we collect your data
We collect data directly from you, through:
Online forms or surveys
Email correspondence
Uploaded files and documents
Conversations with Coachvox (text) and Coachnova (text and voice), which we store to improve and personalise the assets we generate for you
Automatic technical collection (e.g. IP address, device/browser type, and log data when you access the platform)
Conversations with Coachvox and Coachnova — including voice, where offered — are stored to improve and personalise your experience. The AI providers may keep transient prompt logs for a short period (around 30 days); our own retention of your coaching records is covered in the "How long we keep information" section above.
Why we use your data
We process personal data to:
Improve the quality and speed of our business processes
Deliver our services more effectively and efficiently
Generate coaching content tailored to your needs and situation
Enable and improve Coachvox and Coachnova, so they can provide accurate, context-aware support
Analyse platform usage to enhance features, user experience and service performance
Support billing, account management and customer communication
Lawful basis for processing
The lawful basis depends on which tool is involved.
Coachvox (Mini ChrisP) is available to anyone using our website, before any coaching relationship begins. Our lawful basis for processing the information you share with it is your consent (which you give by choosing to use it and registering) and our legitimate interests in providing a helpful free tool and understanding how it's used so we can improve it. You can stop using it at any time, and you can ask us to delete your conversations.
Coachnova is only used as part of a paid coaching engagement, after a coaching agreement is in place. Our lawful basis for processing your information here is contract — it supports the coaching service you've signed up for — and it is entirely optional: clients can opt out of Coachnova at any time and we'll manage session notes another way.
If we ever need to process special category data, we'll do so only in a compliant way, which may include obtaining your explicit consent.
How we protect your data
Data processed through our AI tools is protected by security measures including:
Access controls: role-based access and multi-factor authentication, limiting access to authorised personnel only.
Incident response: in the event of a data breach, we have an incident response plan to promptly address the situation and notify affected clients as required by law.
User responsibility: we encourage you to protect your own data, such as by using strong passwords and safeguarding your account information.
We are committed to maintaining robust security measures to protect your data from unauthorised access and breaches.
Third-party involvement
We use Coachvox and Coachnova as data processors. We have agreements in place with them to protect your personal data, and none of your data is used to train or improve their tools. For details on their privacy standards, refer to their own policies.
We may add or change AI providers from time to time, and we will update this notice to reflect any such changes before they take effect.
Changes to this notice
We may update this notice from time to time. Please check this page periodically for updates. For queries regarding this notice, email hello@brightpathpartners.co.uk.
Last updated: 10 September 2026