Privacy Policy

A Curious Idiot is a trading name of [CONFIRM - Joe Gandy (sole trader) OR A Curious Idiot Ltd, company number XXXXX].

For the purposes of UK GDPR and the Data Protection Act 2018, we are the data controller for the personal data we collect from you.

We are registered with the UK Information Commissioner's Office (ICO). Our registration number is [CONFIRM - register at ico.org.uk/registration first if not already].

You can contact us about anything in this policy by emailing joe@curiousidiot.co.uk.

This policy explains what personal data we collect when you interact with us - through our website at curiousidiot.co.uk, our email newsletter, our coaching enquiries, or as a paying coaching client - what we do with that data, who we share it with, and what your rights are over it.

By using our website, opting in to our newsletter, booking a call, or buying our coaching, you accept the practices described in this policy.

If you visit our website

• IP address (used to derive approximate country/region, never stored long-term in a way that identifies you personally)
• Browser type, device type, operating system
• Pages you visited, time on page, how you arrived (referrer)
• Anonymised analytics data via Google Analytics 4 (ID G-6SM9EJR7HN) and Microsoft Clarity (project wk6e9ptbg9). Clarity records anonymised session replays and heatmaps; GA4 records page views, traffic source, and basic device data. Form field content is masked.

If you opt in to our email newsletter

• Your email address
• Approximate location (derived from IP)
• Which page you opted in from
• Email open and click activity going forward

If you book a free call with Joe

Via our booking form (Cal.com [CONFIRM]) and qualification form (Typeform [CONFIRM if used]):

• Your full name
• Your email address
• [CONFIRM additional fields: phone, business name, current revenue, current pain point]
• Time zone

If you become a paying coaching client

In addition to the above:

• Payment details (handled by our payment processor - [CONFIRM - Stripe / direct bank transfer / Wise]. We never see or store your full card number.)
• Billing address
• WhatsApp number (for between-session feedback - explicit opt-in at the start of the coaching engagement)
• Recordings of your real cold calls that you choose to send to Joe for review
• Session notes Joe takes during coaching
• WhatsApp message history between you and Joe (stored on Joe's WhatsApp Business client and Meta's servers - see Section 5)

If you email us directly

• Your email address and any content you include in your email
• Any attachments you send

We only process your personal data when the law allows us to. We rely on one of the following lawful bases for each type of processing:

Performance of a contract

When you buy coaching, we need to process your data to deliver what you paid for - schedule sessions, review your call recordings, send you feedback, and invoice you.

Legitimate interests

We process some of your data because we have a legitimate business interest that is not overridden by your rights. Examples:

• Operating our website - server logs, basic analytics, security.
• Responding to enquiries - when you contact us, we use your email to reply.
• Maintaining business records - keeping a record of who has been a client and what work was done.
• Preventing fraud and abuse - blocking spam form submissions, suspicious activity.

You can object to this processing at any time (see Section 9).

Consent

For some processing, we ask for your explicit consent:

• Email marketing - you only receive our newsletter if you have actively opted in. Withdraw consent any time via the unsubscribe link in every email.
• Non-essential cookies - analytics, advertising, and tracking cookies are only set if you accept them via our cookie banner. See Section 10.
• Call recordings shared with Joe - when you become a coaching client, you explicitly consent to send recordings of your own calls. You retain ownership and can ask for them to be deleted at any time.

Withdrawing consent doesn't affect anything we processed lawfully before the withdrawal.

Legal obligation

We process some data because the law requires us to - for example, retaining basic financial records for HMRC for six years after a client relationship ends.

We do share your data with a small number of trusted third-party service providers who help us run the business. Each one is bound by data processing agreements that meet UK GDPR standards.

We may also share data with:

• Our accountant - limited to billing data, for invoicing and HMRC compliance.
• Legal or regulatory authorities - if required by UK law, court order, or to defend our legal rights.
• A buyer of the business - if we ever sell or transfer A Curious Idiot, your data may be transferred under the same protections. We would notify you.

Some of our providers are based in the USA or use US-based infrastructure. Where this is the case, we rely on one of the following safeguards:

• The provider's UK GDPR-compliant Standard Contractual Clauses (SCCs) or International Data Transfer Agreement (IDTA), or
• The provider's certification under the UK-US Data Bridge (the extension of the EU-US Data Privacy Framework adopted by the UK on 12 October 2023).

Request a copy of the specific safeguard for any transfer by emailing joe@curiousidiot.co.uk.

If you ask us to delete your data earlier, we will - except where law requires us to keep it.

• Encrypted email - TLS encryption in transit on all email to and from joe@curiousidiot.co.uk.
• Strong passwords + 2FA - unique passwords and two-factor authentication on every business account.
• Device security - devices used to access your data are password-protected and encrypted at rest.
• Vetted providers - every third-party we use is UK GDPR-compliant and has signed a Data Processing Agreement with us.

If you ever suspect your data has been compromised through us, email joe@curiousidiot.co.uk immediately. We are legally required to report personal data breaches to the ICO within 72 hours where the breach is likely to result in a risk to your rights.

Under UK GDPR, you have the following rights over your personal data. To exercise any of them, email joe@curiousidiot.co.uk. We will respond within one month.

We don't charge a fee for any of the above unless the request is clearly unfounded, repetitive, or excessive.

If you're unhappy with how we've handled your data, you have the right to complain to the ICO at ico.org.uk/make-a-complaint - but we'd appreciate the chance to put it right first.

Strictly necessary (always on)

These cookies don't need consent because the site can't work without them. Examples: session cookies, security cookies, cookie-consent state cookies. Not used for tracking.

Cookies we only set if you consent

Everything else is set only after you click "Accept" on our cookie banner:

• Google Analytics 4 - page views, time on site, traffic source. IP anonymisation enabled.
• Microsoft Clarity - anonymised session replays so we can see where the page confuses people. Form-field content is masked by default.
• Meta Pixel [CONFIRM] - measures Facebook/Instagram ad performance and retargets visitors.
• YouTube embedded videos - if you watch an embedded video, YouTube sets cookies. We use youtube-nocookie.com embeds where possible.

You can change your cookie choices at any time by clicking Cookie Settings in our website footer, or by clearing cookies in your browser.

If you opt in to our newsletter, we will send you regular emails covering cold calling tips, coaching announcements, and offers from A Curious Idiot. We never share your email with third parties for their own marketing.

Unsubscribe at any time - every email has a one-click unsubscribe link. Once you unsubscribe, we'll stop sending marketing emails within 24 hours.

We may still send you non-marketing emails relating to a specific coaching engagement (session reminders, invoices) - those are part of the service you bought, not marketing.

Our services are not directed at children under 16. We do not knowingly collect data from anyone under 16. If you believe a child has provided us with data, email joe@curiousidiot.co.uk and we will delete it.

We may update this policy from time to time. The "Last updated" date at the top tells you when we last revised it.

If we make a material change - meaning a change that significantly affects what we do with your data - we will email anyone whose data we hold to let them know.

For anything in this policy - questions, concerns, requests to exercise your rights, complaints - email joe@curiousidiot.co.uk.

For complaints we cannot resolve, you have the right to lodge a complaint with the Information Commissioner's Office: