Privacy policy

Introduction

Welcome to the privacy notice of Positive Health Strategies Ltd, trading as Positive Group (“Positive”).

Positive respects your privacy and is committed to protecting your personal data. This privacy notice will inform you as to how we look after your personal data and tell you about your privacy rights and how the law protects you.

Please also use the Glossary to understand the meaning of some of the terms used in this privacy notice.

1. Important information and who we are

PURPOSE OF THIS PRIVACY NOTICE

This privacy notice aims to give you information on how Positive collects and processes your personal data, including when you work with us as a client, take part in one of our programmes or in coaching, use our website, sign up to receive our news, or work with us as an associate or supplier. This notice may be supplemented by specific information given to you at the time, by us or by your employer.

Our services are provided to organisations. We do not knowingly collect data relating to children.

Our own employees, workers, contractors and job applicants are covered by separate privacy notices.

CONTROLLER

Positive Health Strategies Limited is the controller of the personal data described in this notice and is responsible for it. We are registered with the Information Commissioner’s Office (ICO) under registration number Z2070950.

Where a client contract appoints us as the client’s processor, we process participants’ personal data only on the client’s instructions, and the client’s own privacy notice applies.

We have appointed a Data Protection Lead who is responsible for overseeing questions about this privacy notice. If you have any questions, including any requests to exercise your legal rights, please contact us using the details below.

CONTACT DETAILS

Our full details are:
Positive Health Strategies Limited
2 Maple Court
Davenport Street
Macclesfield
Cheshire
England
SK10 1JE
Email: info@positivegroup.org

If you have a concern or complaint about how we use your personal data, please contact us first at info@positivegroup.org. We will acknowledge it within 30 days and keep you informed. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator (www.ico.org.uk), or, if you are based outside the UK, to your local data protection authority.

EU REPRESENTATIVE

We have appointed De Búrca Greene as our EU Representative. If you are based in the EU, you can contact them about your rights at Claire@dbglaw.ie. Please include “Positive Group” in any correspondence.

CHANGES TO THE PRIVACY NOTICE AND YOUR DUTY TO INFORM US OF CHANGES

We review this privacy notice regularly and may update it from time to time. It was last updated in October 2026.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

THIRD-PARTY LINKS

Our website may include links to third-party websites, plug-ins and applications. Clicking on those links may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements.

2. The data we collect about you

Personal data, or personal information, means any information about a living individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer the following kinds of personal data about you:

• Identity Data: first name, last name, job title and organisation.
• Contact Data: work email address, telephone number and business address.
• Programme Data: attendance at our sessions; recordings of sessions, where participants are made aware; and transcripts of meetings, where participants have agreed.
• Financial and Transaction Data: for associates and suppliers, bank details and records of payments; for clients, invoicing details.
• Technical and Usage Data: information about how you use our website, such as your IP address, browser type and the pages you visit.
• Marketing and Communications Data: your preferences in receiving marketing from us.
• Survey Data: responses to our measurement surveys. We do not ask for names or email addresses, and results are reported to clients only in aggregate.
• Coaching Data: where we provide coaching, relevant notes of your coaching sessions, such as your goals and agreed actions.

We also use Aggregated Data, such as combined survey results. Aggregated Data is not personal data as it does not reveal your identity. If we combine Aggregated Data with personal data so that it could identify you, we treat it as personal data.

We do not collect Special Categories of Personal Data (such as information about your health).

IF YOU FAIL TO PROVIDE PERSONAL DATA

We need your contact details to deliver our programmes and services. If you do not provide them, we may not be able to include you. Signing up to receive our marketing emails is optional.

3. How your personal data is collected

We use different methods to collect data from and about you including through:

• Direct interactions. You may give us your Identity and Contact Data when you correspond with us, attend a session, complete a survey or sign up to receive our news.
• Your employer. Where we deliver a programme for your employer, we may receive your name, job title and work email address from them.
• Event registration services. If you register for one of our events through an event registration service, we receive your Identity and Contact Data from that provider.
• Automated technologies. As you use our website, we may collect Technical and Usage Data through cookies. Please see our Cookie Notice for details.

4. How we use your personal data

We will only use your personal data when the law allows us to. We do not make decisions about you based solely on automated processing.

PURPOSES FOR WHICH WE WILL USE YOUR PERSONAL DATA

Purpose / activity	Type of data	Lawful basis for processing
To deliver our programmes and sessions	Identity, Contact, Programme	Performance of a contract with you or your employer; Legitimate Interest (to deliver the programmes our clients have engaged us to provide)
To record sessions, where participants are made aware – usually in advance by their employer, and by a clear notice when recording starts – so they can decide whether to take part	Identity, Programme	Legitimate Interest (to provide accurate records and recordings to our clients)
To transcribe meetings, where participants have agreed before transcription starts	Identity, Programme	Legitimate Interest (to keep accurate records of meetings)
To manage our relationship with you, including invoicing and payments	Identity, Contact, Financial and Transaction	Performance of a contract; Comply with a legal obligation; Legitimate Interest (to recover money owed to us)
To administer and protect our business and our website	Identity, Contact, Technical	Legitimate Interest (running our business, IT services, network security and preventing fraud); Comply with a legal obligation
To understand how our website is used (website analytics)	Technical and Usage	Consent (through our cookie settings)
To send you news and updates by email	Identity, Contact, Marketing and Communications	Consent
To run measurement surveys and produce aggregate reports for our clients	Survey	Legitimate Interest (to give our clients insight from their programmes)
To provide coaching, including keeping session notes	Identity, Contact, Coaching	Performance of a contract with you or your employer; Legitimate Interest (to provide the coaching our clients have engaged us to deliver)

We use AI tools, such as Microsoft 365 Copilot, to help transcribe some meetings and prepare our work. These providers do not use our data to train their models.

MARKETING

We only send marketing emails to people who have opted in to receive them. You can unsubscribe at any time using the link in any of our emails or by contacting us. We keep a record of your preference for as long as we hold your details, so that we do not send you marketing unless you sign up again.

Where we deliver a programme on behalf of your employer, your employer manages invitations and participation, and their own privacy notice also applies.

COOKIES

For details of the cookies we use and how to manage them, please see our Cookie Notice.

CHANGE OF PURPOSE

We will only use your personal data for the purposes we collected it for. If we need to use it for an unrelated purpose, we will tell you and explain the legal basis for doing so.

5. Disclosures of your personal data

We may have to share your personal data with the parties set out below for the purposes set out in the table above:

• Service providers who support our business, such as our managed IT provider and the cloud platforms we use. They act on our instructions under written contracts.
• Self-employed associates who deliver sessions on our behalf, under confidentiality agreements.
• Your employer, where we deliver a programme for them – for example attendance, or survey results in aggregate. For coaching arranged by your employer, we may confirm attendance but do not share what you discuss without your agreement, unless required by law or there is a serious risk of harm.
• Professional advisers, insurers, HM Revenue & Customs, regulators and other authorities, where required.
• Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. If a change happens to our business, the new owners may use your personal data in the same way as set out in this privacy notice.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We never sell your personal data.

6. International transfers

Some of our service providers store data outside the UK, including in the United States. Where this happens, we make sure your data is protected by the safeguards required under UK law, such as the UK-US Data Bridge or approved data transfer agreements. Please contact us if you would like more information.

7. Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way. These include secure, access-controlled cloud services with multi-factor authentication, encrypted company devices and managed security software. We are Cyber Essentials certified. We limit access to your personal data to those employees, associates and service providers who have a business need to know, and they are subject to a duty of confidentiality.

We have procedures in place to deal with any suspected personal data breach and will notify you and the ICO where we are legally required to do so.

8. Data retention

HOW LONG WILL YOU USE MY PERSONAL DATA FOR?

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting or reporting requirements. To decide how long to keep it, we consider the nature and sensitivity of the data, the purposes we use it for and any legal or contractual requirements. For example, contracts and financial records are kept for 6 years, while survey responses, session recordings and coaching notes are deleted within months of the work ending. Further details are available on request. We may also anonymise personal data so that it can no longer identify you, and use it for research and analysis.

9. Your legal rights

Under certain circumstances, you have rights under data protection laws in relation to your personal data. These are set out in the Glossary below. If a right does not apply in your situation, we will explain why. If you wish to exercise any of these rights, please contact us at info@positivegroup.org. You also have the right to complain to us and to the ICO (see section 1).

NO FEE USUALLY REQUIRED

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive, or refuse to comply with your request in these circumstances.

WHAT WE MAY NEED FROM YOU

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights).

TIME LIMIT TO RESPOND

We try to respond to all legitimate requests within one month. Occasionally it may take us longer if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

10. Glossary

LAWFUL BASIS

Legitimate Interest means the interest of our business in conducting and managing our business to enable us to give you the best service. We make sure we consider and balance any potential impact on you and your rights before we process your personal data for our legitimate interests. You can ask us for more information about how we balance our interests against yours.

Performance of Contract means processing your data where it is necessary for the performance of a contract to which you, or your employer, are a party.

Comply with a legal or regulatory obligation means processing your personal data where it is necessary for compliance with a legal or regulatory obligation that we are subject to.

Consent means you have given clear consent for us to process your personal data for a specific purpose. You can withdraw your consent at any time.

THIRD PARTIES

External third parties include IT and cloud service providers in the UK, the EU and the US; professional advisers such as lawyers, accountants and insurers; and HM Revenue & Customs, regulators and other authorities.

YOUR LEGAL RIGHTS

You have the right to:

• Request access to your personal data.
• Request correction of the personal data that we hold about you.
• Request erasure of your personal data.
• Object to processing of your personal data where we are relying on a legitimate interest, and object at any time to direct marketing.
• Request restriction of processing of your personal data.
• Request the transfer of your personal data to you or to a third party.
• Withdraw consent at any time where we are relying on consent to process your personal data. This will not affect the lawfulness of any processing carried out before you withdraw your consent.