Privacy Notice

Last Updated: 07 October 2026

This Privacy Notice explains how Alexandra McCalla collects, uses, and protects your personal data when you visit my website or engage with my products and services. I am committed to protecting your privacy in accordance with the Data Use and Access Act 2025, the UK GDPR, and the Data Protection Act 2018.

1. Contact details

If you have any questions or wish to exercise your rights, please contact me:

Name: Alexandra McCalla (Data Controller)

Email: hello@alexandramccalla.com

ICO Registration Number: ZC235018

2. What information I collect, use, and why

I collect or use the following personal information for product and service updates or marketing purposes:

Names
Contact details, including email and/or postal addresses
Marketing preferences
Referral source
Website usage data, including clicks, length of visit, IP address, cookie IDs, device and browser; advertising and targeting cookie data (if you opt in)
Social media interactions, comments, likes, and DMs on Instagram and Facebook
Images, video, and audio used in marketing materials
Testimonials and case studies, including stories and quotes for marketing purposes

I collect or use the following information for the operation of my business, to provide and improve client products and services, for archiving purposes, and to comply with legal requirements:

Names
Contact details, including phone numbers, email and/or postal addresses
Personal information, including date of birth
Emergency contact details, including names, phone numbers, email and/or postal addresses to contact someone if there is a safety concern during a session.
Correspondence, including emails, Telegram, WhatsApp, Instagram, and Facebook messages
Transaction and billing data
Consent and waiver records, including signatures
Special category data, including medical history, health conditions, current medications, and any other sensitive information you choose to share, such as trauma history
Session notes to support high-quality service provision: I only record what is needed to deliver safe and effective products and services
Images, video, and audio capture and recordings from group coaching and breathwork calls (see section 5), and in-person sessions
Testimonials and case studies, including stories and quotes for marketing purposes

3. Lawful bases and data protection rights

Under UK data protection law, I must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

The lawful basis I rely on may affect your data protection rights, which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

Your right of access: You have the right to ask for copies of your personal information. You can request other information, such as details about where I get personal information from and who I share personal information with. There are some exemptions, which means you may not receive all the information you ask for. I may extend the one-month deadline by up to two months for complex or numerous requests, and will tell you if so. I'll carry out reasonable and proportionate searches. Read more about the right of access.

Your right to rectification: You have the right to ask me to correct or delete personal information you think is inaccurate or incomplete. Read more about the right to rectification.

Your right to erasure: You have the right to ask me to delete your personal information. Read more about the right to erasure.

Your right to restriction of processing: You have the right to ask me to limit how I can use your personal information. Read more about the right to restriction of processing.

Your right to object to processing: You have the right to object to the processing of your personal data. Read more about the right to object to processing.

Your right to data portability: You have the right to ask that I transfer the personal information you gave me to another organisation, or to you. Read more about the right to data portability.

Your right to withdraw consent: When I use consent as the lawful basis, you have the right to withdraw your consent at any time. Read more about the right to withdraw consent.

If you make a request, I must respond to you without undue delay and in any event within one month. To make a data protection rights request, please contact me using the contact details at the top of this Privacy Notice.

4. Lawful bases for the collection and use of your data

My lawful bases for collecting or using personal information for service updates or marketing purposes:

Consent: I have permission from you after I gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time. The consent is sought for: Marketing communications, Products and Services newsletters, Website cookies, Use of images and video in marketing materials, Use of testimonials and case studies to promote products and services.
Legitimate interests: I’m collecting or using your information because it benefits you, my offer, or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. The legitimate interests are: Necessary website cookies, Understanding referral sources, Engaging with social media comments and messages.
I send marketing emails under the Privacy and Electronic Communications Regulations (PECR). I'll only email you if you've opted in or you're an existing client and I'm marketing similar services. You can unsubscribe at any time using the link in every email or by contacting me directly at the details provided at the top of this Privacy Notice. You have an absolute right to object to direct marketing.

My lawful bases for collecting or using personal information for the operation of my business, to provide and improve client products and services, for record-keeping purposes, and to comply with legal requirements:

Explicit consent: For personal and special category data (health conditions, medical history, current medications), I collect or use this information only with your explicit, separate consent, given after I've explained what I'm collecting and why. You can withdraw this consent at any time, and all your data protection rights apply. Providing health information is optional, but if you choose not to, I may be unable to offer breathwork or somatic sessions safely.
Contract: I have to collect or use the information so I can provide products and services to you. All of your data protection rights may apply except the right to object. The contract includes: Personal and special category data, Session recordings.
Vital interest: The collection and processing of data, including emergency contact details and special category data, is necessary for client safety.
Legal obligation: I have to collect or use your information so I can comply with the law. All of your data protection rights may apply, except the right to erasure, the right to object, and the right to data portability. The legal obligations are: HMRC compliance, including tax and accounting records, Responding to lawful requests.
Legitimate interests: I’m collecting or using your information because it benefits you, my offer, or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. The legitimate interests are: Products and Services provision, Products and Services improvement.

5. Session recordings

I record some group coaching calls and breathwork sessions on Zoom, with consent obtained via contracts, consents and waivers from all participants before each session. 1:1 sessions are not recorded unless agreed in advance.

Why I record: So program participants unable to attend live, or who wish to revisit a practice, can access a replay.

Who can see recordings: Only other program participants in each cohort have limited access via secure login within Thinkific; recordings are deleted from Zoom after upload to Thinkific.

How long I keep them: Recordings are made available for a period of 12 months after a program ends before being permanently deleted.

6. Website cookies

Website cookies are used to support the marketing and delivery of products and services. You can turn non-essential cookies on or off using the cookie banner when you first visit the site.

Necessary cookies are always on. These enable core site functionality and remember user preferences and choices, such as language preferences or customised settings.

Performance and analytics cookies are off unless you turn them on. These run through Squarespace Analytics to count visits, track traffic source and engagement to improve site performance.

Advertising cookies are off unless you turn them on. They're used by advertising companies to show ads relevant to your interests. [Name the providers, e.g. Meta, if you use a pixel.]

You can change or withdraw your choice at any time through the ‘Manage Cookies’ link in the website footer. You can also delete or block cookies in your browser settings, though this may affect site functionality.

Click here to see the full list of cookies my Squarespace website may use now or in the future within each of these categories.

7. Use of AI and automated processing

I use AI to assist with some drafting of content and refinement of processes.

I do not enter client personal data into AI tools.

Whilst automated processing is used for some operational processes, including the purchase, enrolment, and communications of products and services, no automated decision-making occurs about whether and how I work with you.

8. Where I get personal information from

Directly from you via:

Newsletter registration
Social Media correspondence
Products and Services registration
Products and Services contracts, consents and waivers
Products and Services purchase
Products and Services engagement
Testimonial submissions
Website analytics

9. How long I keep information

I will only retain your personal data for as long as necessary to fulfil the purposes I collected it for, including for the purposes of satisfying any relationship, marketing, legal, accounting, or reporting requirements. For information on how long I keep personal information, see the Data Retention Schedule.

10. Who I share information with

10.1. Service providers acting on my instructions (Data Processors)

  
        Data Processor
        This data processor stores:
      
        Asana
        Client first names to support operational tasks relevant to individuals
      
        Flodesk
        names, email addresses, referral source, engagement data for marketing, and the delivery of products and services
      
        Google Workspace
        names, emails, content, personal and special category data, emergency contact details, images, video, audio for marketing, consents and waivers, and the delivery of products and services
      
        Opensign
        names, email addresses, signatures, personal and special category data, emergency contact details for the delivery of products and services - 1:1 contract consents and waivers
      
        Paperbell
        names, email and/or postal addresses, transaction history, billing data for the delivery of products and services
      
        QuickBooks
        names for the delivery of products and services
      
        Squarespace
        names, email addresses, website usage data, including clicks, length of visit, IP address, cookie IDs, device and browser details for marketing
      
        Thinkific
        names, email addresses, billing postcodes, special category data, transaction history, website usage data, including clicks, length of visit, IP address, cookie IDs, device and browser, session recordings for the delivery of products and services
      
        Thrivecart
        names, email and/or postal addresses, marketing consent, transaction history for the delivery of products and services
      
        Typeform
        names, testimonials and case studies, including stories and quotes for marketing purposes
      
        Zapier
        names, email addresses, marketing consent for the delivery of products and services
      
        Zoom
        names, special category data, correspondence, images, video, and audio for the delivery of products and services

10.2. Independent organisations with their own privacy notices (Data Controllers)

These organisations use your data under their own privacy policies. I recommend you read them.

  
        Meta
(Facebook and Instagram)
        names, correspondence, images, video, audio for marketing, and the delivery of products and services
      
        Meta
(WhatsApp)
        names, phone numbers, special category data, correspondence for the delivery of products and services
      
        Telegram
        names, phone numbers, special category data, correspondence for the delivery of products and services
      
        Stripe
        names, email and/or postal addresses, billing data for the delivery of products and services

11. Others I may share personal information with

Professional, financial, or legal advisors
External auditors
Organisations I’m legally obliged to share personal information with

12. Sharing information outside the UK

Where necessary, my data processors will share personal information outside of the UK. When doing so, they comply with the UK GDPR, making sure appropriate safeguards are in place. For further information or to obtain a copy of the appropriate safeguard for any of the transfers below, please contact me using the contact information provided above.

  
    
        Organisation
        Category of recipient
        Country to which the personal information is sent
        How the transfer complies with UK data protection law
      

    
        Asana
        Task management
        USA
        UK Data Transfer Addendum to the EU Standard Contractual Clauses (SCCs)
      

        Flodesk
        Email marketing and automation
        USA
        Addendum to the EU Standard Contractual Clauses (SCCs)
      

        Google Workspace
        Cloud storage and services
        Europe; USA
        Addendum to the EU Standard Contractual Clauses (SCCs)
      

        Meta
(Instagram, Facebook, WhatsApp)
        Social media
        USA
        UK Data Transfer Addendum to the EU Standard Contractual Clauses (SCCs)
      

        Opensign
        E-signature and waiver
        India/EU
        TBC
      

        Paperbell
        Client scheduling and billing
        UK
        No Transfer
      

        QuickBooks
        Accounting and bookkeeping
        USA
        UK Extension to the EU-U.S. Data Privacy Framework
      

        Squarespace
        Website hosting and analytics
        USA
        UK Extension to the EU-U.S. Data Privacy Framework, and UK Addendum to the EU Standard Contractual Clauses (SCCs)
      

        Stripe
        Payment processor
        USA
        UK Extension to the EU-U.S. Data Privacy Framework, and UK International Data Transfer Addendum to the EU SCCs
      

        Telegram
        Correspondence
        Netherlands
        UK Adequacy Regulations
      

        Thinkific
        Course hosting
        Canada / USA
        Addendum to the EU Standard Contractual Clauses (SCCs)
      

        Thrivecart
        Client checkout
        USA
        Addendum to the EU Standard Contractual Clauses (SCCs)
      

        Typeform
        Survey and forms
        USA
        UK International Data Transfer Addendum to the EU SCCs
      

        Zapier
        Workflow automation
        USA
        UK Extension to the EU-U.S. Data Privacy Framework, backed by Standard Contractual Clauses if the DPF is ever invalidated
      

        Zoom
        Video conferencing
        USA
        EU-U.S. Data Privacy Framework (UK Extension), together with Standard Contractual Clauses (SCCs)
      

  

13. How I keep your information secure

I take reasonable steps to protect your information from loss, misuse, and unauthorised access. These include:

Access controls: Only I, my Online Business Manager and Virtual Assistant can access client data. Accounts are protected by strong, unique passwords and two-factor authentication where relevant. I limit access to what each team member needs, with most special category data accessible only by me.
Service providers: I only use providers who offer appropriate security for processing and storing data.
Retention and deletion: I delete or anonymise information when it's no longer needed, in line with the Data Retention Schedule.
If something goes wrong: I keep a record of any personal data breach. If a breach is likely to put your rights and freedoms at risk, I will report it to the Information Commissioner's Office within 72 hours of becoming aware of it. If it is likely to cause a high risk to you, such as exposure of health information, I will also tell you without undue delay, explaining what happened, the likely impact, and what I'm doing about it. No system is completely secure, so if you suspect your information has been compromised, please contact me at hello@alexandramccalla.com immediately.

14. How to Complain

14.1. Complaining directly to me

In line with the Data (Use and Access) Act, 2025, I am committed to handling your personal data fairly and transparently. If you have any concerns about how your personal data is used, you have the right to raise a data protection complaint directly with me using the contact details provided at the top of this Privacy Notice.

I will acknowledge receipt of your complaint promptly, investigate your concerns, and provide a formal substantive response within 30 days of receiving your complaint. I'll keep you updated on progress.

14.2. Complaining to the Regulator

You have the right to lodge a complaint with the UK data protection regulator, the Information Commissioner’s Office (ICO), at any time, including if you remain unhappy with my response after raising a complaint directly.

Website: https://www.ico.org.uk/make-a-complaint

Helpline: 0303 123 1113

Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF