Privacy Policy
Terms of Use · Community Guidelines
The Coach Exchange
Last updated: [DATE]
Draft for solicitor review. Prepared on 20 October 2026 for The Coach Exchange, run by CollaborativeBD. It is a starting point, not legal advice, and should be checked by a solicitor before launch, together with the Terms of Use. Suppliers are assumed to be the same as Sales Outreacher's (Supabase, Vercel, Resend); confirm before launch.
1. Who we are
1.1 The Coach Exchange (the "community") at thecoachexchange.collaborativebd.com is run by Collaborative Business Development Limited, trading as CollaborativeBD, a company registered in Scotland under company number SC537302, whose registered office is at Provender House, Waterloo Quay, Aberdeen AB11 5BS ("we", "us", "our").
1.2 We are the controller of your personal information. This means we decide how and why it's used, and we're responsible for looking after it under UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1.3 We're registered with the Information Commissioner's Office (ICO) under registration number ZC256316.
1.4 For anything about your personal information, contact us at coachexchange@collaborativebd.com or write to us at Provender House, Waterloo Quay, Aberdeen AB11 5BS.
2. What this policy covers
This policy explains what personal information we collect when you apply to join, use the community, or contact us; why we use it; who we share it with; how long we keep it; and your rights. It also applies to people who are invited to apply but don't.
3. The short version
- Other members see you only by a random member number. Only our team knows who you are.
- We never sell your information.
- We never share your details with another business, other than the suppliers that run the community for us (section 9).
- You choose which optional emails you get.
- You can ask us to delete your information at any time.
4. What we collect
4.1 When you apply:
- your name, email address and business name;
- whether your business delivers coaching to clients, how many staff you have, and where your business is based;
- the challenge categories you tick, your top three challenges, and the software you pay for;
- whether you're happy to test early versions or be named in public updates;
- where you heard about The Coach Exchange; and
- your agreement to our terms and the confidentiality statement.
From your email address we may look at your business's public website to check your application.
4.2 If you become a member:
- your member number and founding member status;
- your password, which is held hashed by our sign-in provider and is never visible to us, and your two-step sign-in settings;
- your settings, including notification choices, digest day, time zone, and the conversations and categories you follow; and
- when you joined and your access status.
4.3 What you do in the community:
- your posts, replies, likes and dislikes;
- your questionnaire answers, poll votes, votes on the shortlist and "I need this too" backing;
- reports you make about posts;
- feedback session bookings and, if everyone attending agrees, a recording or transcript made by our AI note-taker during the session (see section 7);
- private messages between you and our team;
- your answers to occasional check-in questions about how the community is working for you; and
- if you leave, the reason you give, if you choose to give one.
4.4 Technical information: when you use the community we automatically collect information such as your IP address, browser and device type, the pages you visit and when, and security logs. See section 13 on cookies.
4.5 From other people: if a member invites you to apply, they give us your name and email address and, optionally, a short note.
4.6 If you decline or are declined: we keep your application for up to 6 months (see section 10).
4.7 Information we don't want: please don't post sensitive information about yourself (such as health, religion or ethnicity) or any information about your clients. If you do, we may remove it.
5. How we use your information, and our lawful bases
UK data protection law says we must have a lawful basis for each way we use personal information.
| What we do | Lawful basis |
|---|---|
| Review your application, check you meet the criteria, and tell you the outcome | Legitimate interests: running an invite-only community for genuine business coaches. Also steps you ask us to take before you join |
| Create and run your account, give you a member number, and provide the community | Contract: providing the membership you've asked for under our Terms of Use |
| Show your posts to other members by member number only | Contract |
| Send account, security and rules emails, and essential announcements that affect every member | Contract and legitimate interests: keeping members informed and accounts secure |
| Send optional emails, such as the weekly digest, replies to your posts and updates, according to your Settings | Legitimate interests: keeping you up to date with the community. You can change or stop these at any time |
| Moderate content, deal with reports, and enforce our terms | Legitimate interests: keeping the community safe, honest and useful |
| Send you private messages, and reply to messages you send our team | Legitimate interests: helping members and running the community |
| Analyse posts, questionnaire answers and votes to understand coaches' challenges, score them, and publish findings that don't identify anyone | Legitimate interests: the purpose of the community is to understand these challenges and design software for them |
| Design, build, test and improve software and other products based on what members share | Legitimate interests: as above |
| Name you publicly (for example in an update or as a founding member) | Consent: only if you've told us you're happy to be named. You can withdraw it at any time |
| Tell you about software or products we sell in the future | Consent, where the law requires it, or legitimate interests where it doesn't. You can opt out at any time |
| Contact someone invited by a member | Legitimate interests: growing the community through people members know |
| Understand how members find us and use the community (for example, which routes bring members, how active conversations are, how long things take), using records that show member numbers only, so we can improve it and share what we've learned without identifying anyone | Legitimate interests: running and improving the community |
| Keep the community secure, prevent misuse and fraud | Legitimate interests |
| Keep records we're required to keep, respond to legal requests, and establish or defend legal claims | Legal obligation and legitimate interests |
Where we rely on legitimate interests, we've considered your interests and rights and believe they're not overridden by ours. You can ask us for more detail, and you have the right to object (see section 11).
6. Member numbers and anonymity
6.1 Other members see you only by your random member number. Member numbers aren't in order, so they don't reveal when you joined or how many members there are.
6.2 Your name, email address and business name are visible only to our team. Team members with "Moderator" access can't see applications or member details.
6.3 Your member number is never given to any other business.
6.4 When we analyse conversations, including with the help of AI tools, we use exports that show members by member number only, with no names or contact details.
6.5 What you write could still identify you to others, for example if you mention your business. Please think about this before you post.
7. Using AI tools
We may use artificial intelligence (AI) services to help us analyse conversations and questionnaire answers, for example to spot common themes. We only use exports that show member numbers, not names or contact details. We use AI providers under business terms that don't allow them to use our data to train their models. No decisions with legal or similarly significant effects on you are made by automated means alone.
In feedback sessions, we may use an AI note-taker (Fathom) to record and transcribe what's said. It's the only one allowed, and we only switch it on if everyone attending agrees at the start. It will capture the name you join with, your voice and your image if your camera is on.
We keep the recording, so we can go back to what was said as the platform is designed and built. We use the transcript internally, including with AI tools, only to analyse feedback for The Coach Exchange and the software it shapes. Before we analyse a transcript with AI, we replace names with member numbers. Recordings and transcripts are only seen by our team and the suppliers in section 9. We never publish them or share them with anyone else, and we never use them to market to you. How long we keep them is in section 10.
8. Who we share your information with
8.1 We never sell your personal information.
8.2 We share it only with:
- Service providers who help us run the community and act only on our instructions, under contracts that require them to protect it. They're listed in section 9, together with AI service providers (section 7) and, if we take payments in future, our payment provider.
- Professional advisers, such as our lawyers, accountants and insurers, where needed.
- Authorities, regulators or courts, where the law requires it, or to protect the rights, property or safety of us, our members or others.
- A buyer or successor, if all or part of our business is sold or reorganised. They would have to use your information in line with this policy.
8.3 Other members see your posts and your member number, as explained in section 6.
9. Where your information is held, and who holds it
Where your information is stored isn't the same as which company holds it, and the second decides whose laws can reach it, so we answer both.
Your account and everything you post are stored in London, and the community is served from London. But our suppliers are companies based outside the UK, so their staff can reach what they store for us, and those transfers rely on the standard legal safeguards rather than on the information never leaving the UK.
- Database: Supabase. The database is in London. That's where accounts, applications, posts and questionnaire answers live. We contract with Supabase Pte. Ltd in Singapore, so transfers are covered by the Standard Contractual Clauses and the UK Addendum.
- Application: Vercel. Served from London. We contract with Vercel, Inc. in the United States, and its data processing addendum applies the Standard Contractual Clauses to anything transferred outside the UK or the European Economic Area.
- Email: Resend. Sign-in, password and notification emails, including the weekly digest. Resend stores its data in the United States and offers no European storage option. Sending is routed through its European region, but storage is not, so the record of an email sent to you, which includes your email address, is held in the United States under the Standard Contractual Clauses, the UK Addendum and Resend's certification under the EU-US Data Privacy Framework.
- Feedback sessions: Microsoft Teams (Microsoft Corporation, under its data protection addendum and the Standard Contractual Clauses), and our AI note-taker, Fathom (Fathom Video Inc., United States). Fathom holds session recordings and transcripts in the United States, under its certification to the UK Extension to the EU-US Data Privacy Framework, with the Standard Contractual Clauses and the UK Addendum in its data processing agreement as a fallback.
- AI analysis. When we use an AI service to analyse anonymised exports (section 7), the provider may process them outside the UK under equivalent safeguards. These exports contain member numbers, not names or contact details.
- Payments (future). If we take payments in future, they'll be handled by Stripe, which will be added here before that happens.
We'd rather say this plainly than claim everything stays in the UK, which is the easier sentence and isn't true.
10. How long we keep your information
| Information | How long |
|---|---|
| Applications that aren't approved | Deleted within 6 months |
| Invitations that aren't taken up | Deleted within 6 months of the invitation |
| Your account and member details | While you're a member. If you ask us to delete your data, we do so within one month |
| Your posts, after you leave | As you choose when you ask us to delete your data: kept but shown as "Former member", so they can't be linked to you, or removed |
| Questionnaire answers and votes | Kept only as anonymous totals after you leave, with nothing linking them to you |
| Private messages between you and our team | 24 months after the conversation ends |
| Feedback session recordings and transcripts | 3 years from the session, then deleted. We review them every year and delete any we no longer need sooner. If you ask us to delete your data, we replace your name with "Former member" in transcripts, and we'll delete or edit out your part of a recording where we reasonably can |
| Technical and security logs | 12 months |
| A record that a deletion request was made and completed (no other personal details) | 6 years, so we can show we met our obligations |
| Backups | Removed as backups are overwritten, normally within 30 days |
We may keep information for longer where the law requires it or to deal with a legal claim. If you stop using the community for a long time, we may contact you to ask whether you want to stay a member.
11. Your rights
You have the right to:
- access the personal information we hold about you and get a copy ("Request a copy of my data" in Settings);
- correct information that's wrong or incomplete;
- delete your information ("Request deletion of my data" in Settings);
- restrict how we use your information in certain circumstances;
- object to us using your information where we rely on legitimate interests, including at any time for direct marketing;
- data portability: receive information you gave us in a commonly used format, or have it sent to another organisation, where this applies; and
- withdraw consent at any time, where we rely on consent. This doesn't affect what we did before you withdrew it.
To use any of these rights, use your Settings or email coachexchange@collaborativebd.com. We'll respond within one month. We may need to confirm your identity first. There's normally no charge.
12. How we protect your information
We use appropriate technical and organisational measures to protect your information, including encryption in transit, encrypted password storage, optional two-step sign-in, access limited to the team members who need it, and automatic checks that stop contact details being posted. Access to members' details is limited to the team members whose work requires it. If personal information we hold is lost or exposed and it's likely to put people at risk, we'll tell the ICO within 72 hours of becoming aware of it, and we'll tell the people affected without undue delay where the risk to them is high.
13. Cookies
13.1 Cookies are small files stored on your device. We use only sign-in cookies, which keep you signed in and your account secure. These are strictly necessary, so they don't need your consent.
13.2 There's no advertising or analytics tracking. We don't track whether you open our emails or click the links in them. If that ever changes, we'll ask for your consent first and you can change your mind at any time.
14. Children
The community is only for people aged 18 or over. We don't knowingly collect information about children.
15. Information about other people
Please don't post information about your clients or anyone else. If you invite someone to apply, please make sure they're happy for you to give us their name and email address.
16. Changes to this policy
If this policy changes in a way that affects you, we'll tell you by email rather than quietly updating the date at the top: at least 30 days before the change takes effect, and at least 90 days before a change that widens what we do with your information. This matches the notice periods in our Terms of Use.
17. Questions and complaints
17.1 If you have a question or a concern about how we use your information, please contact us first at coachexchange@collaborativebd.com. We'll acknowledge your complaint within 30 days and try to resolve it.
17.2 You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk, telephone 0303 123 1113, or Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.
Collaborative Business Development Limited, Provender House, Waterloo Quay, Aberdeen AB11 5BS, United Kingdom. Registered in Scotland, number SC537302. Registered with the Information Commissioner's Office, number ZC256316.