Privacy Notice

1. About this notice and who is responsible

This Privacy Notice explains how I collect, use, store and share personal information when you visit www.thehangedman.co.uk, contact me, make a booking or receive a service from The Hanged Man. It applies to website visitors, prospective clients and current and former clients.

Daniel Todhunter, a sole trader trading as The Hanged Man, is the data controller responsible for your personal information.

You can contact me about this Privacy Notice or the use of your personal information at:

Email: privacy@thehangedman.co.uk
Website: www.thehangedman.co.uk
Address: Ryley Cottage, High Street, Billingshurst, RH14 0RD

For general booking or service enquiries, contact:

Email: bookings@thehangedman.co.uk

You may also find information about data-protection rights and complaints on the Information Commissioner’s Office website.

2. The information I collect

Depending on how you interact with The Hanged Man, I may collect:

  • identity and contact information, such as your name, email address, telephone number and billing address;

  • booking, order and payment information, including the service purchased, appointment details, payment status, cancellations and refunds;

  • service information, including your challenge, circumstances, desired outcome, preparation-form responses and accessibility requirements;

  • reading materials and communications, including cards drawn, spread photographs, working notes, reports, emails and follow-up responses;

  • feedback, permissions and preferences, including marketing choices, testimonial permissions and consent records; and

  • website and technical information, including your IP address, browser, device, website activity and cookie preferences.

I collect most information directly from you. I also create information while arranging and delivering the service.

3. Sensitive information and information about others

Information you provide may include sensitive personal information relating to matters such as health, disability, religious or philosophical beliefs or other personal circumstances. Please provide only what is reasonably necessary to explain your challenge or request an adjustment. You do not need to provide a diagnosis or detailed medical history.

Where I need to use special-category information to assess, personalise or deliver the service, I rely on your explicit consent as explained in Section 5. If you do not provide information that is genuinely necessary, or withdraw consent to its continued use, I may be unable to provide all or part of the service.

Your challenge may also involve another person. Please avoid including names, contact details or sensitive information about that person unless genuinely necessary. I will not contact them, investigate their circumstances or attempt to verify what you tell me.

I need your name, contact and order information, together with enough information to administer and deliver the service. The Reflection and The Deep Dive require a completed preparation form. The Deep Dive also requires appointment arrangements.

Marketing choices, feedback and testimonial permission are always optional.

4. How and why I use personal information

I use personal information only where reasonably necessary for the purposes described in this Privacy Notice.

  • Responding to enquiries and taking steps before booking
    Lawful basis: Contract or legitimate interests.

  • Administering bookings, payments and refunds
    Lawful basis: Contract and legal obligation.

  • Assessing and delivering the service
    Lawful basis: Contract.

  • Providing adjustments and using special-category information
    Lawful basis: Contract, together with explicit consent under Article 9(2)(a) of the UK GDPR where applicable.

  • Security, fraud prevention and business records
    Lawful basis: Legitimate interests or legal obligation.

Where you choose to provide special-category information, I rely on your explicit consent under Article 9(2)(a) of the UK GDPR to use it where reasonably necessary to assess, personalise or deliver the service or provide an adjustment.

You may withdraw consent by emailing privacy@thehangedman.co.uk. This will not affect earlier lawful processing, but I may be unable to continue where the information remains genuinely necessary. Different conditions may apply to legal claims or an exceptional threat to life.

5. Who receives information

I do not sell personal information. I use trusted providers to operate the website, process payments, communicate with clients, host online sessions and store or create documents. These currently include:

  • Squarespace for the website, online store, forms and analytics;

  • Squarespace Payments, Stripe and Sift for payments and fraud prevention;

  • Microsoft for email, calendar, online meetings, documents and file storage; and

  • Google Places, where address suggestions are enabled.

For example, Squarespace may collect and use website usage information to operate, secure, maintain and improve its platform in accordance with its own Privacy Policy

I may also share relevant information with professional advisers, insurers, financial institutions, courts, regulators, law-enforcement agencies or emergency services where reasonably necessary or required by law.

I share only what is reasonably necessary. Some providers also process information for their own lawful purposes under their own privacy information.

6. International transfers

Some service providers may store, process or access personal information outside the United Kingdom. Where international-transfer rules apply, I will use a lawful transfer mechanism and any further safeguards required by data-protection law. This may include UK adequacy regulations or approved contractual safeguards. You can request further information by emailing privacy@thehangedman.co.uk.

7. How long information is kept

I retain personal information only for as long as reasonably necessary:

  • enquiries that do not lead to a booking are normally kept for up to six months;

  • working notes and accessibility information are normally kept for up to three months after the service;

  • client submissions, preparation forms, reports and routine correspondence are normally kept for up to 12 months after completion or cancellation; and

  • transaction, consent, complaint and legal records may be retained for longer where necessary to meet tax, legal or accountability requirements.

Marketing information is retained until you unsubscribe or withdraw consent, after which I may retain a minimal suppression record.

Information may be kept longer where required for a complaint, claim, regulatory enquiry or legal obligation. When it is no longer needed, it will be securely deleted or anonymised.

I may retain genuinely anonymised report material for private service development, quality review and template development, provided it can no longer reasonably be linked to you or another person.

8. How information is protected

I use reasonable technical and organisational measures to protect personal information. These include access-controlled systems, strong passwords, multi-factor authentication, secured devices, software updates, careful checking of communications, data minimisation and secure deletion. Access to sensitive information is limited to what is reasonably necessary.

If a personal-data breach occurs, I will assess and contain it and make any notification required by law. No method of internet transmission, email communication or electronic storage can be guaranteed to be completely secure.

9. Online sessions

The Deep Dive is delivered using a Microsoft online meeting service, which may process your name, email address, meeting details, connection information and any audio or video you choose to share.

Sessions are not recorded, transcribed or processed using automated meeting recap tools. Neither you nor I may record a session without the other person’s prior written agreement.

I make written notes needed to deliver the service and prepare the report. You should join from a suitably private location and must not share the meeting link.

10. Marketing, feedback and testimonials

Booking confirmations, appointment information, reminders, report delivery and service follow-up are service communications rather than marketing.

If you begin a purchase through the website but do not complete it, I may send a reminder email about your incomplete booking.

I may ask for optional feedback after the service. Feedback remains private unless you specifically permit publication as a testimonial. Before publishing a testimonial, we will agree its wording, attribution and any other information included.

I send promotional emails only where permitted by law. You can unsubscribe at any time without affecting service communications. Testimonial permission may also be withdrawn for future use, after which I will remove the testimonial from places under my control within a reasonable period.

Sensitive information will not be used in marketing or testimonials without separate, explicit permission.

11. Website analytics and cookies

The website uses necessary cookies to operate securely and provide requested functions. With your consent, it may also use optional analytics and performance cookies to understand website use and improve its content and operation.

You can manage optional cookies through the website’s cookie controls. Further details about the cookies used, their providers, purposes and duration are available in the Cookie Notice.

12. Your data-protection rights and how to make a complaint

Depending on the circumstances, you may have the right to:

  • request access to your personal information and receive a copy of it;

  • ask for inaccurate or incomplete information to be corrected;

  • ask for personal information to be deleted where there is no continuing lawful reason to retain it;

  • ask for the use of your information to be restricted in certain circumstances;

  • receive certain information in a portable format, or ask for it to be transferred to another organisation, where the right to data portability applies;

  • object to processing based on legitimate interests and object at any time to the use of your information for direct marketing;

  • withdraw consent where processing is based on consent, including explicit consent for special-category information.

Please note that I do not use solely automated processing to make substantive decisions about your eligibility, suitability or reading. Payment and fraud-prevention providers may use automated systems under their own privacy arrangements.

These rights are not absolute and may depend on the information concerned, the reason it is being used and any legal obligation requiring me to retain it. For example, I may need to retain limited transaction or complaint records even where other service information can be deleted.

To exercise a right or raise a data-protection complaint, email privacy@thehangedman.co.uk. I may request information reasonably necessary to confirm your identity and locate the relevant records. There is normally no charge.

I will acknowledge a complaint within 30 days, make appropriate enquiries, keep you informed where necessary and explain the outcome. If you remain dissatisfied, you may complain to the Information Commissioner’s Office.

13. Changes to this notice

This is Version 1.0 of this Notice and is effective from 13th September 2026

I may update this notice to reflect changes to the services, providers, legal requirements or the way personal information is handled. The current version and effective date will be published on the website.

Where a material change affects information already held about you, I will take reasonable steps to bring it to your attention before the new use begins.