Privacy policy

Last updated: August 19, 2026

XOPH LTD, a company registered in England and Wales under company number 16562013, operates this store and website, including all related information, content, features, tools, products, coaching and other services offered through it (the “Services”).

XOPH is powered by Shopify, which enables us to provide the Services to you.

This Privacy Policy explains how we collect, use, store and disclose your personal information when you visit or use our website, purchase a product, book or receive coaching, complete an intake form, attend an online session or otherwise communicate with us.

If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls in relation to the collection, processing and disclosure of personal information.

Please read this Privacy Policy carefully. By using the Services, you acknowledge that you have read and understood how we collect, use and disclose personal information as described in this policy.

Personal Information We Collect or Process

“Personal information” means information that identifies you or can reasonably be linked to you. It does not include information collected anonymously or information that has been de-identified so that it can no longer reasonably identify you.

Depending on how you interact with the Services, where you live and what is permitted or required by law, we may collect or process the following categories of personal information:

Contact details, including your name, preferred name, address, billing address, shipping address, telephone number, email address, country and any safe-contact instructions you provide.

Financial information, including payment details, transaction information, payment method and payment confirmation. Shopify and our payment providers process payment-card information. XOPH normally receives payment confirmation and limited transaction details rather than your complete card details.

Account information, including your username, password, preferences, security settings and other information associated with a Shopify customer account.

Transaction information, including products or services you view, place in your basket, purchase, return, exchange or cancel, together with your order and booking history.

Communications, including information contained in emails, messages, enquiries, complaints, reviews, feedback and customer-support requests.

Device information, including information about your device, browser, network connection, IP address and other unique identifiers.

Usage information, including information about how and when you interact with or navigate the Services.

Coaching and intake information, including your reasons for seeking coaching, the outcomes you hope to achieve, support needs, accessibility requirements, current professional support, safe-contact instructions, coaching agreements, consent choices, session administration and proportionate coaching records.

Sensitive information, including information you choose to provide about your mental or physical health, disability, neurodivergence, trauma experiences or support needs. This may constitute special category data under UK data-protection law. You should share only what feels relevant and do not need to describe traumatic experiences in detail.

Safeguarding information, where reasonably necessary to respond to a safeguarding concern, serious and immediate risk of harm or legal requirement.

Please do not upload or send medical records, screenshots, evidence or detailed information about another person unless we specifically request it and explain why it is necessary.

Sources of Personal Information

We may collect personal information:

  • Directly from you when you create an account, visit or use the Services, buy a product, make a booking, complete an intake form, attend a coaching session, communicate with us or otherwise provide information.

  • Automatically through the Services, including from your device and through cookies and similar technologies.

  • Through Microsoft Forms when you complete a coaching intake form.

  • Through Microsoft Outlook when you communicate with us by email.

  • Through Microsoft Teams when we administer or deliver an online coaching session.

  • From Shopify, payment processors and other service providers that enable us to operate our website and provide the Services.

  • From partners or other third parties where permitted by law.

If another person books or contacts us on your behalf, they should have your permission to provide your information.

If you give us personal information about another person, please share only what is necessary and lawful.

How We Use Your Personal Information

Depending on how you interact with us and which Services you use, we may use personal information for the following purposes.

Providing, Tailoring and Improving the Services

We use personal information to provide the Services and perform our contract with you. This includes processing payments, fulfilling orders, remembering preferences, managing customer accounts, sending account or order notifications, processing purchases, returns, exchanges, cancellations and refunds, arranging shipping and creating an appropriate shopping experience.

We may also use proportionate information to understand how the Services are used and improve our website, products and customer experience.

Providing Coaching Services

We use personal information to:

  • Respond to coaching enquiries.

  • Assess whether coaching may be suitable for your current needs.

  • Prepare for and deliver coaching sessions.

  • Understand the outcomes you hope to achieve.

  • Make reasonable accessibility or communication adjustments.

  • Communicate safely with you.

  • Administer bookings, cancellations and rescheduling.

  • Maintain appropriate service boundaries and records.

  • Provide relevant information or signposting.

  • Manage complaints, disputes or concerns about the service.

XOPH provides trauma-informed coaching, not counselling, psychotherapy, medical treatment, diagnosis or emergency support.

Marketing and Advertising

We may use personal information for marketing and promotional purposes, including sending marketing communications by email, text message or post where permitted.

We may also use information about activity on the Services to show or support online advertising, including through Shopify features, where this is permitted by law and subject to any required consent or opt-out rights.

You may unsubscribe from promotional emails at any time by using the unsubscribe option included in our emails.

We do not use sensitive coaching or intake information for marketing, advertising or unrelated profiling.

Security and Fraud Prevention

We use personal information to authenticate accounts, provide a secure payment and shopping experience, detect and investigate suspected fraudulent, illegal, unsafe or malicious activity, protect the Services and protect the rights and safety of XOPH, our customers and others.

If you create an account, you are responsible for keeping your login information secure. You should not share your username, password or other access information with another person.

Communicating With You

We use personal information to provide customer support, respond to enquiries, administer bookings and orders, provide effective Services and maintain our business relationship with you.

Legal, Safety and Safeguarding Reasons

We may use personal information to:

  • Comply with applicable laws and valid legal processes.

  • Respond to requests from courts, regulators, law-enforcement agencies or government bodies.

  • Investigate or participate in legal proceedings.

  • Enforce or investigate potential violations of our terms or policies.

  • Establish, exercise or defend legal claims.

  • Respond to safeguarding concerns.

  • Respond to a serious and immediate risk of harm.

  • Protect the rights, safety and wellbeing of you, XOPH or another person.

Lawful Bases for Processing

Where UK data-protection law applies, we rely on one or more of the following lawful bases:

Steps before entering into a contract: This includes responding to enquiries, arranging bookings and assessing whether coaching may be suitable at your request.

Performance of a contract: This includes processing orders and payments, providing products or coaching, administering sessions and communicating about the Services you requested.

Legal obligation: This includes keeping tax, accounting and company records and complying with other legal or regulatory requirements.

Legitimate interests: This includes operating a safe and accountable business, responding to enquiries, securing our website, preventing fraud, improving our Services, maintaining proportionate service records, managing complaints and establishing, exercising or defending legal claims.

Where we rely on legitimate interests, we consider whether the processing is necessary and balance our interests against your rights and interests.

Consent: We rely on consent where it is required, including for certain marketing activities, non-essential cookies and the processing of special category information where explicit consent is appropriate.

Vital interests: In an exceptional emergency, we may rely on vital interests where processing is necessary to protect somebody’s life and the relevant legal requirements are met.

Special Category Information and Explicit Consent

Information about physical or mental health, disability, neurodivergence and certain related support needs may be special category data.

Where this information is genuinely needed to assess suitability, make reasonable adjustments, prepare for or deliver coaching, our Article 6 lawful basis is normally taking steps at your request before entering into a contract or performing our contract with you.

Our separate Article 9 condition is your explicit consent under Article 9(2)(a) of the UK GDPR.

We request explicit consent separately in our coaching intake form. Consent must be given through a clear and affirmative choice.

You may withdraw your consent for future processing by contacting gareth@xoph.co.uk. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

If relevant sensitive information is genuinely necessary to provide coaching safely and appropriately, refusing or withdrawing consent may mean that we cannot begin or continue the service.

We do not use sensitive intake or coaching information for advertising, personalised marketing or unrelated profiling.

In an exceptional emergency, legal or safeguarding situation, another lawful basis and special-category condition may apply where permitted by law. We will only process or disclose information where it is necessary, proportionate and legally permitted.

Coaching, Confidentiality and Safeguarding

Coaching information is treated as private, but confidentiality is not absolute.

We may need to use or disclose relevant information:

  • Where disclosure is required by law.

  • Where there is a safeguarding concern.

  • Where we reasonably believe there is a serious and immediate risk of harm.

  • Where necessary to establish, exercise or defend legal claims.

  • Where you ask or consent to the disclosure.

We will only share the information reasonably necessary and will record the reason for doing so.

Our intake form, social-media accounts and ordinary email are not monitored continuously.

If you or somebody else is in immediate danger, call 999 or go to A&E.

For urgent mental-health support in England, call NHS 111 and select mental-health option 2.

Samaritans can be contacted free, day or night, on 116 123.

If you are outside the UK, contact your local emergency or crisis service.

How We Disclose Personal Information

We may disclose personal information to third parties for legitimate purposes and subject to this Privacy Policy, including:

Shopify and connected providers, which provide website hosting, checkout, order administration, customer-account features, fraud prevention, payments and other ecommerce services.

Microsoft 365, including Microsoft Forms for intake forms, Outlook for email, Teams for online sessions and Microsoft storage or administration services used to operate these tools.

Vendors and service providers that perform services on our behalf, including IT support, cloud storage, data analytics, customer support, payment processing, fulfilment, shipping and professional administration.

Professional advisers, including accountants, legal advisers and insurers where access is necessary for a defined purpose.

Business and marketing partners, where permitted, to provide marketing or advertising services. These partners process information in accordance with their own privacy notices and your applicable consent or opt-out choices.

Authorities and protective services, including courts, regulators, law-enforcement bodies, safeguarding organisations, emergency services or healthcare services where disclosure is required or permitted by law and is necessary and proportionate.

Other organisations involved in a business transaction, such as a merger, reorganisation, sale, insolvency or transfer of all or part of the business.

We may also disclose information when you direct, request or consent to the disclosure, such as when arranging delivery, using a social-media feature or connecting to a third-party service.

Service providers may act as processors on our behalf or as independent controllers for particular activities, such as payment processing or fulfilling their own legal duties. Their own privacy information will apply where they act as independent controllers.

Relationship With Shopify

The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services to provide and improve the Services.

Information submitted through the Services may be transmitted to and shared with Shopify and other service providers, which may be located in countries outside the country where you live.

We may use Shopify features that incorporate information obtained from your interactions with our store, other merchants and Shopify. These features may be used to protect, improve and grow the business and may include personalised advertising or other enhanced services where enabled.

In these circumstances, Shopify may be responsible for particular processing activities, including responding to requests concerning information processed by Shopify for its own purposes.

You can learn more through the Shopify Consumer Privacy Policy:

https://www.shopify.com/legal/privacy/app-users

Depending on where you live, you may exercise certain rights relating to Shopify’s processing through the Shopify Privacy Portal:

https://privacy.shopify.com/en

Third-Party Websites and Links

The Services may provide links to websites or online platforms operated by third parties.

If you follow a link to a website that is not operated or controlled by XOPH, you should review that organisation’s privacy and security policies and its terms and conditions.

We are not responsible for the privacy, security, accuracy or reliability of unaffiliated third-party websites.

Information you provide in public or semi-public spaces, including third-party social-media platforms, may be visible to other users and may be used by those platforms or other third parties.

Including a link to a third-party website does not necessarily mean that XOPH endorses that website or its operator.

Children’s Information

XOPH’s individual one-to-one coaching service and adult coaching intake form are intended only for people aged 18 or over.

Our store and Services are not intended to be used independently by children, and we do not knowingly collect personal information from children under the age of majority in their jurisdiction.

If you are a parent or guardian and believe that a child has provided personal information to us, contact us using the details below to request its deletion.

If we learn that a child’s information has been submitted inappropriately, we will take reasonable steps to restrict or delete it, subject to any safeguarding or legal duty.

As of the effective date of this Privacy Policy, we do not have actual knowledge that we sell or share, as those terms are defined under applicable law, personal information belonging to anybody under 16.

Security

We use proportionate technical and organisational measures intended to protect personal information, including access controls, account security, restricted access to coaching information and the security features available through Shopify and Microsoft 365.

However, no security measures or online systems are completely secure, and we cannot guarantee perfect security.

Information may also be at risk while being transmitted. Please use a safe device and contact method and avoid sending unnecessary sensitive or confidential information through ordinary email or social media.

How Long We Retain Information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, safeguarding, insurance and dispute-resolution requirements.

Our usual starting retention periods are:

Enquiries that do not become bookings: Up to six months after the last meaningful contact.

Coaching intake forms and coaching records: Up to three years after the final session or last coaching-related contact.

Payment, tax and company records: For the period required by applicable law and legitimate accounting requirements.

Customer accounts and transaction records: For as long as needed to maintain the account, provide the Services, process transactions and meet legal or accounting requirements.

Marketing preferences: Until consent is withdrawn or the information is no longer required, subject to retaining a minimal suppression record where necessary to respect an opt-out.

We may retain particular information for longer where a safeguarding concern, complaint, dispute, insurance requirement or legal obligation makes this necessary.

We may delete or anonymise information sooner where it is no longer required.

Your Rights and Choices

Depending on where you live and the circumstances, you may have some or all of the following rights:

Right of access: You may request a copy of the personal information we hold about you and information about how it is used.

Right to rectification: You may request that inaccurate or incomplete information is corrected.

Right to erasure: You may request deletion of information where there is no lawful reason for us to retain it.

Right to restriction: You may request that we restrict processing in certain circumstances.

Right to object: You may object to processing based on legitimate interests or to the use of personal information for direct marketing.

Right to portability: You may request a copy of certain information you provided to us in a commonly used format or ask us to transfer it to another organisation where the legal requirements apply.

Right to withdraw consent: Where we rely on consent, you may withdraw that consent at any time for future processing. Withdrawal does not affect processing carried out before consent was withdrawn.

Managing communication preferences: You may unsubscribe from promotional emails at any time using the unsubscribe option included in those emails. We may continue to send non-promotional communications concerning your account, orders, bookings or Services.

You may exercise your rights through any options provided within the Services or by contacting us using the details below.

We will not discriminate against you for exercising your rights.

We may need to verify your identity before responding to a request. Where permitted by law, you may authorise another person to make a request on your behalf, although we may require evidence of that authority and may need to verify your identity directly.

Rights are not absolute and may only apply in certain circumstances. We will explain if we cannot fulfil all or part of a request.

Where UK data-protection law applies, we normally respond within one month, although the law permits an extension in certain circumstances.

To learn more about information processed by Shopify or exercise rights relating to Shopify’s own processing, visit:

https://privacy.shopify.com/en

Cookies and Similar Technologies

Our Shopify website uses cookies and similar technologies.

Some cookies are necessary for security, checkout, customer accounts, bookings and essential site functions.

Optional analytics, personalisation or advertising technologies are used subject to the consent or opt-out requirements that apply in your location.

You can review or change your choices using the XOPH cookie banner or the privacy controls provided through the website.

Automated Decision-Making

We do not make solely automated decisions using coaching or intake information that produce legal or similarly significant effects.

Decisions about coaching suitability and the provision of coaching involve human review.

Shopify or other providers may use automated systems for matters such as fraud prevention, security, personalisation or advertising, as explained in their own privacy information.

International Transfers

We, Shopify and other service providers may transfer, store or process personal information outside the country where you live.

Where UK or European data-protection law requires transfer safeguards, we or our providers rely on recognised safeguards. These may include an adequacy decision, the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement, the UK Addendum or another lawful transfer mechanism.

You may contact us for further information about the safeguards relevant to your information.

Complaints

If you have concerns about how we process personal information, please contact us using the details below so we can try to resolve the matter.

If you are in the UK, you also have the right to complain to the Information Commissioner’s Office, the UK data-protection regulator:

https://ico.org.uk/make-a-complaint/

Depending on where you live, you may also have the right to complain to your local data-protection authority or appeal a decision concerning your request.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our Services, providers, business practices or legal and regulatory obligations.

We will publish the revised Privacy Policy on this website, update the “Last updated” date and provide any additional notice required by law.

Contact Us

If you have questions about this Privacy Policy, our privacy practices or your personal information, or if you would like to exercise your rights, contact:

XOPH LTD
Company number: 16562013
Registered office: 5 Lower Edge Avenue, Oldham, OL1 2XN, United Kingdom
Email: gareth@xoph.co.uk
Telephone: +44 7549 310731
Website: https://www.xoph.co.uk

For the purposes of applicable data-protection law, XOPH LTD is the controller of your personal information, except where Shopify or another provider acts as an independent controller for its own processing activities.