Legal

Privacy Policy

Empower Life Academy Limited Last updated: May 2025  |  Version 1.2 Applies to: empowerlifeacademy.com and all ELA products and services

Who We Are

Empower Life Academy Limited ("ELA", "we", "us", "our") is a learning and community platform for women, registered in England and Wales.

We are the data controller for the personal data we collect about you. This means we are responsible for deciding how and why your personal data is used, and for keeping it safe.

What Personal Data We Collect

We collect personal data in the following ways:

When you register for a workshop or event

Data we collect Why we collect it Legal basis
Name and email address To confirm your registration and send joining details Contract performance
Optional information you choose to share To help us support you appropriately during the event Legitimate interests

When you make a purchase

Data we collect Why we collect it Legal basis
Name, email, billing address To process your order and send your product Contract performance
Payment information To complete your transaction Contract performance
Order history To manage your account and respond to queries Contract performance

Payment information is processed securely by Shopify. Empower Life Academy Limited does not store your card details. Shopify's privacy policy applies to payment processing.

When you subscribe to our email list

Data we collect Why we collect it Legal basis
Name and email address To send newsletters and updates you have subscribed to Consent
Email engagement data To understand what content is useful and improve our communications Legitimate interests

When you become a community member

Data we collect Why we collect it Legal basis
Name, email, information you share in the community To manage your membership and facilitate community participation Contract performance / Legitimate interests

When you contact us

Data we collect Why we collect it Legal basis
Name, email, content of your message To respond to your enquiry Legitimate interests
Sensitive information you choose to share To provide appropriate support Vital interests / Explicit consent

When you visit our website

Data we collect Why we collect it Legal basis
IP address, browser type, pages visited, time on site To understand how our website is used and improve it Consent (via cookie banner)
Cookies and tracking data See our Cookie Policy Consent

Our Legal Bases for Processing

Under UK GDPR, we must have a lawful basis for processing your personal data. We rely on the following:

  • Contract performance — processing necessary to provide a service you have requested, such as delivering a workshop or sending a journal you have purchased.
  • Consent — where you have given us clear, specific permission, such as subscribing to our email list or accepting non-essential cookies. You can withdraw consent at any time.
  • Legitimate interests — where we have a genuine business reason that does not override your rights, such as improving our services or maintaining records. We always consider your interests before relying on this basis.
  • Vital interests — in rare circumstances where processing is necessary to protect someone's life or safety.
  • Legal obligation — where we are required to process data to comply with UK law, such as financial record-keeping.

How We Use Your Personal Data

  • To deliver workshops, courses, and events you have registered for
  • To process and fulfil product orders
  • To send email communications you have subscribed to
  • To manage your community membership
  • To respond to your questions and support requests
  • To send service communications such as booking confirmations and order updates
  • To improve our website, content, and services
  • To comply with our legal and financial obligations

We will never sell your personal data to third parties. We will never use your personal data for advertising on behalf of other companies.

Who We Share Your Data With

We share your data only with trusted third-party service providers who help us deliver our services. All providers are required to handle your data securely and in compliance with UK GDPR.

Provider Purpose Privacy policy
Shopify E-commerce platform — processes orders and payments shopify.com/legal/privacy
Klaviyo Email marketing — sends newsletters and automated sequences klaviyo.com/legal/privacy
HubSpot Customer relationship management legal.hubspot.com/privacy-policy
Buffer Social media scheduling and publishing buffer.com/legal/privacy
n8n Workflow automation n8n.io/legal/privacy
Meta (Facebook / Instagram) Social media platforms where you may interact with us facebook.com/privacy/policy
LinkedIn Professional network where you may interact with us linkedin.com/legal/privacy-policy

We may also share your data where required by law, or to protect the vital interests of you or another person, including in emergency or safeguarding situations.

International Data Transfers

Some of our third-party providers are based outside the UK. Where we transfer your personal data internationally, we ensure appropriate safeguards are in place in line with UK GDPR requirements.

Klaviyo, HubSpot, and Buffer are US-based companies. They operate under Standard Contractual Clauses or equivalent mechanisms approved by the ICO for UK-to-US transfers. You can request details of the specific safeguards we rely on by contacting us at nicole@empowerlifeacademy.com.

How Long We Keep Your Data

We keep your personal data only for as long as necessary for the purpose it was collected, or as required by law.

Data type Retention period
Workshop registration data 24 months from the date of the workshop
Customer purchase records 7 years from the date of purchase (required for HMRC financial records)
Email marketing data Until you unsubscribe, or 24 months from last engagement — whichever comes first
Community membership data Duration of membership plus 12 months
Enquiry and contact data 12 months from the date of your last contact with us
Website analytics data 26 months (standard analytics retention period)
Safeguarding and crisis records Minimum 7 years as required by UK safeguarding best practice
Financial and tax records 7 years minimum as required by HMRC

When data is no longer required, it is securely deleted or anonymised.

Your Rights Under UK GDPR

You have the following rights in relation to your personal data. To exercise any of these rights, contact us at nicole@empowerlifeacademy.com. We will respond within one month.

  • Right of access — you can ask for a copy of the personal data we hold about you (a Subject Access Request).
  • Right to rectification — you can ask us to correct inaccurate or incomplete personal data.
  • Right to erasure — you can ask us to delete your personal data in certain circumstances. Some data may be exempt where we have a legal obligation to retain it.
  • Right to restrict processing — you can ask us to pause processing your data in certain circumstances, for example while accuracy is disputed.
  • Right to data portability — where we process your data by automated means on the basis of consent or contract, you can request it in a structured, portable format.
  • Right to object — you can object to processing based on legitimate interests. We will stop unless we can demonstrate compelling grounds that override your interests.
  • Right to withdraw consent — where we rely on consent, you can withdraw it at any time. This does not affect the lawfulness of processing before withdrawal.
  • Right to unsubscribe — you can unsubscribe from our emails at any time using the link in any email, or by contacting us directly.

There is no charge for exercising your rights. We will respond within one month. For complex or multiple requests we may extend this by a further two months — we will notify you if this applies.

Cookies

Cookies are small text files placed on your device when you visit our website. We use cookies to make our website function, to understand how it is used, and to improve your experience.

Essential cookies

These are necessary for the website to function and cannot be switched off. They include session cookies, Shopify checkout cookies, and security cookies that protect against fraud.

Analytics cookies

With your consent, we use analytics cookies to understand how visitors use our website. We use Google Analytics, which measures traffic and behaviour. Data is anonymised where possible.

Marketing and tracking cookies

With your consent, Meta (Instagram and Facebook) and LinkedIn may set tracking cookies when you interact with our social content or click through to our website. These are governed by those platforms' own privacy policies.

Managing your cookies

When you first visit our website you will be asked to accept or decline non-essential cookies. You can update your preferences at any time using the cookie settings link in the footer of our website, or through your browser settings.

For full details of the cookies we use, please see our Cookie Policy.

Children's Data

Our website and services are intended for adults aged 18 and over. We do not knowingly collect personal data from anyone under the age of 18.

If you believe we have inadvertently collected data from a child, please contact us immediately at nicole@empowerlifeacademy.com and we will delete it without delay.

Sensitive Personal Data

Information shared with us through workshops, community participation, or direct contact may sometimes be sensitive in nature — for example relating to mental health, family circumstances, or personal wellbeing.

We treat all such information with the highest level of care and confidentiality. Sensitive personal data is:

  • Accessible only to those directly responsible for providing your care or support
  • Never used for commercial purposes of any kind
  • Stored securely and retained only as long as necessary

In circumstances involving risk to life or safety, we may be required to share information with emergency services or appropriate authorities. We will inform you when this applies unless doing so would place someone at risk.

How We Keep Your Data Secure

We take the security of your personal data seriously. Our measures include:

  • Encrypted data transmission (HTTPS) across our website and platforms
  • Access controls ensuring only authorised individuals can access personal data
  • Use of security-certified third-party providers with their own data protection obligations
  • Regular review of our data handling practices

In the event of a data breach likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours and inform affected individuals without undue delay, as required by UK GDPR.

How to Complain

If you have a concern about how we handle your personal data, please contact us first and we will do our best to resolve it:

If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Changes to This Privacy Policy

We may update this policy from time to time to reflect changes in our practices, services, or legal obligations. When we make significant changes we will notify you by email where we hold your address, and by posting a notice on our website.

The date at the top of this policy shows when it was last updated. We encourage you to review it periodically.

Contact Us

For any questions about this privacy policy or how we handle your personal data: