Privacy Policy
Radically Hopeful Ltd
Last updated: April 2026 | Version 1.0
We are committed to protecting the personal data of everyone who visits our website, signs up to our mailing list, or books a place on one of our programmes. This policy explains what information we collect, why we collect it, how we use it, and what your rights are under UK data protection law.
Please read this policy before using our website or submitting any personal information to us.
1. Who We Are
Radically Hopeful Ltd is the data controller responsible for the personal data described in this policy.
Company name
Radically Hopeful Ltd
Registered address
23 Baydon Drive
Company number
16039197
ICO registration number
ZB920538
Contact email
Website
2. What Personal Data We Collect and Why
The lists below sets out the categories of personal data we process, together with the purpose and lawful basis for each.
Data collected: Purpose, Lawful basis, Retention
Name and email address
To process bookings, send session confirmation and joining details, and communicate about your programme
Contract / Legitimate interests
Duration of your programme + 2 years
Payment information (card details)
To process session or programme fees via our payment processor
Contract
Not stored by us — held by Stripe
Booking and transaction records
To maintain records of sessions booked and payments received
Contract / Legal obligation
6 years (HMRC requirement)
Responses to registration questions
To tailor the programme to participants and plan session content
Contract / Legitimate interests
Duration of your programme + 1 year
Self-diagnostic tool responses (where used)
To provide personalised feedback through our diagnostic tool
As specified at point of collection
Until you unsubscribe
Website usage data (via Squarespace analytics)
To understand how our website is used and improve our content
Legitimate interests
Aggregated data; not linked to individuals
3. How We Collect Your Data
We collect personal data in the following ways:
Directly from you — when you complete a booking form via Acuity Scheduling, subscribe to our Substack newsletter, or contact us by email
Automatically — via our Squarespace website, which may collect standard server log data and aggregate analytics when you visit
Via our self-diagnostic tool — where you choose to complete an online assessment (once launched; see Section 9)
4. Our Lawful Basis for Processing
UK GDPR requires us to identify a lawful basis before processing your personal data. We rely on the following:
Contract — where processing is necessary to perform the services you have booked or to take steps before entering into a contract with you
Legal obligation — where we are required to keep records by law (for example, financial records for HMRC)
Legitimate interests — where processing is necessary for our legitimate business interests (such as improving our services), provided those interests are not overridden by your rights
Consent — where you have given us your explicit, freely-given agreement (for example, subscribing to our newsletter or using the diagnostic tool). You may withdraw consent at any time
5. Who We Share Your Data With
We do not sell, rent, or trade your personal data. We share data only with the third-party processors listed below, each of whom processes data on our behalf under a data processing agreement or equivalent safeguards.
Processor, Service, Data shared, Location by service listed below:
Squarespace:
Website hosting and analytics
Website usage data
USA (DPF certified)
Acuity Scheduling (Squarespace):
Booking management
Name, email, booking details
USA (DPF certified)
Stripe:
Payment processing
Payment card data, transaction record
USA (DPF certified)
Zoom:
Session delivery
Name, email (for meeting invitations)
USA (DPF certified)
We will disclose personal data to law enforcement, regulators, or courts where we are required to do so by law.
6. International Data Transfers
Several of our processors are based in the United States. Transfers to the USA are protected by the UK-US Data Bridge (an extension of the EU-US Data Privacy Framework), which allows UK personal data to be transferred to participating US companies without the need for additional safeguards, provided those companies are DPF-certified.
All processors listed in Section 5 are DPF-certified at the time of writing. We will update this policy if that changes.
7. How Long We Keep Your Data
We retain personal data only for as long as necessary for the purpose it was collected, and in accordance with applicable legal requirements. Specific retention periods are set out in the table in Section 2. As a general guide:
Booking and financial records: 6 years from the end of the financial year in which the transaction took place, in line with HMRC guidance
Programme participation records: 2 years after your programme ends
Newsletter subscriber data: retained while you remain subscribed; deleted within 30 days of an unsubscribe request
Diagnostic tool responses: retention period disclosed at the point of collection
8. Your Rights Under UK GDPR
As a data subject, you have the following rights. These rights are not absolute in every circumstance, but we will respond to all requests within one calendar month.
Your right
What it means
Access : You can request a copy of the personal data we hold about you (a Subject Access Request).
Rectification: You can ask us to correct any inaccurate or incomplete personal data.
Erasure: You can ask us to delete your personal data where there is no compelling reason for us to continue holding it. This right does not apply where we are legally required to keep records.
Restriction: You can ask us to restrict how we use your data whilst a complaint or correction is being resolved.
Portability: Where we process your data by automated means on the basis of consent or contract, you can ask us to provide it in a machine-readable format.
Object: You can object to processing based on legitimate interests, including direct marketing. We will stop unless we can demonstrate compelling legitimate grounds.
Withdraw consent: Where we rely on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
To exercise any of these rights, please contact us at hello@radicallyhopeful.org. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.
9. Self-Diagnostic Tool (Coming Soon)
We are developing an online self-diagnostic tool for doctoral researchers, which will be offered alongside our coaching and programme services. This tool will collect personal data, including responses to questions about your research experience, working patterns, and academic context.
When the tool launches, this policy will be updated to include full details of: the specific data collected, the purpose and lawful basis for processing, whether responses are stored individually or in aggregate, how long responses are retained, and whether any data is shared with third parties.
We will collect your informed consent before you use the diagnostic tool, and will not process your responses for any purpose beyond those disclosed at that time.
10. Cookies
Our website is hosted on Squarespace, which uses cookies to support website functionality and collect aggregate analytics data. Cookies are small text files placed on your device when you visit our website.
We use the following types of cookies:
Strictly necessary cookies — required for the website to function correctly (for example, maintaining your session when booking)
Analytics cookies — used by Squarespace to understand how visitors use our website. Data is aggregated and not linked to individual identities
You can manage or disable cookies through your browser settings. Disabling cookies may affect the functionality of our booking system. Our cookie banner on first visit gives you the option to accept or decline non-essential cookies.
11. Security
We take the security of personal data seriously. Our website is served over HTTPS, and payment data is handled exclusively by Stripe, which is PCI DSS Level 1 certified. We do not store payment card details.
We limit access to personal data to those within our organisation who have a legitimate need to process it. No system of data storage is entirely secure; if we become aware of a breach affecting your personal data, we will notify you and the ICO as required by law.
12. Changes to This Policy
We may update this Privacy Policy from time to time, for example when we introduce new services, use new technology, or in response to changes in data protection law. The most current version will always be available on our website.
Where changes are material — for example, if we begin to process your data for new purposes — we will notify you directly by email where we hold your contact details.
The version number and date at the top of this document indicate when it was last revised.
13. Contact Us and How to Complain
If you have any questions about this Privacy Policy, want to exercise your rights, or have a concern about how we handle your data, please contact us:
Post
23 Baydon Drive, Reading, RG1 6JB, UK
Website
If you are not satisfied with our response, or if you believe we are processing your personal data unlawfully, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Website: ico.org.uk
Helpline: 0303 123 1113
Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5A
This policy is written in plain English in keeping with the UK GDPR requirement that privacy information be provided in a concise, transparent, and easily accessible form. If any part of this policy is unclear, please contact us at hello@radicallyhopeful.org and we will be happy to explain.