GDPR Compliance Statement

Last Updated: November 2026

Emerald Meadow is committed to compliance with the General Data Protection Regulation (GDPR) and respects the data protection rights of individuals in the European Union and European Economic Area.

Legal Basis for Processing

We process personal data under the following legal bases:

• Consent: When you provide explicit consent for us to process your personal data for specific purposes
• Contract Performance: When processing is necessary to perform our coaching services contract with you
• Legitimate Interests: When we have a legitimate business interest that does not override your fundamental rights and freedoms
• Legal Obligation: When we must process data to comply with legal requirements

Your GDPR Rights

Right to Access

You have the right to request access to the personal data we hold about you. We will provide you with a copy of your personal data in a commonly used electronic format.

Right to Rectification

If your personal data is inaccurate or incomplete, you have the right to request that we correct or complete it.

Right to Erasure (Right to be Forgotten)

You can request deletion of your personal data when:

• The data is no longer necessary for the purposes for which it was collected
• You withdraw your consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• The data has been unlawfully processed
• The data must be erased to comply with a legal obligation

Right to Restriction of Processing

You can request that we restrict processing of your personal data when:

• You contest the accuracy of the data
• Processing is unlawful but you oppose erasure
• We no longer need the data but you need it for legal claims
• You have objected to processing pending verification of our legitimate grounds

Right to Data Portability

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller.

Right to Object

You have the right to object to processing of your personal data based on legitimate interests or for direct marketing purposes. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests.

Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority in your country of residence, place of work, or where an alleged infringement occurred.

Data Processing Activities

Categories of Personal Data

We process the following categories of personal data:

• Identity data: name, professional title
• Contact data: email address, business address
• Training data: performance recordings, coaching notes, progress assessments
• Technical data: IP address, browser type, device information
• Usage data: how you interact with our website and services

Data Retention Periods

We retain personal data only as long as necessary for the purposes outlined:

• Enquiry data: 2 years from last contact
• Client data: Duration of service relationship plus 7 years for legal compliance
• Training recordings: 12 months after programme completion unless you request extended access
• Marketing consent: Until consent is withdrawn
• Website analytics: 26 months

International Data Transfers

When we transfer personal data outside the European Economic Area, we ensure appropriate safeguards are in place, such as:

• Standard contractual clauses approved by the European Commission
• Adequacy decisions recognising equivalent data protection standards
• Binding corporate rules where applicable

Data Security Measures

We implement appropriate technical and organisational measures to ensure data security:

• Encryption of data in transit and at rest
• Regular security assessments and updates
• Access controls and authentication requirements
• Staff training on data protection obligations
• Incident response procedures

Data Protection Officer

For questions regarding data protection or to exercise your GDPR rights, you may contact our data protection contact at:

Email: contact at emerald-meadow.com

We will respond to your request within one month of receipt. In complex cases, we may extend this period by two additional months and will inform you of such extension.

Automated Decision-Making and Profiling

We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you.

Third-Party Data Processors

We work with carefully selected third-party service providers who process personal data on our behalf. All processors are bound by data processing agreements that ensure GDPR compliance and include:

• Processing only on documented instructions
• Confidentiality obligations
• Appropriate security measures
• Sub-processor restrictions
• Assistance with data subject rights
• Data deletion or return upon contract termination

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify you without undue delay. We will also notify the relevant supervisory authority within 72 hours of becoming aware of the breach, where required by law.

Updates to This Statement

We may update this GDPR compliance statement to reflect changes in our practices or legal requirements. Material changes will be communicated to you through our website or direct notification where appropriate.

Exercising Your Rights

To exercise any of your GDPR rights, please contact us at contact at emerald-meadow.com with:

• Your full name and contact details
• Description of your request
• Proof of identity (if required for security purposes)

We do not charge fees for legitimate requests, though we may charge a reasonable fee for manifestly unfounded, excessive, or repetitive requests.