Last updated: 04.07.2026

This Privacy Policy explains how Hannah Alley Consulting (“we”, “us” or “our”) collects, uses, stores, shares and protects personal data.

We are committed to handling personal data lawfully, fairly and transparently, in accordance with the UK General Data Protection Regulation, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations, and other applicable privacy laws where relevant.

This policy applies when you visit our website, submit an enquiry or application form, communicate with us, subscribe to updates, engage our services, or otherwise interact with Hannah Alley Consulting.

1. Who we are

Data Controller: Hannah Alley Consulting
Website: www.hannahalley.co.uk
Email: hannahalleyconsulting@outlook.com
If you need to contact us by post in relation to a data protection matter, please email us first and we will provide an appropriate correspondence address where required.

Hannah Alley Consulting provides strategic marketing, brand, partnership, retail, commercial and fractional CMO consultancy services for fashion, jewellery, luxury, premium and founder-led brands.

For most personal data described in this Privacy Policy, Hannah Alley Consulting acts as the data controller and determines why and how that information is processed.

In limited circumstances, a client may provide personal data for Hannah Alley Consulting to process solely on that client’s documented instructions as part of a professional engagement. Where Hannah Alley Consulting acts as a data processor rather than an independent controller, the relevant client remains responsible for its obligations as controller and any additional data-processing terms required by law will apply.

2. Personal data we collect

We may collect and process the following types of personal data.

Information you provide directly

This may include:

• your name;
• business or brand name;
• job title or professional role;
• email address;
• phone number, if provided;
• website or social media handles;
• information submitted through enquiry, contact or application forms;
• information shared in emails, calls, documents, proposals, briefs or meetings;
• details about your business, brand, project, objectives, challenges, budget, timeline or commercial priorities;
• payment, billing or invoicing details where you become a client;
• any other information you voluntarily choose to share with us;
• information provided when booking a Strategic Intensive or other service, including the service selected, booking date, availability, time zone and booking-related communications;
  information submitted through Strategic Intensive briefing forms, diagnostic forms and questionnaires;
  business and commercial information relevant to the engagement, which may include business performance, revenue priorities, budget or investment ranges, marketing expenditure, campaign performance, commercial opportunities, retailer or wholesale information, agency or supplier information, partnership information and strategic priorities;
  documents and files uploaded for review, including presentations, pitch decks, proposals, spreadsheets, reports, strategy documents, commercial or pricing information, campaign plans, CRM plans, retailer materials, partnership materials and correspondence;
  information discussed during meetings, working sessions or other client communications;
  recordings or transcripts of meetings where recording or transcription has been agreed and is lawful;
  feedback, clarification requests and information provided after delivery;
  information relating to payment status, transaction reference, invoice status or refunds, although full payment-card information is generally handled by the relevant payment processor rather than Hannah Alley Consulting.

Client Materials relating to other people

Documents supplied as part of a consultancy or Strategic Intensive engagement may occasionally contain personal data relating to individuals other than the person who made the booking, for example employees, agency contacts, suppliers, retailer contacts, customers or commercial partners.

Clients should only provide personal data that is reasonably necessary for the engagement and should remove, redact or anonymise personal information where it is not needed for the work.

The client is responsible for ensuring that it is entitled to provide any personal data contained within Client Materials and, where applicable, that appropriate privacy information and lawful grounds for disclosure are in place.

We do not require identifiable customer, employee or other third-party information where anonymised, aggregated or redacted information is sufficient for the purpose of the engagement.

Information collected automatically

When you visit our website, we may collect limited technical and usage information, such as:

• IP address or approximate location;
• browser type and version;
• device type;
• operating system;
• pages visited;
• time spent on the website;
• traffic source;
• interactions with forms, pages or content;
• cookie consent preferences.

This information may be collected through cookies, analytics tools, server logs or similar technologies. Please see our Cookie Policy for more information.

Information from third parties

We may receive personal data from third-party platforms and service providers used to operate Hannah Alley Consulting, including:

website hosting and website-management providers;

booking and scheduling platforms;

form, questionnaire and file-upload providers;

payment processors and accounting systems;

email and calendar providers;

video-conferencing platforms;

meeting-recording or transcription tools, where used;

cloud-storage and document-management systems;

CRM or project-management systems;

analytics providers;

email-marketing platforms;

social-media platforms where you interact with us;

professional advisers;

referral partners where you have asked or permitted them to introduce you.

For example, where you book a Strategic Intensive, the relevant booking, form and payment providers may supply Hannah Alley Consulting with information such as your name, email address, business details, booking details, payment status and submitted briefing information.

We may share personal data where reasonably necessary with trusted third parties supporting our business or delivery of services, including:

website hosting and maintenance providers;

booking and scheduling providers;

form, questionnaire and file-upload providers;

email and calendar providers;

video-conferencing providers;

recording or transcription providers where applicable;

cloud-storage and document-management providers;

CRM and project-management systems;

payment processors;

accountants and bookkeepers;

analytics providers;

email-marketing platforms;

professional advisers such as lawyers, accountants and insurers;

carefully selected subcontractors or specialist collaborators where required for an agreed service;

fraud-prevention, payment-dispute or debt-recovery providers where reasonably necessary;

regulators, courts, law-enforcement authorities or other legal bodies where required or permitted by law.

We do not sell Client Materials or personal data to advertisers or unrelated third parties.

We only disclose personal data where necessary and proportionate to the relevant purpose. Where a service provider acts as our processor, we seek to use providers offering appropriate data-protection and security safeguards.

Special category data

We do not intentionally collect special category data through our website, such as health information, racial or ethnic origin, religious beliefs, political opinions, trade union membership, biometric data, genetic data, or information about sex life or sexual orientation.

Please avoid sending special category data unless it is strictly necessary. If you choose to share such information voluntarily, we will handle it with appropriate care and only where we have a lawful basis to do so.

3. How we use personal data

We may use personal data to:

• respond to enquiries, applications and requests;
• assess whether our services are an appropriate fit for your brand or business;
• arrange discovery calls, meetings or consultations;
• prepare proposals, scopes of work, agreements and invoices;
• deliver consultancy, strategy, marketing, partnership or commercial services;
• communicate with you about projects, retainers or potential collaborations;
• manage client relationships;
• improve our website, content, user journey and services;
• understand website performance and marketing effectiveness;
• send newsletters, updates or marketing communications where you have opted in or where we are legally permitted to do so;
• maintain records for business, tax, accounting and legal purposes;
• protect our business, website, systems and rights;
• comply with legal or regulatory obligations;
• administer and confirm bookings, appointments, Review Blocks and Live Sessions;
  process and reconcile payments, refunds, invoices and transaction records;
  conduct suitability, scope and conflict checks before accepting or beginning an engagement;
  review Strategic Intensive briefs, diagnostic forms and uploaded Client Materials;
  prepare for and deliver Strategic Intensives, consultancy sessions, reviews, written recommendations and other agreed Deliverables;
  arrange and conduct video meetings and working sessions;
  make or provide recordings or transcripts where these have been agreed and there is an appropriate lawful basis;
  manage document deadlines, rescheduling, cancellations and client communications;
  provide clarification and post-delivery support included within the relevant service;
  maintain evidence of the services purchased, contractual terms accepted, work delivered and communications exchanged;
  investigate or respond to billing disputes, chargebacks, complaints, legal claims or contractual disputes;
  protect confidential information, intellectual property, our systems and our legal rights;
  improve the design, scope and operation of our services using appropriately limited information.

4. Lawful bases for processing

We only process personal data where we have an appropriate lawful basis.

Depending on the circumstances, this may include:

Contract
Where processing is necessary to take steps at your request before entering into an agreement or to perform our contract with you. This may include processing bookings, briefing information, Client Materials, communications and information required to deliver the purchased service.

Legitimate interests
Where processing is necessary for our legitimate business interests and those interests are not overridden by the rights and freedoms of affected individuals. This may include managing business relationships, assessing suitability, maintaining professional records, improving services, protecting confidential information, preventing fraud, managing disputes and protecting our legal and commercial interests.

Consent
Where we have asked for and received your consent, for example for certain marketing communications, non-essential cookies or, where applicable, recording or transcription activities for which consent is the appropriate lawful basis.

Legal obligation
Where processing is necessary to comply with legal, regulatory, accounting, tax or other legal requirements.

Establishment, exercise or defence of legal claims
Where information is reasonably necessary to establish, exercise or defend legal rights, contractual rights or claims.

We do not intentionally request or routinely require special category personal data as part of our website, Strategic Intensive forms or consultancy services.

Special category data includes personal data revealing or relating to:

racial or ethnic origin;

political opinions;

religious or philosophical beliefs;

trade union membership;

genetic data;

biometric data used for identification;

health;

sex life; or

sexual orientation.

Please do not upload or include special category data, criminal-offence data or other highly sensitive personal information within briefing forms, Client Materials or correspondence unless it is genuinely necessary for the engagement and has been agreed with Hannah Alley Consulting in advance.

Where less intrusive, anonymised or aggregated information would serve the same purpose, clients should provide that instead.

If sensitive information is provided inadvertently, we may delete, redact, restrict or return it where appropriate. Where processing is genuinely necessary, it will only take place where an appropriate lawful basis and any additional legal condition required by data-protection law are available.

5. Enquiry and application forms

When you submit an enquiry, application, booking form, Strategic Intensive briefing, diagnostic questionnaire or other form, we use the information you provide for the purpose connected with that form.

This may include:

understanding your business and requirements;

assessing whether our services are appropriate;

checking whether the requested work falls within the purchased scope;

conducting suitability or conflict checks;

administering your booking;

preparing for and delivering the service;

reviewing uploaded Client Materials;

preparing recommendations and Deliverables;

communicating with you during and after the engagement;

maintaining appropriate contractual and business records.

Strategic Intensive forms may request commercially sensitive business information, including strategic priorities, budgets or investment levels, performance information, retailer or wholesale information, marketing activity, agency or supplier information, partnership information, business objectives and supporting documents.

You should provide only information reasonably required for the service and avoid including unnecessary personal or sensitive information.

Submitting an enquiry or application does not guarantee that Hannah Alley Consulting will accept an engagement.

Where you have already purchased a fixed-scope service, the information supplied may be reviewed to confirm that the requirement remains within the purchased scope and is professionally suitable for Hannah Alley Consulting to undertake.

6. Marketing communications

We may send marketing communications, newsletters, updates or invitations if you have opted in, requested them, or where we are otherwise permitted by law to contact you in a business context.

You can unsubscribe or opt out of marketing communications at any time by using the unsubscribe link, where available, or by contacting us at hannahalleyconsulting@outlook.com.

We will not sell your personal data to third parties.

7. Cookies, analytics and website tracking

We use cookies and similar technologies to operate the website, understand website performance, improve the user experience, and, where applicable, measure marketing activity.

We may use Google Analytics 4 or similar analytics tools. Google Analytics may use cookies or similar technologies to help us understand website use in aggregated reports. Google Analytics 4 does not log or store individual IP addresses from UK, EU or Swiss users.

Where required, non-essential analytics, advertising or tracking cookies will only be used with your consent.

Please see our Cookie Policy for more detail about the cookies and technologies we may use.

8. Who we share personal data with

We may share personal data with trusted third parties who support our business operations, including:

• website hosting and maintenance providers;
• form, CRM and email systems;
• analytics providers;
• cloud storage and document management providers;
• accountants, bookkeepers and payment processors;
• professional advisers, such as lawyers or insurers;
• project management and communication tools;
• subcontractors or specialist collaborators, where required to deliver services and where appropriate safeguards are in place;
• regulators, authorities or legal bodies where required by law.

We only share personal data where necessary and appropriate. Where third parties process data on our behalf, we aim to ensure suitable contractual and security arrangements are in place.

9. International transfers

Some of the systems and service providers we use may process or store personal data outside the United Kingdom.

Where personal data is transferred internationally, we take steps designed to ensure appropriate safeguards are in place. These may include adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or other lawful transfer mechanisms.

This is relevant in particular where booking, payment, form, cloud-storage, communications or video-conferencing providers operate infrastructure or group companies in other countries.

10. How long we keep personal data

We keep personal data only for as long as necessary for the purposes for which it was collected, including business, legal, accounting, tax, reporting and record-keeping purposes.

Typical retention periods may include:

• website analytics data: according to the retention settings of the relevant analytics provider;
• enquiry and application form data: for a reasonable period after the enquiry, unless a longer period is needed for relationship management, legal or business purposes;
• client and project records: for the duration of the relationship and for up to six years afterwards, where required for legal, tax, accounting or contractual reasons;
• marketing data: until you unsubscribe, withdraw consent or we decide to stop contacting you;
• financial and invoice records: generally up to six years, in line with UK tax and accounting requirements.

We may retain limited information where necessary to evidence that a request, objection, unsubscribe or deletion request has been handled.

Strategic Intensive and consultancy records: key contractual, briefing, correspondence, final Deliverable and project records may be retained for the duration of the relationship and for up to six years afterwards where reasonably required for contractual, legal, insurance, tax, accounting or dispute-resolution purposes.

Uploaded Client Materials and working files: we do not intend to operate as a permanent file-storage service. Working copies, temporary uploads, drafts and supporting materials may be deleted earlier once they are no longer reasonably required for delivery, follow-up, contractual record-keeping or legal purposes.

Meeting recordings and transcripts: retained only for as long as reasonably required for the purpose for which they were made and then deleted or anonymised, unless a longer retention period is reasonably required because of a dispute, legal obligation or other legitimate need.

Payment and invoice information: generally retained for up to six years where necessary for tax, accounting and legal record-keeping.

Booking and scheduling records: retained for as long as reasonably required for client administration, contractual records, accounting and dispute management.

We periodically review whether information still needs to be retained and may securely delete or anonymise information sooner where it is no longer necessary.

11. How we protect personal data

We take reasonable technical and organisational measures to protect personal data from unauthorised access, loss, misuse, alteration or disclosure.

These measures may include:

• secure website connections using HTTPS;
• access controls;
• password protection;
• limited access to personal data;
• use of reputable service providers;
• secure storage and backup practices;
• appropriate internal confidentiality measures.

No online transmission or storage system can be guaranteed to be completely secure, but we take privacy and data protection seriously.

Depending on the information and service involved, measures may also include:
access permissions and account authentication;
limiting access to those who reasonably need the information;
secure cloud and document-storage providers;
contractual confidentiality obligations;
appropriate controls when sharing files or documents;
reviewing the security and privacy arrangements of key service providers where appropriate.

12. Your rights

Depending on your location and the applicable law, you may have rights in relation to your personal data, including the right to:

• request access to the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request deletion of your personal data in certain circumstances;
• request restriction of processing;
• object to processing based on legitimate interests;
• object to direct marketing;
• withdraw consent where processing is based on consent;
• request data portability in certain circumstances;
• lodge a complaint with a data protection authority.

To exercise your rights, please contact hannahalleyconsulting@outlook.com.

We may need to verify your identity before responding to certain requests.

13. Complaints

If you are concerned about how we handle your personal data, please contact us first so we can try to resolve the matter.

You also have the right to complain to the UK Information Commissioner’s Office.

14. Children’s privacy

Our website and services are intended for business and professional audiences. They are not directed at children.

We do not knowingly collect personal data from children. If you believe a child has provided personal data to us, please contact us so we can take appropriate action.

15. Automated decision-making

We do not use personal data submitted through this website to make solely automated decisions that have legal or similarly significant effects.

We may use software to assist with administration, scheduling, form handling or organisation of information, but suitability decisions and substantive professional recommendations are not made solely by automated means.

16. Links to other websites

Our website may include links to third-party websites, platforms or social media pages.

We are not responsible for the privacy practices, cookie practices or content of third-party websites. We recommend reviewing the privacy policy of any external site you visit.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in law, regulatory guidance, our services, the tools we use, or the way we process personal data.

The latest version will always be published on this page, with the updated date shown above.

18. Form Data

When you submit an enquiry or application form, we may collect information about your business, project goals, budget range, timeline, business stage, team structure, service requirements and any other information you choose to provide. This is used to assess fit, respond to your enquiry, prepare for any introductory call and determine whether our services may be appropriate.

19. Meetings, recordings and transcripts

We may conduct client meetings or Strategic Intensive sessions using video-conferencing or telephone platforms.

A meeting will not be recorded or transcribed by Hannah Alley Consulting unless recording or transcription has been disclosed (the icon is shared within the meeting/on screen for example) and an appropriate lawful basis applies.

Where a recording or transcript is created, it may be used to:

support accurate delivery of the agreed service;

prepare or check written Deliverables;

provide the Client with an agreed recording;

maintain an appropriate record of the engagement where reasonably necessary.

Automated transcripts may contain inaccuracies and should not be treated as authoritative records unless verified.

Clients should not introduce an automated meeting assistant, transcription service or recording tool into a meeting without notifying Hannah Alley Consulting and ensuring that its use is lawful and appropriate.

Recordings and transcripts will not be retained for longer than reasonably necessary for the purposes for which they were created, subject to any legal, contractual or dispute-related requirement to retain them.

20. Strategic Intensives and Client Materials

Strategic Intensive engagements may involve the submission of commercially sensitive business information and supporting documents.

This may include information about business performance, commercial priorities, marketing budgets, retailer or wholesale activity, campaigns, agencies, partnerships, suppliers, audiences, pricing, strategy and other material necessary to deliver the selected service.

We use this information to assess scope and suitability, prepare for the engagement, perform the agreed review or analysis, provide the relevant working session and Deliverables, and maintain appropriate business and contractual records.

Clients should only provide information reasonably necessary for the engagement and should redact or anonymise unnecessary personal data before uploading documents.

Client Materials are treated confidentially in accordance with the relevant engagement terms and this Privacy Policy.

20. Contact

For questions about this Privacy Policy or how your personal data is handled, please contact:

Hannah Alley Consulting
Email: hannahalleyconsulting@outlook.com
If you need to contact us by post in relation to a data protection matter, please email us first and we will provide an appropriate correspondence address where required.