Privacy Policy
Introduction
This privacy notice explains how the International Coaching Federation UK Charter Chapter (“UK ICF”, “we”, “us”, “our”) collects and uses your personal data when you contact us, visit our website, become or renew as a member, attend our events, apply for a volunteer or board role, raise or are the subject of an ethics complaint, or otherwise use our services. It also explains the rights you have and how to use them.
Part 2 of this document is our Cookie Policy, which explains how we use cookies and similar technologies on our website.
If you have any questions about this notice or how we use your personal data, please contact our Data Protection Lead using the details in section 2.
This privacy notice was last updated on [09 October 2026].
Who we are and how to contact us
Name:International Coaching Federation UK Charter Chapter
Address: 59Birmingham Road, Lichfield, Staffordshire, WS13 6PG
Telephone: 01922 660088
Data Protection Lead: contactable at admin@coachingfederation.org.uk
We are the “controller” of your personal data. This means we decide how and why your personal data is used, and we are responsible for looking after it in line with UK data protection law, including the UK General Data Protection Regulation (“UK GDPR”),the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (“PECR”).
We are registered with the Information Commissioner’s Office (“ICO”). Our registration number is ZA848217.
The International Coaching Federation (“ICF Global”), based in the United States, is a separate organisation. Where ICF Global collects your personal data directly (for example, when you join ICF Global or apply for an ICF credential), itis responsible forthat data and its own privacy notice applies: [ICF Global privacy notice].
The personal data we collect
Personal data is any information that relates to a person who can be identified from it. Depending on how you interact with us, we may collect the following:
| Type of data | Examples |
|---|---|
| Identity and contact details | Name, title, postal address, email address, telephone number. |
| Membership details | Membership number and type, joining and renewal dates, ICF Global membership status, your employer (for Coaching in Organisations membership). |
| Professional and credential information | Coaching qualifications and training, ICF credential level, coaching experience, accreditation application details and assessment outcomes, all details are collected by the Global ICF |
| Event information | Event bookings and attendance, dietary requirements, accessibility needs, and photographs or recordings taken at events and webinars. |
| Financial information | Invoices, payment amounts and dates, and transaction references. Card payments are handled by our payment provider, and we do not store your full card details. |
| Volunteer and board information | Applications, CVs, references, skills and experience, declarations of interest, and dates of appointment. |
| Ethics complaint information | Details of complaints made by or about a member, supporting evidence, correspondence, interview notes and outcomes. |
| Communications and preferences | Your correspondence with us, survey responses and your marketing preferences. |
| Website and technical data | IP address, device and browsertype, pages visited, and cookie identifiers (see Part 2). |
When we ask you for information, we will make clear which details are required (for example, the details we need to process your membership or event booking) and which are optional.
If you do not provide the required details, we may not be able to provide the membership, event or service you have asked for.
Special category and criminal offence data
Some types of personal data are more sensitive and need extra protection. These include information about health, racial or ethnic origin, religious beliefs, sexual orientation, and information about criminal allegations or convictions.
We do not routinely ask for this type of information. We may, however, process it in the following limited situations:
- Accessibility and dietary requirements for events – only if you choose to tell us, and only to make arrangements for you. We rely on your explicit consent, which you can withdraw at any time.
- Emergencies – if you are taken ill at one of our events, or a safeguarding concern arises, we may share relevantinformation with emergency services where it is necessary to protect your vital interests orthose of another person.
- Ethics complaints – a complaint may include sensitive information. We only use it where it is necessary for the establishment, exercise or defence oflegal claims, or where another condition in UK GDPR Article 9 or Schedule 1 of the Data Protection Act 2018 applies. All ethical and compliance queries must go directly to the confidential ICF Ethics Assist line at ethics@coachingfederation.org or +1.859.226.4245.
How we get your personal data
Directly from you – for example, when you join or renew your membership, book an event, subscribe to our newsletter, apply for a volunteer role, contact us or complete a survey.
From other people and organisations – for example:
- your employer, ifthey arrange your Coaching in Organisations membership;
- ICF Global, which shares membership and credential status information with us;
- assessors, where they are involved in a credential or accreditation process;
- people who raise an ethics complaint, or who provide information as part of an investigation;
- referees you nominate when applying for a volunteer or board role;
- publicly available sources, such as the ICF Credentialed Coach Finder or your professional profile.
Automatically – when you visit our website, we collecttechnical information such as your IP address and, where you allow it, information from cookies and similar technologies. See Part 2 for details.
How we use your personal data, our lawful basis and how long we keep it
We can only use your personal data when we have a lawful basis to do so. The table below sets out each purpose,the lawful basis we rely on and how long we keep the data.
| What we use your data for | Our lawful basis | How long we keep it |
|---|---|---|
| Processing and administering memberships, managing renewals, keeping membership records and sending service messages about your membership | Contract – this is necessary to provide your membership. | 6 years after your membership ends |
| Administering Coaching in Organisations memberships arranged by your employer | Legitimate interests – providing the membership your employer has arranged for you. | 6 years after your membership ends |
| Assessing and validating coach credentials and training programme accreditation applications is handled directly by the Global ICF and not by the UK Chapter. | Contract, and legitimate interests in maintaining professional coaching standards. | 10 years after credential expiry |
| Managing event, webinar and conference registrations, payments and delivery, including sharing attendee lists with venues | Contract. Explicit consent for any accessibility or health-related dietary information you choose to give us. | 3 years after the event. Accessibility and dietary information:1 month after the event |
| Taking photographs and recordings at events and webinars and using them to promote the Chapter | Legitimate interests – promoting our activities and sharing learning. We will tell you at the event, and you can ask not to be featured. [Use consent instead if individuals are the main focus of an image.] | 3 years, or until you ask us to remove it |
| Sending newsletters, event promotions and industry updates by email | Members and people who have booked our events: legitimate interests, using the “soft opt-in” under PECR. Everyone else: consent. See section 6. | Until you unsubscribe. We keep a minimal record of your opt-out so that we do not contact you again. |
| Asking for feedback through surveys | Legitimate interests – improving our services and events. | 2 years |
| Responding to enquiries and general correspondence | Legitimate interests – responding to you. Where you are asking about joining or booking, steps before entering into a contract. | 2 years after our last contact |
| Keeping our website secure and working properly | Legitimate interests – running a secure and functioning website. | Server logs:12 months |
| Understanding how our website is used (analytics) | Consent, given through our cookie banner. | 26 months |
| Online advertising, measuring advert performance and showing you our adverts on other websites | Consent, given through our cookie banner. | Until you withdraw consent. Cookie durations are set out in Part 2. |
| Processing payments, issuing invoices and keeping statutory accounts | Legal obligation (finance and tax law) and contract. | 6 years from the end of the financial year |
| Recruiting, onboarding and supporting volunteers and board directors | Legitimate interests – running the Chapter with suitable volunteers. Legal obligation for statutory director records. | 6 years from the end of the term. Unsuccessful applicants: 6 months |
| Investigating ethics complaints against members and taking disciplinary action where necessary | Legitimate interests – upholding the professional and ethical standards of coaching and protecting the public. See section 3 for sensitive data. | 7 years after the case is closed |
| Handling data protection rights requests and complaints, and managing personal data breaches | Legal obligation. | Requests and complaints: 3 years after closure.Breach records: 6 years |
| Sharing information with the police, regulators or courts, or to deal with legal claims | Legal obligation, or legitimate interests (including recognised legitimate interests – see below). | As long as necessary for that purpose |
When we no longer need your personal data, we securely delete it or anonymise it so that you can no longer be identified. We may keep anonymised data for longer to analyse trends and produce reports.
Our lawful bases explained
Contract – the processing is necessary to provide a service you have asked for, such as membership or an event booking, or to take steps you have asked for before entering into a contract.
Legal obligation – the processing is necessary for us to comply with the law, for example keeping financial records for tax purposes or responding to a lawful request from the police.
Legitimate interests – the processing is necessary for our legitimate interests (or those of someone else), and those interests are not overridden by your rights and interests. We only rely on this when the privacy impact on you is low and you would reasonably expect us to use your data in that way. The specific interests we rely on are set out in the table above. You have the right to object to processing based on legitimate interests (see section 10).
Recognised legitimate interests – UK data protection law now lists certain purposes, such as detecting or preventing crime, safeguarding vulnerable people and responding to emergencies, for which organisations may use personal data without carrying out a separate balancing test. We may rely on this where, for example, we need to share information with the police or with safeguarding authorities.
Consent – you have given us clear permission to use your personal data for a specific purpose. You can withdraw your consent at any time by contacting us, using the unsubscribe link in our emails or changing your cookie settings. Withdrawing consent does not affect anything we did before you withdrew it.
Vital interests – in rare situations, we may need to share your personal data to protect your life or someone else’s, for example if you are taken ill at one of our events.
If our purposes change
We will only use your personal data for the purposes set out above, or for a new purpose that is compatible with them. If we need to use your personal data for an unrelated purpose, we will tell you and explain the lawful basis that allows us to do so before we start.
Marketing
We would like to keep you informed about our events, webinars, newsletters and coaching industry updates.
- Members and people who have booked our events: we may send you emails about our own similar events and services. You will be given the chance to opt out when you first give us your details and in every email we send.
- Everyone else: we will only send you marketing emails if you have opted in.
You can unsubscribe at any time using the link in our emails or by contacting us. Your right to opt out of marketing is absolute – if you ask us to stop, we will. We will continue to send you essential service messages, such as membership renewal reminders and event joining instructions.
We do not sell your personal data, and we do not share it with other organisations for their own marketing.
Who we share your personal data with
We only share your personal data where the law allows us to and where it is necessary for one of the purposes in section 5.
Service providers acting on our behalf (processors)
These organisations process personal data only on our instructions. We have written contracts with each of them requiring them to keep your data secure, use it only as we instruct and delete or return it when the service ends.
- CRM and membership database provider WordPress
- Email and communications platforms Google
- Website and IT hosting providers, including cloud storage 20i
- Payment processors Stripe
- Event booking and video conferencing platforms [Zoom]
- External assessors and IT forensic providers, where we engage them.
Other organisations that make their own decisions about your data (controllers)
- ICF Global – to administer membership and credentials and to deal with ethics complaints through the ICF Global Ethics team
- Independent investigators appointed in ethics cases
- Professional advisers – such as our lawyers, accountants and insurers
- Venues and event partners – attendee names and, where you have given them to us, accessibility requirements
- Advertising platforms (Meta, LinkedIn and Google) – only if you accept marketing cookies (see Part 2)
- The police, HMRC, regulators and courts – where we are required or permitted by law.
Transferring your personal data outside the UK
Some of the organisations we share data with are based outside the UK, or store data outside the UK. In particular, ICF Global and several of our service providers are based in the United States. We only transfer personal data outside the UK where it will be protected to a standard that is not materially lower than in the UK. We do this by relying on one of the following:
- the country or organisation has been approved under UK data protection law as providing adequate protection – for example, countries in the European Economic Area, or US organisations certified under the UK Extension to the EU–US Data Privacy Framework (the “UK–US data bridge”); or
- appropriate safeguards are in place, such as the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; or
- a specific exception applies – for example, the transfer is necessary to provide a service you have asked for, or you have given your explicit consent.
Our main transfers are: [ICF Global – USA – IDTA/Addendum]; [Google – USA – UK–US data bridge]; [CRM provider – country – safeguard]; [email platform – country – safeguard]. You can contact us for more information or a copy ofthe safeguards we use.
Keeping your personal data secure
We have appropriate technical and organisational measures in place to protect your personal data from loss, misuse and unauthorised access. These include access controls, multi-factor authentication, encryption where appropriate, confidentiality commitments from our staff and volunteers, and contracts with our service providers. If a personal data breach is likely to put you at high risk, we will tell you without undue delay.
Your rights
Under UK data protection law you have the following rights. Some apply only in certain circumstances.
- Right of access – to ask for a copy of the personal data we hold about you and information about how we use it.
- Right to rectification – to ask us to correct personal data that is inaccurate or complete data that is incomplete.
- Right to erasure – to ask us to delete your personal data in certain circumstances.
- Right to restrict processing – to ask us to limit how we use your personal data in certain circumstances.
- Right to object – to object to us using your personal data on the basis of legitimate interests, on grounds relating to your particular situation. We will stop unless we have compelling legitimate grounds to continue, or we need the data for legal claims. You can object to direct marketing at any time, and we will always stop.
- Right to data portability – to receive personal data you have given us in a structured, commonly used, machine-readable format, or ask us to send it to another organisation. This applies when we rely on consent or contract and the processing is automated.
- Right to withdraw consent – where we rely on your consent, you can withdraw it at any time.
- Rights relating to automated decision-making – we do not make decisions about you with legal or similarly significant effects based solely on automated processing. If you accept marketing cookies, our advertising partners may use them to build a profile of your interests to show you relevant adverts; you can refuse or withdraw this at any time through our cookie settings.
How to exercise your rights
To exercise any of these rights, please contact our Data Protection Lead using the details in section 2. There is usually no charge. We may need to ask you for proof of identity, or for more information to help us find what you are looking for. The time limit for our response starts once we have received what we need.
We will respond within one month. If your request is complex, or you have made a number of requests, we may extend this by up to two further months; if so, we will tell you within the first month and explain why. When responding to access requests, we will carry out reasonable and proportionate searches for your personal data.
You can find more information about your rights on the ICO website: https://ico.org.uk/for-the-public/
How to complain
Complaining to us
If you are unhappy with how we have used your personal data, or how we have handled a request, please tell us first so that we can try to putthings right. You can complain:
- by emailto admin@coachingfederation.org.uk
- by post to the Data Protection Lead, International Coaching Federation UK Charter Chapter, 59Birmingham Road, Lichfield, Staffordshire, WS13 6PG; or
- by telephone on 01922 660088.
We will acknowledge your complaint within 30 days of receiving it. We will look into it without undue delay, keep you updated on our progress and tell you the outcome.
Complaining to the ICO
If you are not satisfied with our response, you have the right to complain to the Information Commissioner’s Office. The ICO will usually expect you to have raised your concern with us first.
Website: https://ico.org.uk/make-a-complaint/
Helpline: 0303 123 1113
Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Changes to this privacy notice
We review this privacy notice regularly, and at least once a year. The date at the top shows when it was last updated. If we make significant changes, we will tell you by email or by a notice on our website before the changes take effect.