Business outreach privacy notice

Last updated: 23 September 2026

Who I am

I am Jessica Sandall, a sole trader trading as Jessica Sandall Coaching. I am responsible for deciding how the personal information described in this notice is used (the data controller).

For privacy questions or requests, email jessica@jessicasandall.com.

Information I collect and its sources

I collect limited professional information to identify businesses that may benefit from my coaching. This may include your name, role, business email address, company name, location and relevant public information about your business, such as recruitment or expansion.

Sources include company websites, public professional profiles, company registers and published business news. I record the source of research and can tell you where your details came from. I also keep relevant correspondence, delivery information, booking status and your contact preferences.

Why I use it

I use this information to assess whether my services may be relevant to your professional role, personalise a business introduction, manage limited follow-ups, respond to enquiries and respect requests not to be contacted.

My lawful basis for relevant business outreach is legitimate interests: developing my coaching business by introducing services to appropriate business decision-makers. I assess relevance, necessity and the potential impact on your privacy. This does not override marketing rules requiring consent for particular recipients or channels.

You are not required to reply or provide further information. If you request a booking, the necessary contact and appointment information is used to arrange it. Where you are personally entering a contract, this is to take steps at your request before entering that contract. Where you act for a business, my legitimate interest is handling that business enquiry.

AI assistance and service providers

I use Google Workspace to manage email and OpenAI services, including ChatGPT and Sites, to assist with business research, draft communications, review relevant responses and maintain an outreach tracker. Relevant professional details and correspondence may be processed by those services and their authorised service providers. AI can help assess professional relevance; it is not used to make decisions about you with legal or similarly significant effects.

If you book, Calendly handles scheduling information and Stripe processes payment for paid appointments. Their own privacy information also explains processing they undertake for their own purposes. I do not add cold outreach contacts to my Kit newsletter solely because I have contacted them.

International processing

These services may process information outside the UK, including in the United States. Their published terms describe transfer arrangements, including recognised adequacy arrangements where applicable, or contractual safeguards such as standard contractual clauses adapted for UK transfers.

OpenAI’s business data-processing terms specify standard contractual clauses with the UK Addendum for UK data. Calendly’s terms describe reliance on the applicable Data Privacy Framework and contractual fallback arrangements. Google and Stripe publish their transfer provisions in the documents linked below. You can contact me for information about the safeguards applicable to your data and how to obtain a copy, with confidential information redacted where necessary.

• Google data-processing terms

• OpenAI data-processing terms

• Calendly data-processing terms

• Stripe data-processing terms

Retention

For prospects who do not respond, I delete identifiable outreach research and correspondence from my active records within six months of the final outreach. If no contact is made, I delete unused research within one month of collection.

Where an enquiry develops, I retain relevant enquiry records for up to six months after the discussion ends. Client, transaction and complaint records may require separate retention for their relevant purposes; this notice does not set the retention period for coaching or accounting records.

If you object to marketing, I keep a minimal suppression record, such as your email address and the date of your objection, for as long as I operate outreach where it is needed to prevent further contact. I review that need annually. This record is not used to restart marketing.

Deletion from active records does not mean immediate deletion of every supplier backup. Residual copies may remain for the supplier’s applicable deletion and backup periods, subject to their controls.

Your choices and rights

You can object to direct marketing at any time by replying to an email or contacting jessica@jessicasandall.com. I will stop marketing to you.

Depending on the circumstances, you can also request access, correction, erasure or restriction, object to other processing based on legitimate interests, and request portability where that right applies. These rights are subject to applicable legal conditions. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing.

You can complain directly to the Information Commissioner’s Office; you do not have to complain to me first.