Who is responsible for your information
Clare E Kenny is the controller of personal information collected through this website and through enquiries about her speaking, workshops and consultancy services.
You can contact Clare about privacy at clare@clareekenny.com.
What information is collected
When you get in touch
Clare may receive your name, work email address, organisation and anything you include in your message. Your enquiry is saved in Clare’s private portal, hosted by Cloudflare, and sent to her inbox through Resend. Portal access is limited to authorised team members. Submitting an enquiry only adds you to Clare’s mailing list if you tick the separate, unticked box for her email updates; that signup is handled as described in the next section. Portal copies are removed after 365 days, or earlier following an authorised deletion request; email correspondence is managed separately as described below.
When you request a resource or join the mailing list
Newsletter, guide and Mini Masterclass requests save your first name, email address and any optional marketing consent in Clare’s private portal. Requested PDF and video access emails are sent through Resend. If you choose follow-up emails, Kit delivers the relevant email sequence and handles unsubscribes. You can request a resource without joining the follow-ups.
When you use the website
Cloudflare hosts the website and may process technical request information needed to deliver and secure it, such as your IP address, browser, device, requested page, date and time. The site also stores your privacy choices and limited session information in your browser.
Optional services
YouTube receives information from your browser only after you allow external media and a video is loaded.
Website measurement with Google Analytics
Before you choose, and if you decline, Google Analytics receives cookie-free measurements: which pages are viewed and actions such as sending a form, requesting a resource, completing the diagnostic or selecting an email link, each tagged with a random number that is not stored, so visits cannot be linked together. Google uses the IP address to work out a rough location and then discards it. Clare relies on a legitimate interest in knowing how the site is used. If you accept analytics cookies, a cookie is set so repeat visits are recognised, and that rests on your consent. Your choice is kept in your browser for 180 days. You can change it at any time from Cookie settings in the footer. Google may process this data in the EU and the United States. For covered transfers to the United States, Google relies on the UK Extension to the EU-US Data Privacy Framework, with contractual safeguards including the UK International Data Transfer Addendum where applicable.
The measurements never include your name, email address, the contents of a form or your diagnostic answers and results. Page addresses are sent without anything after a question mark or hash, and Google's advertising features are switched off for this site.
When you complete the psychological safety diagnostic
Your email address, optional first name and organisation, selected context, 16 answers, scores and report are stored in Clare’s separate diagnostic database on Cloudflare. Clare and authorised team members can view these records through a private portal and export them to prepare for conversations. This is an individual perspective on workplace behaviour, not an anonymous employee survey or a clinical assessment.
You can answer the questions before entering an email address. Incomplete answers stay in your browser for up to 30 days and can be cleared from the diagnostic at any time. After submitting, you receive a one-time email sign-in link before you can view your report. This link expires after 15 minutes. A successful sign-in creates an essential, secure browser session for that report lasting up to 24 hours. You can sign out or request a fresh link. Keep an unused sign-in email private, as anyone with that link could use it before it expires. Reports and their answers are removed from the diagnostic database after 365 days, or earlier following an authorised deletion request.
Optional follow-up emails require a separate, unticked opt-in. When this option is available and you choose it, after verifying your email, your name, email, report page address and result summary are passed to Kit for Clare’s follow-up sequence. That page address does not grant access without a report sign-in session; the one-time sign-in token is not stored in Kit. Choosing not to receive these emails does not prevent you from viewing your report. You can unsubscribe using the link in an email. Contact Clare if you also want your diagnostic record deleted.
Cloudflare Turnstile helps protect submissions and sign-in requests from automated abuse. Resend delivers the requested report sign-in email and portal sign-in links for authorised team members. Report access emails are separate from optional marketing emails. Diagnostic and private-report pages do not load analytics or the website’s screenshot-feedback tools. When you complete the diagnostic from a page of this website, that page counts the completion as one of the actions described under website measurement, without your answers, results or contact details. Limited campaign and referring-site information may be recorded with a completed diagnostic; report-link secrets are not included in that information.
Why the information is used
| Purpose | Information | UK GDPR lawful basis |
|---|---|---|
| Reply to enquiries and discuss possible work | Contact details, organisation and message | Taking steps at your request before a contract; legitimate interests in responding to business enquiries |
| Deliver services and manage client relationships | Business contact and project information | Contract; legitimate interests in managing business relationships |
| Send newsletters or occasional useful updates | Name, email address and consent record | Consent, which you can withdraw at any time |
| Provide a requested free resource | Name, email address and requested resource | Taking steps at your request; legitimate interests in delivering the resource |
| Measure how the website is used with cookie-free Google Analytics measurements | Pages viewed, actions such as sending a form, a random number that is not stored, browser and device type, and a rough location worked out from the IP address | Legitimate interests in knowing how the site is used |
| Recognise repeat visits with Google Analytics cookies | Analytics cookie identifiers and the same usage information | Your consent |
| Operate, protect and troubleshoot the website | Technical request and security information | Legitimate interests in running a secure, reliable website |
| Remember and respect your privacy choices | Consent categories and timestamps | Legal obligations and legitimate interests in demonstrating and respecting your choice |
| Load YouTube videos | Online identifiers and usage information | Your consent |
Clare does not use website information for automated decision-making or profiling that produces legal or similarly significant effects.
Sensitive information
The website does not ask you to provide health information or other special-category personal data. Please avoid including sensitive personal details in a general enquiry unless they are genuinely necessary. If a project requires this type of information, Clare will explain the purpose and the appropriate legal basis separately.
Who information may be shared with
Information is shared only where needed with service providers acting on Clare's instructions or where the law requires it. Depending on how you use the site, these may include:
- Cloudflare, which hosts, delivers and protects the website;
- Resend, which delivers website enquiries to Clare's email account;
- email and business-administration providers used to receive and manage enquiries;
- Kit, which receives opted-in newsletter, guide, Mini Masterclass and diagnostic follow-up details;
- professional advisers or authorities where necessary to meet legal obligations;
- Google, which provides Google Analytics and receives the website measurements described above; and
- YouTube (part of Google), only when you allow external media.
Clare does not sell your personal information.
International transfers
Some technology providers operate internationally, so information may be processed outside the UK. Where UK data-protection law requires safeguards, Clare relies on the provider's approved transfer mechanism, such as UK adequacy regulations or contractual protections, and reviews those arrangements when selecting or configuring a provider. Google may process Google Analytics data in the EU and the United States. For covered transfers to the United States, Google relies on the UK Extension to the EU-US Data Privacy Framework, with contractual safeguards including the UK International Data Transfer Addendum where applicable.
How long information is kept
Information is kept only as long as needed for the purpose it was collected for, including follow-up, client-service, legal, tax and dispute requirements. Enquiries that do not lead to work are periodically reviewed and deleted when there is no continuing business or legal need. Client records may need to be kept longer to meet contractual, accounting or legal obligations.
Website signup and consent records are retained in Clare’s private portal for up to one year after the latest request. Kit retains its own subscription and unsubscribe records.
Marketing contact details are kept until you unsubscribe, withdraw consent or the list is cleaned after sustained inactivity. Your cookie choice is kept in your browser for 180 days, after which the site asks again. Hosting and security-log retention is controlled by the configured Cloudflare service and is reviewed as part of the production setup.
Google Analytics keeps event-level website measurements for 14 months. Data past that age is deleted through Google's monthly deletion process. The setting applies to event-level data only and does not govern aggregated reports in Google Analytics.
Your data-protection rights
Depending on the circumstances, you may have the right to ask for access to your information, correction, deletion, restriction, portability or an objection to certain uses. Where processing relies on consent, you may withdraw it at any time without affecting earlier lawful use.
To exercise a right, email clare@clareekenny.com. Clare may need to confirm your identity and will normally respond within one month.
If you are unhappy with how your information is handled, please contact Clare first so the issue can be investigated. You can also complain to the Information Commissioner's Office, the UK data-protection regulator.
Security, children and changes to this policy
Reasonable technical and organisational measures are used to protect information, but no internet transmission or storage system can be guaranteed completely secure. This business website is intended for adults acting in a professional context and is not directed at children.
This policy will be updated when the website's providers or data uses change. The date at the top shows when it was last revised.