External Privacy Policy

Last Updated: May 2026

“Companions For Leadership” and CFL Global are trading names of Companions For Leadership Limited (“CFL”, “we”, “us”), a global leadership consultancy. CFL is committed to data security and to the fair and transparent processing of personal data.

This privacy notice explains how Companions For Leadership Limited (“CFL”, “we”, “us”) collects and uses personal data, and what your rights are. We process personal data in accordance with the UK GDPR, the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025), the Privacy and Electronic Communications Regulations 2003, and, where applicable, the EU GDPR and other national data-protection laws.

CFL is registered with the UK Information Commissioner’s Office (“ICO”) under registration number ZA305443.

Please read this notice carefully. It contains important information about who we are, how and why we collect, store, use and share personal data, your rights in relation to your personal data, and how to contact us or the supervisory authority if you would like to raise a concern.

Who are we?

CFL is a limited company registered in England and Wales under company number 10107693, with its registered office at Prama House, 267 Banbury Road, Oxford OX2 7HT, United Kingdom.

For the purposes of UK GDPR, CFL is the controller of the personal data you provide to us as a client, prospective client, programme participant, event attendee or supplier of CFL, including data provided through www.cflglobal.com, www.companionsforleadership.com, an event, or any other online or paper-based form.

Our relationship with Oxford Leadership Academy Limited (OLA)

CFL is also a trading partner of Oxford Leadership Academy Limited (“OLA”). OLA is independently owned and operated. CFL resells certain OLA programmes, including the digital offering “SML Online”, but OLA controls registration, access and the platform itself.

CFL is the controller of personal data you provide to CFL or through CFL’s websites and CFL-run events.
OLA is the controller of personal data you provide to OLA, to the SML Online platform, or through the OLA website (www.oxfordleadership.com) or OLA events.

Where personal data is shared between CFL and OLA in connection with a programme, that sharing takes place under a written data-sharing agreement. For OLA’s own processing, please see the OLA Privacy Policy at www.oxfordleadership.com/privacy-policy/.

For some services, particularly where we deliver programmes on behalf of an organisational client, CFL may process personal data solely on our client’s documented instructions as their data processor. In these cases, the client remains the data controller and their privacy information will also apply.

What we do

CFL is a global leadership consultancy. This privacy policy applies to: visitors to our websites; clients and prospective clients; individuals nominated by clients to participate in our programmes (including 360-feedback raters and line managers); attendees at our events; recipients of our newsletter and marketing communications; suppliers and professional advisers; and job applicants.

What personal data does CFL collect?

Information you provide to us

We may collect special category personal data (Article 9 UK GDPR) from you when you:

complete a form on our website;
complete a survey or 360-feedback questionnaire.
correspond with us by phone, email or in writing;
report a problem with our website or services;
subscribe (including by way of soft opt-in under PECR) to our newsletter or other promotional communications;
register for, or attend, one of our events; or
enter into a contract with us to receive products or services.

Individual 360 feedback responses are only disclosed in accordance with the design of the relevant programme. Where reports are intended to be anonymous, responses are aggregated and presented in accordance with agreed reporting thresholds. Where psychometric or leadership assessments are used, personal data is processed solely for coaching, leadership development or programme purposes and not for employment decision-making by CFL.

The personal data we typically collect in these circumstances is: name, email address, postal address, employer, job role and any information you choose to include in your message. You may also choose to provide your telephone number if you would like to be contacted by phone. Examples of circumstances such data might be processed are accessibility requirements at events, dietary or health needs for residential programmes etc.

Information CFL collects automatically

When you visit our website we automatically collect:

technical information including the IP address used to connect your device to the internet, device identifiers, browser type and version, time-zone setting, browser plug-in types and versions, operating system, and approximate location derived from IP address;
information about your visit, such as the pages you view, the products or services you search for, page response times, download errors, length of visits, page-interaction information (scrolling, clicks, mouse-overs) and the methods used to browse away from the page; and
analytics identifiers (for example Google Analytics 4 client IDs).

Most of this data is collected through cookies and similar technologies. Please see the “Cookies” section for the full list, including providers and retention periods.

Information we receive from other sources

We may receive special category personal data (Article 9 UK GDPR) about you from third parties — for example, from your employer when they contract with us for you to participate in one of our programmes (such as dietary requirements, accessibility needs and disability adjustments), from professional contacts who introduce you to us, or from publicly available business sources (such as LinkedIn) when we are researching prospective clients.

Information about other people

If you provide us with information about anyone other than yourself — for example, programme participants you nominate, line managers, 360-feedback raters or event guests, you must ensure that they understand how their information will be used and have agreed to your providing it to us, and to us and our suppliers using it as set out in this notice.

Special category personal data

Some personal data is treated as “special category personal data” under Article 9 UK GDPR (for example, data revealing health, religious beliefs, sexual orientation or trade-union membership). We do not routinely collect such data. Where we do, for example in relation to accessibility requirements, dietary or health needs for residential programmes, or feedback that may reveal protected characteristics, we will tell you why and rely on your explicit consent (or another lawful condition under Article 9).

How do we use your personal data?

When we ask you to provide personal data we will make clear whether the data is required (for example, to deliver a contracted service) or optional. The lawful basis we rely on for each processing activity is summarised in the table below, and the four bases are then explained in more detail.

Lawful basis matrix

Processing activity	Categories of data	Lawful basis	Retention
Responding to a website enquiry	Name, email, employer, content of message	Legitimate interests / steps prior to entering a contract	24 months from last contact
Delivering a contracted programme or consultancy engagement	Name, employer, role, programme attendance, assessment outputs	Performance of a contract	Duration of contract + 6 years
Sending the CFL newsletter and event invitations	Name, email, employer, engagement metrics	Consent (B2C); legitimate interests / soft opt-in (B2B)	Until you unsubscribe, or 24 months of inactivity
Running satisfaction or impact surveys	Name (where attributed), employer, free-text responses	Legitimate interests	Aggregated indefinitely; identifiable for 24 months
Website analytics and improvement	IP address, device data, pages viewed, analytics IDs	Consent (for non-essential cookies)	14 months (GA4 default)
Recruitment	CV / résumé, contact details, right-to-work data	Legitimate interests; legal obligation	12 months after the recruitment decision
Complying with legal, audit and tax obligations	Transaction records, identification documents	Legal obligation	6 years (or longer where required by law)

Performance of a contract

We may process your personal data where this is necessary to perform a contract with you, or to take steps at your request before entering into a contract, including:

providing the products and services you have asked for;
communicating with you about the delivery of those products and services;
delivering coaching sessions, workshops and leadership programmes using secure video conferencing platforms such as Microsoft Teams or Zoom where appropriate;
providing administrative support such as account creation, security and resolving issues; and
providing information directly related to the products and services you have purchased.

Legitimate interests

We may process your personal data where this is necessary for legitimate interests pursued by us or a third party, and provided those interests are not overridden by your rights and freedoms. The legitimate interests we rely on are:

promoting our services to existing customers and to professional contacts in roles relevant to leadership development (B2B marketing);
communicating with you in relation to issues, complaints or disputes;
improving the quality of experience when you interact with our products, services and website (including testing performance and customer experience); and
analysing sales and marketing data to determine the effectiveness of campaigns.

We have carried out a Legitimate Interests Assessment (“LIA”) for each of these activities. The processing is necessary to achieve the interest, is proportionate, and uses minimal personal data. You have the right to object. Please see “Your rights” below.

Consent

Where you have given express consent, we may use your personal data to:

send you newsletters, surveys, information about our awards and events, offers and promotions related to products and services offered by CFL; and
develop, improve and deliver marketing for those products and services.

We process special category personal data only where we have your explicit consent or another Article 9 condition applies. You can withdraw your consent at any time using the contact details at the end of this notice, or by clicking “unsubscribe” in any marketing email. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

We rely on the “soft opt-in” under regulation 22(3) PECR for marketing to existing customers about similar products and services, having given you a clear opportunity to opt out at the point of collection and in every subsequent message.

Photographs and recordings

During some workshops, conferences and events, photographs or short video recordings may be taken for promotional, educational or internal business purposes. Where individuals are identifiable, participants will be informed in advance and, where required by applicable law, consent will be obtained. Participants who do not wish to appear in photographs or recordings should inform a member of the CFL team before or during the event.

Legal obligation

We may also process your personal data where required to do so by law, including responding to lawful requests from government or law-enforcement authorities, or for the prevention or detection of crime or fraud.

Who do we share your personal data with?

We take all reasonable steps to ensure that our staff protect your personal data and are aware of their information-security obligations. We limit access to personal data to those who have a genuine business need to know it.

We may share your personal data with the following categories of recipient:

legal, accounting and other professional advisers, consultants and experts;
Associate consultants, facilitators, coaches and faculty engaged by CFL to deliver programmes. They only receive the personal data necessary to perform their role and, where appropriate, only the participant information relevant to the specific programme or coaching engagement they are delivering. They are contractually required to keep personal data confidential, use it only for CFL purposes, comply with applicable data protection laws, and securely delete or return the data when it is no longer required.
IT service providers — including our cloud productivity suite, customer-relationship-management platform, email-marketing platform, website host and analytics provider;
payment processors, where you make a payment to us;
Oxford Leadership Academy Limited, where a programme requires it (see “Who are we?”);
professional bodies, accreditation organisations and auditors, where required;
a buyer or successor in the event of a merger, divestiture, restructuring, reorganisation, dissolution or other sale or transfer of some or all of CFL’s assets; and
law enforcement and other authorities, if and where required by applicable law.

A list of the specific sub-processors currently engaged by CFL is available on request from contact@cflglobal.com. Where we engage a processor, we put a written contract in place which contains the obligations required by Article 28 UK GDPR, including in relation to confidentiality, security and lawful processing.

Where personal data is transferred outside the United Kingdom, we apply the safeguards described under “International Transfers” below. Where programmes are delivered internationally, participant information may be shared with trainers or programme facilitators located outside your country where necessary for programme delivery. Appropriate safeguards are applied to any international transfers.

How long will we keep your personal data?

We retain personal data only for as long as is necessary for the purposes for which it was collected, or as required by law. Our standard retention periods are:

Category of personal data	Retention period
Client and contract records	Duration of the contract plus 6 years (limitation period under the Limitation Act 1980)
Marketing contacts (no contract)	Until you unsubscribe, or after 24 months of inactivity, whichever is sooner
Website enquiries	24 months from last contact
Website analytics	Aggregated, indefinitely; raw identifiers retained for 14 months in line with default GA4 settings
Job applicant data	12 months after the recruitment decision; longer with your consent
Cookies	See the per-cookie table under “Cookies”
Records required by law (e.g. tax)	6 years, or longer if required by applicable law

At the end of the retention period, personal data is deleted, anonymised, or, where deletion is not technically possible, securely archived and protected from further processing.

Where do we store your personal data and how is it protected?

We take appropriate technical and organisational measures to protect your personal data against loss, misuse, unauthorised access, disclosure, alteration or destruction, in line with Article 32 UK GDPR. These include:

encryption of personal data in transit (TLS) and at rest;
encryption of laptops and mobile devices used to access personal data;
role-based access controls and the principle of least privilege;
multi-factor authentication for our key business systems;
secure document sharing using access-controlled platforms where personal data is exchanged electronically;
regular security awareness training for all staff;
supplier due-diligence and Article 28 contracts with our processors; and
documented incident-response and business-continuity procedures.
regular backups and disaster-recovery procedures designed to maintain the availability and integrity of personal data;

Where you have a username, password or other identifier that gives access to certain services or parts of our site, you are responsible for keeping that credential confidential. Do not share your password with anyone.

No transmission of information over the internet is completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of personal data transmitted to our site, and any transmission is at your own risk.

Personal data breaches

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours of becoming aware of it, in accordance with Article 33 UK GDPR. Where the risk is high, we will also notify you without undue delay, in accordance with Article 34.

International Transfers

Some of our service providers and group operations are based outside the United Kingdom and the European Economic Area (“EEA”). Where this is the case, we take steps to ensure that your personal data receives a level of protection that is essentially equivalent to that guaranteed in the UK and EEA. We do this by ensuring at least one of the following applies:

the personal data is transferred to a country covered by adequacy regulations made by the UK Secretary of State (or, for transfers from the EEA, an adequacy decision of the European Commission);
we have entered into the UK International Data Transfer Agreement (“IDTA”), or the European Commission’s Standard Contractual Clauses (“SCCs”) together with the UK Addendum, with the receiving organisation, supported by a documented Transfer Risk Assessment and any supplementary measures required; or
another lawful Article 46 UK GDPR transfer mechanism applies, such as Binding Corporate Rules, or a derogation under Article 49 UK GDPR is available.

You can ask for a copy of the safeguards we use for a particular transfer by emailing contact@cflglobal.com.

Marketing Communications

From time to time, where we are lawfully permitted to do so, we may use your information to contact you about CFL products, services and events that we think may be of interest to you. For business contacts, we usually rely on legitimate interests or the PECR soft opt-in (existing customers, similar products and services). For consumer contacts, and for any contact made by automated electronic mail to a non-customer, we rely on your consent.

With your permission, we may also use testimonials, quotations, case studies or feedback about our programmes in our marketing materials, website, proposals and tender submissions or other business communications. Unless otherwise agreed, we will not attribute testimonials to you by name or identify your organisation without your prior consent.

You can stop us from contacting you for marketing purposes at any time, and without giving a reason, by clicking “unsubscribe” on any marketing email or by emailing contact@cflglobal.com. Withdrawing consent or unsubscribing does not affect the lawfulness of processing carried out before that point.

Your rights

You have the following rights in relation to your personal data:

Right to be informed: to know what personal data we collect, how we use it, on what lawful basis, who we share it with and how long we keep it. We use this notice to explain that.
Right of access: to receive a copy of the personal data we hold about you (commonly known as a “Subject Access Request”).
Right to rectification: to have any incomplete or inaccurate information we hold about you corrected.
Right to erasure: to ask us to delete your personal data, in the circumstances set out in Article 17 UK GDPR (commonly known as the “right to be forgotten”).
Right to restrict processing: to ask us to suspend processing of your personal data in the circumstances set out in Article 18 UK GDPR.
Right to object to processing: to object to our processing your personal data on the basis of legitimate interests, including profiling. If you object to marketing, we will stop sending you marketing material.
Right to data portability: to receive personal data you have provided to us in a structured, commonly used and machine-readable format. This applies only to data we process by automated means on the basis of consent or contract.
Right to withdraw consent: where we rely on your consent, you can withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.
Rights in relation to automated decision-making: see “Automated decision-making and AI” below.
Right to lodge a complaint: with the ICO or, if you live or work in the EEA, the supervisory authority in your country of residence, place of work or place of the alleged infringement. See “Complaints” below.

How to exercise your rights

You will not usually need to pay a fee to exercise any of these rights. We may charge a reasonable fee, or refuse to act on the request, if it is manifestly unfounded or excessive.

To exercise any right, contact us using the details under “How to Contact Us”. We may need to ask for specific information to confirm your identity. Once we have what we need, we will respond without undue delay and in any event within one month. Where the request is complex or numerous, we may extend that period by a further two months — we will tell you within one month if so, and explain why.

Cookies

Cookies are small text files placed on your device by websites you visit. They are widely used to make websites work, or work more efficiently, and to provide information to the owners of the site.

We only set strictly necessary cookies without your consent. All other cookies, including analytics, functionality and marketing cookies, are set only after you give consent through our cookie banner. You can change or withdraw your consent at any time by clicking the “Cookie preferences” link in the footer of cflglobal.com.

For more information about cookies generally, including how to view and delete the cookies set on your device, see the ICO’s cookies guidance at ico.org.uk/your-data-matters/online/cookies.

Cookies used on cflglobal.com

Cookie	Provider / type	Purpose	Duration
Session / load-balancing	First-party / strictly necessary	Maintains your session and distributes load across our web servers so the site performs well.	Session
Cookie consent	First-party / strictly necessary	Records your cookie preferences so we do not ask again on every page.	12 months
_ga, _ga_*	Google Analytics 4 / analytics	Distinguishes users so we can understand how the website is used in aggregate.	14 months
_gid	Google Analytics 4 / analytics	Distinguishes users for short-term analytics aggregation.	24 hours
YouTube cookies (PREF, VISITOR_INFO1_LIVE, YSC)	Third-party / functional	Set by embedded YouTube videos to remember preferences and measure bandwidth. We use the youtube-nocookie.com embed by default and only switch to standard embed after consent.	Up to 24 months
User preference	First-party / functional	Remembers settings such as layout, default views and search filters.	12 months

A live, fully up-to-date list of the cookies set on cflglobal.com is available in the cookie preference centre accessible from the footer of every page.

Automated decision-making and AI

We do not make decisions about you that produce legal effects, or that significantly affect you, based solely on automated processing.

CFL may use generative-AI and analytics tools to help with internal tasks such as drafting marketing copy, summarising research and publicly available information and analysing aggregated programme feedback. Where we use such tools, we do not input personal data unless the tool has been approved for that purpose, the provider is contractually bound under Article 28 UK GDPR, and human review is applied before any output is used in a way that affects you. We will update this notice in line with the EU AI Act and any equivalent UK transparency obligations as they come into force.

CFL does not use personal data to train public generative AI models.

Complaints

You have the right to complain if you consider that we have not complied with data-protection law in handling your personal data. We will acknowledge your complaint within five working days, investigate without undue delay, keep you informed of progress, and aim to provide a substantive response within 30 days.

Please use the contact details under “How to Contact Us”. If you are not satisfied with our response, you can complain to a supervisory authority:

Information Commissioner’s Office (UK) — org.uk/global/contact-us/ or 0303 123 1113.
EEA residents — you may also complain to the supervisory authority in your country of residence, place of work or place of the alleged infringement. A list is available at edpb.europa.eu.

Children’s Privacy

Our products and services are not directed at children. We do not knowingly collect personal data from children under the age of 13 in the UK (or under the equivalent age of digital consent, which ranges from 13 to 16 depending on the relevant EU Member State). If you become aware that a child has provided us with personal data without parental consent, please contact us using the details below and we will securely delete the data, in accordance with applicable law.

U.S. State Privacy Rights (Addendum)

This addendum applies if you are a resident of a U.S. state with a comprehensive consumer privacy law, currently including California (CCPA / CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Tennessee, Indiana, Florida, Delaware and New Jersey and supplements the rest of this notice.

Depending on your state of residence, you may have the right to:

know what personal information we collect about you, the sources, the purposes, and the categories of recipient;
access a copy of that personal information;
correct inaccurate personal information;
delete personal information we have collected from you;
opt out of the “sale” or “sharing” of your personal information for cross-context behavioural advertising;
limit the use and disclosure of “sensitive personal information”; and
not be discriminated against for exercising your rights.

CFL does not “sell” personal information for money. We do not knowingly process the personal information of consumers under 16 for sale or sharing without consent. To exercise any of these rights, please email contact@cflglobal.com with the subject line “U.S. Privacy Request”. We will verify your identity using the personal information we already hold and respond within the time-frame required by your state’s law (typically 45 days).

Accessibility

This notice is available in alternative formats — including large print, plain text and audio — on request. Please email contact@cflglobal.com.

How to Contact Us

If you have any questions about this notice, or wish to exercise any of your rights, please contact us:

The Data Protection Lead, Companions For Leadership Limited, Prama House, 267 Banbury Road, Oxford OX2 7HT, United Kingdom.

Email: contact@cflglobal.com

Telephone: +44 (0)1865 390950

CFL has not been required to appoint a statutory Data Protection Officer under Article 37 UK GDPR. The Data Protection Lead is the named contact for all data-protection matters.

Changes to this privacy policy

We may update this notice from time to time. The “Last Updated” date at the top of this document shows when it was last revised, and a summary of material changes is given in the revision history below. Where required by law we will notify you of changes directly.

Revision history

Date	Summary of changes
May 2026	Comprehensive update: aligned with UK GDPR, DPA 2018 (as amended by the Data (Use and Access) Act 2025) and PECR; added lawful-basis matrix, retention schedule, per-cookie table, AI / automated-decision section, U.S. state-privacy addendum, accessibility statement and 72-hour breach commitment; resolved duplications and inconsistencies in the previous version.
Earlier	Earlier versions are available on request from contact@cflglobal.com.