Data protection policy

Our approach to proportionate, responsible handling of personal information.

Issue 1 · Updated 17 October 2026 · Contact: info@thinkingfreely.co.uk

Purpose and scope

This policy sets expectations for personal information used in enquiries, consultancy, audits and training. It applies to work undertaken for Thinking Freely Ltd. Client-specific arrangements must be agreed before processing client records.

Only what is needed

Collect and use information for a defined purpose and an appropriate lawful basis. Keep it relevant, accurate and limited to what is necessary. Avoid collecting identifiable employee, health or other sensitive records where anonymised evidence is sufficient.

Clear responsibilities

The person responsible for an engagement must establish what data is required, who may access it, whether Thinking Freely is acting as controller or processor, and any required confidentiality or processing terms. New uses and disclosures must be assessed before they take place.

Access, sharing and retention

Access should be limited to authorised people who need the information for their work. Transfers and sharing must use an agreed, appropriate method. Retention should be reviewed against the purpose, contract and applicable obligations; unnecessary copies should be removed securely.

Requests and incidents

Forward data rights requests and suspected personal data incidents promptly to info@thinkingfreely.co.uk. Relevant facts, risks and required actions must be assessed, including any obligation to notify affected people or the ICO within applicable time limits.

Review

Review this policy when services, systems or processing arrangements change. The privacy notice explains the information available to website visitors and enquirers.

Related information