Privacy Policy

Last Updated: 15th October 2026

We take the security and handling of your personal information very seriously. Working on your leadership, thinking and potential can involve sharing things that matter deeply to you: your ambitions, relationships, challenges and experiences. We recognise the trust this involves and want you to understand what happens to that information, who can see it and the choices you have.

This policy covers our website, enquiries, resources, assessments, coaching, mentoring, tutoring, courses, events, organisational programmes and human augmentation services. It also explains how personal information is handled when AI tools, recordings or connected technologies are used. You can ask us a question at any time by emailing hello@maximy.life.

This is a privacy notice, not a request for blanket consent. Accepting our terms or using our services does not amount to consenting to every use of your information. Where we rely on consent, we ask separately. A service-specific notice will explain additional details before the relevant information is collected or used; it cannot remove your legal rights.

‍

‍

1. Who is responsible for your information

Maximy Ltd is the controller of information used for the purposes described here, unless we explain a different arrangementfor a particular service. This means we decide why and how that information isused. Contact our privacy lead at hello@maximy.life or write to Maximy Ltd, Hughenden Hall, Plomer Green Lane, Downley Common, High Wycombe, HP13 5XN.

We comply with applicable data protectionlaw, including the UK GDPR and Data Protection Act 2018, as amended. Other countries’ mandatory privacy laws may also apply to particular activities.

For employer-sponsored services, the employer may be a separate controller. Some Associates also act as independent controllers for their professional records. Where we act only on an organisation’s documented instructions as its processor, its privacy notice explains that processing. We will identify the relevant roles and contact routes before participation.

‍

2. Where information comes from

We receive information directly from you, through our website and service systems, and where relevant from the organisation arranging a service, Associates delivering it, assessment respondents and integrations you authorise. We may use relevant public professional information, such as your organisation’s website, for business enquiries or matching. We do not treat information being public as permission for unrestricted use.

Where information comes from someone else, we explain its source and categories within the time required by law, normally within one month and sooner if we contact you or disclose it first, unless a lawful exception applies.

‍

3. What personal information we collect

Contact and administration

Your name, contact details, organisation, role, account details, bookings, correspondence, attendance, payment status, invoices and communication preferences. Payment providers process payment details; Maximy receives the transaction information needed to administer the purchase.

Free resource request

When you request a free resource, such as aworkbook, template or framework, we collect your name, email address, country and a record of the resource requested. We use this information to send you the resource and administer your request.

Learning and development

Your stated goals, needs, assessment answers and scores, thinking or leadership profiles, feedback, learning activity, submitted exercises, coaching notes, development plans and reports. Assessments can include observations and opinions about you as well as facts.

Recordings and AI interactions

Where the arrangements in sections 7 and 8 apply, audio or video, meeting chat, transcripts, summaries, prompts, uploaded documents, generated responses and relevant tool usage records.

Connected services

If you choose a service involving personal digital records, calendars, documents, wearables or other integrations, the specific information you authorise us to access. This may include health or wellbeing information. Access is limited to the agreed service and explained before connection.

Website and community activity

IP address, browser and device information, security logs, pages visited, resource downloads, cookie preferences and any contributions you post in community spaces. We collect information through cookies or similar technologies only as permitted by law.

We explain whether requested information is compulsory or optional and what happens if you do not provide it. Without information essential to a booking or service, we may be unable to deliver that part of the service. You do not have to disclose unnecessary personal experiences to take part.

Downloading a reflection template does not give Maximy the answers you enter into a copy stored on your own device. We receive those answers only if you submit them, share them during a service or use an agreed connected system that makes them available to us.

Please avoid sending unnecessary sensitive information in general enquiries or sharing identifiable information about family members, colleagues or other people where an anonymous description would be sufficient. Do not share passwords or access credentials in coaching notes or AI prompts.

‍

4. How we use information lawfully

We identify a lawful basis for each purpose. Contract applies where processing is necessary for our agreement with you or steps you request before entering it. Where an employer buys the service, our contract with that employer is not, by itself, a contractual lawful basis for processing your personal information. We normally assess legitimate interests for necessary programme administration and delivery, with additional protections for sensitive information.

Legitimate interests require us to weigh the purpose and necessity of processing against your rights and reasonable expectations. You can ask about that assessment and object. We do not switch toanother basis simply to defeat a withdrawal of consent.

‍

Purposes and lawful bases

The following describes our main purposes and bases. The relevant service notice explains the precise basis where the arrangement differs or involves additional sensitive information.

Consent can be withdrawn by contacting usor using the relevant controls. Withdrawal does not affect earlier lawful processing. We explain any effect on an optional feature. We do not makeunrelated services conditional on consenting to optional marketing, recordingor AI processing.

‍

5. Sensitive information and confidentiality

Coaching and assessments may reveal health, disability, racial or ethnic origin, religious or philosophical beliefs, political opinions, trade union membership, sexual orientation or sex life. Genetic information and biometric information used to uniquely identify someone also receive special protection. Profiles or AI inferences can reveal sensitive information even if you did not expressly provide it.

For optional development activities involving special category information, we normally seek your explicit consent. We explain what information is needed, why, who can access it and your alternatives. We do not rely on consent where you lack a genuine choice, including because of workplace pressure. If there is no valid condition, we will not undertake that sensitive processing.

Other conditions may apply in limited circumstances, such as establishing or defending legal claims or lawful safeguarding disclosures under an applicable substantial public interest condition. We assess and document the conditions required, including any additional UK statutory requirements. We do not routinely request criminal offence information and process it only where specifically authorised by law.

We restrict access to personal reflections and coaching content. Confidentiality is not absolute: a necessary and lawful disclosure may be required by a court, a legal obligation, a serious safeguarding concern or a legal claim. We disclose only what is necessary and, where appropriate and lawful, discuss it with you first. Professional supervision should use anonymised material wherever possible; identifiable disclosure requires an explained purpose, lawful basis and appropriate safeguards.

‍

6. Employer sponsored services and feedback

Before an organisational programme begins, we explain what the sponsor will receive, who will receive it and why. This may include booking and attendance information, agreed objectives, progress against those objectives or a specified assessment report. Payment for a service does not itself entitle an employer to your private coaching notes, recordings, transcripts or personal reflections.

We will not share private session content with a sponsor without your specific agreement and an appropriate lawful basis, except where a necessary lawful disclosure applies as described above. We explain the distinction between a private coaching service and an assessment intended to inform an organisational decision.

For 360-degree or similar feedback, both the respondent and the person being assessed receive information about how responses will be used. We explain whether comments are attributed, combined or redacted. We cannot promise absolute anonymity where comments or a small group could reveal identity, or where disclosure is legally required. Access requests are assessed with regard to other people’s rights.

We use aggregated reporting only where the risk of identifying participants is adequately controlled, including in small teams. Removing a name alone does not make information anonymous.

‍

7. Artificial intelligence and human augmentation

Where included in an agreed service, AI may help organise information, draft development plans, summarise authorised materials, identify themes in assessments, personalise learning or support your personal AI operating model. Automated transcription and meeting summaries follow the additional safeguards in section 8. We explain the relevant use before your personal information is processed in this way.

Before introducing a tool to your service, we identify the provider, purpose, information involved, access arrangements, retention and relevant international transfers in the service notice or tool information. We assess privacy and security risks and carry out a data protection impact assessment where the processing is likely to create a high risk to individuals.

We limit inputs to what is needed and use anonymised information where practical. Pseudonymised information, such as a coded profile that can be linked back to you, remains personal information. We do not put confidential coaching content or sensitive personal information into an unapproved public AI service.

We do not use identifiable coaching content, recordings, assessment responses or personal digital records to train general-purpose AI models, or permit our AI providers to use them for that purpose. We select appropriate business arrangements and settings to support this restriction. Any separate proposed research or model-development project involving your identifiable information would require its own notice and lawful basis, including explicit consent where required for sensitive information.

AI outputs may contain errors, unsupported inferences or bias. Where we use them to prepare a personal assessment or recommendation, an appropriate person reviews the output before it is relied on. You can ask us to correct factual errors, explain a profile and review an AI-supported recommendation. Development profiles are not clinical diagnoses.

We do not make decisions with legal or similarly significant effects on you solely through automated processing. Our AI tools support human judgement. If a future service proposes such decisions, we will explain the logic, significance, likely consequences and available safeguards before introducing it, comply with applicable restrictions and provide the required opportunities to make representations, obtain human intervention and contest a decision.

Where you connect a calendar, document store, personal knowledge system or wearable, we explain the access permissionsand use the minimum necessary. You can disconnect an optional integration; we explain what happens to copies already received. We do not use this policy to authorise continuous monitoring, employer surveillance or access to unrelated accounts. Health data and sensitive inferences require the additional conditions in section 5.

If you choose to use a separate AI service through your own account, its provider’s privacy terms also apply. We explain when Maximy receives information from that account and when it does not. Ask us before uploading information about other people or confidential organisational material.

‍

8. Recording calls and coaching sessions

We do not record or transcribe private coaching sessions by default. Where an optional recording, transcription or AI note-taking feature would be useful, we explain the purpose, tool, information captured, recipients and retention before it starts and ask each participant for consent. Where sensitive information is likely to be captured, we seek explicit consent for that processing. A platform’s recording notification is not a substitute for this explanation and choice.

Recordings may capture your voice, image, name, screen-sharing, meeting chat and information about other people mentioned in the conversation. Transcripts and summaries are separate records and may be inaccurate. We limit their circulation and provide a way to raise corrections.

You may decline optional recording or AI note-taking without losing access to the underlying coaching session. We can agree brief written notes instead. You can ask for recording to be paused or stopped at any time. Withdrawing consent stops future consent-based use; it does not make earlier processing unlawful. We delete relevant records unless aspecific lawful reason requires limited retention, which we explain.

For group sessions and webinars, we tell attendees beforehand whether the event will be recorded, what is captured and who can watch it. Where participation would appear in an optional recording, we provide a practical way to participate without being recorded or obtain the necessary permission. We make late joiners aware before capturing their contribution.

Private session recordings are not made available to an employer merely because it funded the service. Access is limited to the participant, relevant delivery professionals and approved providers as explained before recording. Using a recording for supervision, training, testimonials, public events, a podcast or publicity is a separate purpose and requires its own notice and appropriate permission. Consent to a coaching recording is not consent to publication.

Please do not introduce a recording device or AI meeting bot into a session without discussing it with us and the other participants beforehand. This helps protect everyone’s confidentiality and privacy. This request does not override any rights provided by law.

‍

9. Community spaces and public contributions

When you post in a forum, interactive classroom or group discussion, your name and contribution may be visible to other participants or to the public, depending on the setting. We explain the audience before participation. Please avoid sharing sensitive information about yourself or others in public spaces.

We may use contributions and moderation records to administer the community, investigate concerns and meet legal safety obligations. The relevant service notice explains the scope of monitoring, reporting routes and retention. Other participants may copy material, so a group confidentiality rule cannot guarantee that a contribution will remain private.

For identifiable testimonials, photographs, case studies and promotional recordings, we explain the proposed channels and use and seek separate permission. If you withdraw consent, we stop further consent-based use and take reasonable steps to remove material under our control. We explain any practical limits, such as printed material already distributed or copies held independently by others.

‍

10. Who we share information with

We share only the information needed for the relevant purpose. Recipients may include Associates and assessment specialists delivering your service; providers of hosting, learning platforms, assessment tools, communications, AI, secure storage, payments and support; and your sponsoring organisation to the extent explained in section 6.

We use Mailchimp to manage mailing-list subscriptions, store resource-request records and send resource emails. Mailchimp processes the information needed to provide these services on our behalf.

Processors acting for Maximy must follow our documented instructions under appropriate data protection agreements. Independent controllers, such as some professional advisers, payment providers or Associates, have their own responsibilities and privacy notices. We explain material independent-controller arrangements before sharing information.

We may share necessary information with legal advisers, insurers, regulators, courts or public authorities where lawful, including for legal claims or safeguarding. If the business is sold or restructured, relevant information may be disclosed to advisers or a successor under appropriate confidentiality and data protection safeguards. Any new purpose must have a lawful basis and be explained where required. We do not sell your personal information.

‍

11. International transfers

Some technology providers and authorised support teams may process information outside the UK. The relevant service or supplier information identifies the countries and arrangements that apply; you can also request these details from hello@maximy.life.

Where a transfer is restricted under UK data protection law, we rely on applicable UK adequacy regulations or appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses. Where required, we assess the protection offered in the destination and apply additional safeguards. You may request a copy or description of the safeguards, subject to necessary redactions.

If EU data protection rules also apply, we meet the relevant EU transfer requirements. Simply using our services or accepting this policy is not consent to an international transfer.

‍

12. Keeping information secure

We use technical and organisational measures proportionate to the sensitivity of the information and the risks.These include limiting access to people who need it, appropriate account protection, secure storage and transfer arrangements, confidentiality requirements, supplier checks and controlled deletion. We review protections when services or risks change.

No system is completely risk-free. This does not remove our responsibility to protect information. We assess suspected breaches promptly and notify the regulator and affected individuals where legally required. Please report any concern or misdirected message to hello@maximy.life. Avoid emailing highly sensitive material unless we have agreed an appropriate method.

‍

13. How long we keep information

We retain information only for as long as needed for the stated purpose. These are our standard periods, not universal periods prescribed by data protection law. We delete or anonymise information when the purpose ends and may delete earlier when it is no longer needed. Any justified service-specific period is explained before collection.

Event replays, public media, community contributions and consent records have purpose-specific periods explained in their notices: for example, an agreed replay-access period or the duration of an authorised publication. We keep sufficient consent evidence while relying on it and, where necessary, a limited record afterwards to demonstrate compliance.

A complaint, legal hold or safeguarding matter may require a different period. We document the reason, restrict access and review the need. Backups are overwritten on a controlled cycle and kept beyond routine use meanwhile; any restored data remains subject to deletion requirements. Ask us for the period applying to your service or provider.

‍

14. Children and young people

Where a service is intended for under-18s, we provide age-appropriate information and explain parent, guardian or school involvement before participation. Parent or school involvement does not automatically permit access to every private reflection or conversation; we explain access and safeguarding limits clearly.

‍

15. Marketing and cookies

We send promotional messages only where permitted by data protection and electronic marketing rules. We ask for consent where required. Where the existing-customer exception applies, we market our own similar services and provide an opt-out when collecting contact details and in every message. Different rules can apply to corporate contacts, but we still respect objections and explain our use of personal information.

Unsubscribe using the link in a message or email hello@maximy.life. We stop direct marketing when you object. Essential booking, service and security messages may continue. Downloading a resource or joining a programme does not by itself constitute consent to marketing.

Requesting a free resource does not subscribe you to our newsletter. If you choose to subscribe through the resource-request form, we ask you to confirm your subscription by email before sending newsletters. You can receive the resource without subscribing.

Our Cookie Policy, available from the footer of maximy.life, explains the technologies used, providers, purposes, lifetimes and controls. We obtain consent before using technologies that require it. Where a lawful exception applies, we provide the required information and any applicable opportunity to object. You can change consent choices through the website controls; accepting our terms is not cookie consent.

‍

16. Your privacy rights

Depending on the circumstances, you may request access to your personal information, correction of inaccurate information, erasure, restriction of use or a portable copy. You may object to processing based on legitimate interests and always object to direct marketing. Where processing relies on consent, you can withdraw it. Rights concerning significant automated decisions include the applicable safeguards described insection 7.

These rights are not absolute. For example,we may need to retain an invoice to meet a legal duty, or protect another person’s rights when responding to an access request. We explain any lawful refusal or restriction and your options to challenge it.

Contact hello@maximy.life or write to the address in section 1. You do not need a special form or legal wording; requests can also be made verbally. We may seek proportionate identity checks. We respond without undue delay, normally within one month, subject to lawful extensions or pauses, which we explain. Requests are normally free; a fee or refusal is used only where the law permits.

‍

17. Concerns and complaints

Please contact hello@maximy.life or write to us if you are concerned about our handling of information. We acknowledge data protection complaints within 30 days, make appropriate enquiries, keep you informed and provide an outcome without undue delay. You can also complain to the Information Commissioner’s Office at https://ico.org.uk/make-a-complaint/or call 0303 123 1113. Our process does not remove your right to contact the regulator or seek a legal remedy.

‍

18. Changes and other privacy notices

We update this policy when our practices or legal obligations change and show the revision date above. Where required, we tell you about material new uses before starting them and obtain fresh consent where necessary. Continued use does not automatically constitute consent to a new purpose. Other websites and services you visit have their own privacy notices; our responsibilities for information we process continue to apply.

‍

‍

‍

‍

‍

‍

‍

‍