Data Protection Policy

Trauma Informed Law

Effective Date: October 2024 / Last Updated: September 2026

Next Review Date: September 2027

Your Privacy at a Glance

At Trauma Informed Law, we know that trust is at the heart of our work. That is why we take care to collect only the information we need and to handle it responsibly.

What we may collect

Depending on how you interact with us, we may collect:

• your name and contact details;

• your organisation, role or professional details;

• information needed to provide our coaching, training, consultancy or online learning services;

• account and membership information;

• information about your use of the Vicarious Trauma Toolkit Hub, such as content accessed, learning progress and attendance at Live Learning Labs;

• information you choose to share with us;

• questions, feedback and other communications;

• payment and transaction information;

• contractor and supplier information; and

• basic technical and website information, such as IP address, device information, cookies and usage data.

We aim to collect only the information we genuinely need.

How we use it

We may use your information to:

• provide the services or membership you have requested;

• create and manage your account;

• administer the Vicarious Trauma Toolkit Hub;

• organise and deliver Live Learning Labs and other events;

• communicate with you about your services or membership;

• process payments and maintain appropriate business records;

• respond to questions, feedback and complaints;

• identify anonymised themes and learning from Live Learning Labs to help us develop reflective communications for Hub members;

• improve our services and learning experience;

• keep our systems and services secure; and

• meet our legal, regulatory, accounting and tax obligations.

Who we share it with

We do not sell, rent or trade your personal information.

We may share information with carefully selected service providers and professional advisers who help us run our business and deliver our services.

These may include providers supporting our:

• website and online services;

• video hosting;

• live online sessions;

• event bookings and registrations;

• payment processing;

• AI-assisted notetaking and transcription;

• IT and cloud storage;

• accounting and professional advice.

We may also share information where required by law or where necessary to protect the rights, safety or security of individuals or our services.

Your rights

You have a number of rights in relation to your personal information. Depending on the circumstances, these include the right to:

• ask to see the information we hold about you;

• ask us to correct inaccurate information;

• ask us to delete your information in certain circumstances;

• ask us to restrict how we use your information;

• object to certain types of processing;

• ask for certain information in a portable format; and

• withdraw your consent where we rely on your consent to process your information.

You can find more information below.

1. Introduction

At Trauma Informed Law, we take your privacy seriously.

This Policy explains how we collect, use and protect personal information in accordance with applicable UK data protection law, including the UK General Data Protection Regulation and the Data Protection Act 2018.

It applies to personal information we handle in connection with our coaching, training, consultancy, online learning, the Vicarious Trauma Toolkit Hub, Live Learning Labs, website and other business activities.

2. Who We Are

Trauma Informed Law (“TiL”, “we”, “us” or “our”) is the data controller responsible for the personal information covered by this Policy.

This means that we are responsible for deciding how and why your personal information is used.

If you have any questions or concerns about how we handle your information, please contact us at:

Email: info@traumainformedlaw.co.uk

3. When This Policy Applies

This Policy applies when you:

• visit our website;

• contact or communicate with us;

• enquire about or purchase our services;

• take part in coaching, training or consultancy;

• register for or use the Vicarious Trauma Toolkit Hub;

• attend a Live Learning Lab or other event or session;

• receive services from us through an organisation, employer, chambers or other organisation that has engaged us;

• work with us as a contractor, collaborator or supplier; or

• otherwise provide us with personal information.

4. The Personal Information We Collect

The information we collect will depend on your relationship with us and the services you use.

Clients, customers and learners

We may collect:

• your name;

• email address, telephone number and other contact details;

• your organisation, job title or professional role;

• information relating to the service or membership you have purchased;

• account and login information;

• payment and transaction information;

• communications, questions and feedback;

• information necessary to provide coaching, training or consultancy; and

• other information you voluntarily choose to share with us.

Vicarious Trauma Toolkit Hub members

If you register for or use the Vicarious Trauma Toolkit Hub, we may collect:

• account and membership information;

• information about the content you access;

• information about your progress through the Hub, where this functionality is enabled;

• attendance or booking information relating to Live Learning Labs or other events;

• questions or feedback you provide;

• technical information relating to your use of the Hub; and

• other information you choose to provide to us.

We use this information to provide and administer your membership, support your learning experience, manage Live Learning Labs, respond to queries and improve the Hub.

We may also use proportionate information about how the Hub is used to understand what content and resources are useful and how we can improve the learning experience.

Where possible and appropriate, we may anonymise or aggregate information before using it for analysis or service development.

Information shared in Live Learning Labs

Live Learning Labs provide an opportunity to explore and reflect on themes arising from the learning programme.

We do not require you to share personal experiences, health information or information about trauma in order to participate. You remain free to decide what you do and do not wish to share.

Please consider carefully what information you disclose and avoid sharing unnecessary confidential or identifiable information about clients, colleagues or other third parties.

We may use an AI-assisted notetaking or transcription service, such as Fireflies, to help us identify recurring themes, questions, insights and learning arising across Live Learning Labs.

Where we do so, we will make participants aware before or at the start of the relevant session.

Our purpose in using AI-assisted notetaking is not to monitor or assess individual participants or to create individual learner profiles. We use it to help us identify broader themes and learning arising from discussions.

We may use these anonymised and aggregated themes to create periodic reflective communications for Hub members, such as a monthly reflective email.

Before using themes or learning points in a wider communication, we will take care to remove personal, confidential or identifiable information. We will not intentionally identify an individual participant or attribute a comment, experience or reflection to a particular person without their express permission.

We do not routinely create detailed records of individual participants' personal contributions unless this is necessary for a clearly stated purpose.

Information provided by organisations

If your employer, chambers, firm or another organisation purchases access to the Hub on your behalf, we may receive information about you from that organisation.

This may include:

• your name;

• work email address;

• job title or role; and

• other information reasonably necessary to create and administer your Hub account.

We use this information to provide and administer your access to the Hub and to communicate with you about your membership.

Where an organisation has purchased access for a number of learners, we may provide that organisation with appropriate administrative information needed to manage its membership.

Unless we have clearly explained otherwise, we do not intend to provide an organisation with access to:

• your personal reflections;

• personal information you voluntarily share during a Live Learning Lab; or

• detailed personal contributions made in an interactive learning environment.

The information available to an organisational customer may depend on the membership arrangement and the functionality of the Hub platform. Where relevant, we will aim to be clear about what information may be shared.

Contractors, collaborators and suppliers

If you work with us, we may collect information necessary to manage that relationship, including:

• contact details;

• professional information;

• payment and bank details;

• contractual information; and

• other information reasonably required for administrative, legal or accounting purposes.

Website visitors

When you visit our website, we may collect technical information such as:

• your IP address;

• browser and device information;

• information about how you use our website; and

• information collected through cookies and similar technologies.

Please see our Cookie Notice for more information.

5. Sensitive and Special Category Information

Because some of our work includes trauma, vicarious trauma and wellbeing-related subject matter, there may occasionally be circumstances in which you choose to provide information relating to your health, wellbeing or personal experiences.

We do not require you to provide this type of information in order to access the Vicarious Trauma Toolkit Hub or participate in our general learning services.

If you voluntarily provide us with information that is classified as special category personal data under applicable data protection law, we will only process it where we have a valid legal basis and an additional condition for doing so.

We will seek to minimise the collection and retention of sensitive personal information wherever possible.

Please do not send us unnecessary sensitive personal information or confidential information about another person unless it is relevant and appropriate for the service you are receiving.

6. How We Use Your Personal Information

We use personal information for a number of purposes.

To provide our services

For example, to:

• respond to enquiries;

• deliver coaching, training or consultancy;

• create and manage Hub accounts;

• provide access to learning materials;

• administer memberships;

• organise and deliver Live Learning Labs and other events; and

• provide customer and technical support.

To manage our relationship with you

For example, to:

• communicate about your account or membership;

• send important service updates;

• respond to questions or complaints;

• manage payments and invoices; and

• maintain appropriate business records.

To identify broader learning and reflective themes

Where appropriate, we may review information generated through Live Learning Labs, including AI-generated notes or transcripts where an AI-assisted notetaking service has been used, to identify recurring themes, questions, insights and learning.

We may use these themes to develop anonymised and aggregated reflective communications for Hub members, such as a monthly reflective email.

We will not intentionally use an individual's personal contribution in a way that identifies them without their express permission.

To improve our services

We may use feedback, usage information and other proportionate information to understand how our services are being used and how we can improve them.

Where possible and appropriate, we may anonymise or aggregate information before using it for analysis or service development.

To keep our services secure

We may use information to:

• protect our systems;

• prevent misuse or fraud;

• investigate security issues; and

• enforce our terms and conditions.

To meet legal and regulatory obligations

We may retain or use information where necessary to meet legal, tax, accounting, insurance or other regulatory requirements.

7. Our Legal Bases for Using Your Information

Data protection law requires us to have a valid legal basis for processing personal information.

Depending on the circumstances, we may rely on:

Contract

Where we need to process your information to provide a service, membership or other agreement you have requested or entered into with us.

For example, this may include:

• creating your Hub account;

• providing access to membership content;

• administering your membership;

• organising a Live Learning Lab you have booked; and

• managing payment.

Legitimate interests

Where processing is reasonably necessary for our legitimate interests or those of a third party, provided that your rights and interests do not override those interests.

For example, this may include:

• managing and improving our services;

• understanding how our Hub is being used;

• identifying broader and anonymised learning themes arising from Live Learning Labs;

• developing reflective communications for Hub members;

• maintaining the security of our systems;

• responding to enquiries and communications; and

• preventing misuse or fraud.

Where we rely on legitimate interests, we will consider the potential impact on your rights and privacy.

Consent

Where we ask for your clear permission.

For example, this may include certain marketing communications or the use of non-essential cookies.

You can withdraw your consent at any time. This will not affect the lawfulness of processing carried out before you withdrew your consent.

Legal obligation

Where we need to process or retain information to comply with a legal obligation.

8. Marketing and Other Communications

We may send you important information about services or memberships you have purchased, including:

• account information;

• access details;

• payment or renewal information;

• changes to scheduled Live Learning Labs; and

• important changes to the Hub or our services.

These are service or administrative communications and are not the same as marketing communications.

Where we send you marketing communications, we will do so in accordance with applicable law and, where required, with your consent.

You can opt out of marketing communications at any time by using the unsubscribe option provided or by contacting us at info@traumainformedlaw.co.uk.

9. Who We Share Your Information With

We do not sell, rent or trade your personal information.

We use carefully selected third-party providers to help us run our website, deliver our services, administer the Vicarious Trauma Toolkit Hub, organise Live Learning Labs and process payments.

Depending on how you interact with us, these providers may include the following.

Squarespace

We use Squarespace to host and manage our website and to support website functionality.

Squarespace may process technical information and information you provide through our website.

Vimeo

We use Vimeo to host and deliver video content.

Depending on how the Hub is configured, Vimeo may process technical and usage information relating to your access to video content.

Zoom

We use Zoom to deliver Live Learning Labs and other online sessions.

Zoom may process information such as your name, email address, meeting attendance and technical information associated with your participation.

Fireflies

We may use Fireflies, an AI-powered notetaking and transcription service, in connection with Live Learning Labs.

Where Fireflies is used, it may process information relating to the session, including:

• participant names and other account information made available through the meeting;

• meeting and attendance information;

• audio from the session;

• transcripts;

• AI-generated summaries or notes; and

• other information included in the session where this is captured by the service.

Our purpose in using Fireflies is to help us identify recurring themes, questions, insights and learning arising across Live Learning Labs.

We may use these anonymised and aggregated themes to develop periodic reflective communications for Hub members, such as a monthly reflective email.

We do not use Fireflies to assess individual participants, monitor their performance or create individual learner profiles.

Recordings, transcripts and AI-generated notes will only be accessible to those who have a legitimate need to review them for the purpose described above.

We will normally delete recordings, transcripts and AI-generated notes created for this purpose within 60 days of the relevant Live Learning Lab, unless there is a legitimate reason to retain them for longer.

Ticket Tailor

We use Ticket Tailor to manage bookings and registrations for relevant events or Live Learning Labs.

Ticket Tailor may process information such as your name, contact details and booking information.

Stripe

We use Stripe to process payments.

Payment card details are generally collected and processed directly by Stripe rather than being stored by us.

We may receive information about payments and transactions necessary to manage your purchase, membership and our business records.

Other providers

We may also use other carefully selected providers for services such as:

• email and communications;

• cloud storage and IT services;

• accounting and bookkeeping;

• insurance;

• professional and legal advice; and

• website security and technical support.

We only share personal information where reasonably necessary for the relevant purpose.

Where another organisation processes personal information on our behalf, we take appropriate steps to ensure that suitable contractual and organisational safeguards are in place.

We may also disclose information:

• where required by law;

• to establish, exercise or defend legal claims; or

• where reasonably necessary to protect the rights, safety or security of individuals or our services.

10. International Transfers

Some of the third-party providers we use may process personal information outside the United Kingdom.

For example, providers involved in website services, video hosting, live online sessions, AI-assisted notetaking or payment processing may operate internationally or use infrastructure and service providers located in other countries.

Where personal information is transferred outside the United Kingdom, we will take appropriate steps to ensure that the transfer is protected in accordance with applicable UK data protection law.

Depending on the circumstances, this may include:

• transferring information to a country recognised as providing an adequate level of protection;

• using approved contractual safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses; or

• relying on another lawful transfer mechanism recognised under applicable data protection law.

If you would like further information about international transfers relevant to your personal information, please contact us at info@traumainformedlaw.co.uk.

11. How Long We Keep Your Information

We only keep personal information for as long as reasonably necessary for the purposes for which it was collected, including for legal, accounting, tax, insurance or dispute-resolution purposes.

The period we keep information for will depend on the nature of our relationship with you and the type of information involved.

For example:

• membership and account information may be retained for the duration of your membership and for an appropriate period afterwards;

• payment and transaction records may be retained for the period required for accounting, tax or legal purposes;

• information relating to an enquiry may be retained for a reasonable period while we deal with your enquiry and any follow-up;

• contractor and supplier records may be retained for as long as reasonably necessary for contractual, accounting and legal purposes;

• technical and website information will be retained in accordance with our Cookie Notice and the settings of the relevant technology providers; and

• recordings, transcripts and AI-generated notes created through Fireflies for the purpose of identifying broader learning themes will normally be deleted within 60 days of the relevant Live Learning Lab, unless there is a legitimate reason to retain them for longer.

We will not keep detailed learning activity or other personal information for longer than reasonably necessary.

When information is no longer required, we will securely delete it or anonymise it.

12. How We Protect Your Information

We take appropriate technical and organisational measures to protect personal information.

These may include:

• secure digital systems and storage;

• access controls so that information is only available to people who need it;

• appropriate password and account security measures;

• encryption and secure communications where appropriate;

• secure arrangements with relevant service providers; and

• procedures designed to reduce the risk of unauthorised access, loss or misuse.

No system can guarantee absolute security, but we take reasonable steps to protect the information we hold.

13. Your Data Protection Rights

Depending on the circumstances, you may have the right to:

Access

Ask for confirmation of whether we process your personal information and request a copy of it.

Correction

Ask us to correct inaccurate or incomplete personal information.

Erasure

Ask us to delete your personal information in certain circumstances.

Restriction

Ask us to restrict how we use your personal information in certain circumstances.

Data portability

Ask for certain personal information in a portable format.

Object

Object to certain processing, including processing based on legitimate interests and, where applicable, direct marketing.

Withdraw consent

Withdraw your consent at any time where we rely on consent to process your information.

These rights are not absolute and may depend on the circumstances and the legal basis on which we are processing your information.

To exercise any of these rights, please contact us at:

info@traumainformedlaw.co.uk

We will respond within the timescales required by applicable law.

14. Automated Decision-Making

We do not currently use your personal information to make decisions about you solely through automated processing that would have a legal or similarly significant effect on you.

If this changes, we will update this Policy and provide any additional information required by law.

15. Cookies and Similar Technologies

Our website and online services may use cookies and similar technologies.

Some cookies are necessary for our website or services to function.

Where we use non-essential cookies, such as analytics or marketing cookies, we will provide appropriate information and obtain consent where required.

You may be able to manage your cookie preferences through our cookie consent tool.

Please see our Cookie Notice for more detailed information about the cookies and similar technologies we use.

16. Links to Other Websites

Our website or Hub may contain links to other websites or services.

We are not responsible for the privacy practices of those third parties. We encourage you to read the privacy notices of any external websites or services you use.

17. Complaints

We aim to handle questions and concerns about personal information with care and transparency.

If you have concerns about how we use your information, please contact us first at:

info@traumainformedlaw.co.uk

We will do our best to resolve your concern.

You also have the right to make a complaint to the UK Information Commissioner's Office.

Further information is available from the Information Commissioner's Office.

18. Changes to This Policy

We may update this Policy from time to time to reflect changes to our services, the way we process personal information or our legal obligations.

Where we make significant changes, we will take reasonable steps to bring them to your attention.

The latest version will be available on our website.

19. Contact Us

If you have any questions about this Policy or how we handle your personal information, please contact:

Trauma Informed Law

Email: info@traumainformedlaw.co.uk