Last updated: 2 November 2026

This policy explains what personal data Kirkpatrick Consult Limited (“KCL”, “we”, “us”) collects when you use kcltd.es or work with us, why we collect it, who we share it with, how long we keep it, and your rights.

Who we are

Kirkpatrick Consult Limited is the controller of your personal data.

  • Registered in England and Wales, company number 06285045
  • Registered office: 28 New Barns Road, Ely, Cambridgeshire CB7 4PN, United Kingdom
  • Office in Spain: Carrer de Francesc Vidal i Sureda 62, La Bonanova, 07015 Palma de Mallorca
  • Email: info@kcltd.es · Phone: +44 7887 554 006 (UK), +34 648 882 933 (Spain)

We work with clients in the UK and the European Union, so we follow both the UK GDPR and Data Protection Act 2018, and the EU GDPR together with Spain’s data protection law (LOPDGDD).

What we collect and why

When What we collect Why, and on what legal basis
You send us a message through a contact form Name, email address, subject, message To reply to you. Legitimate interests (answering enquiries), or steps before a contract if you’re asking about our services.
You download one of our guides Name, email address To send you the guide by email (through MailerLite). We don’t add you to our newsletter unless you subscribe separately. Steps you’ve asked us to take.
You subscribe to our newsletter Email address To send you our monthly newsletter. Consent, which you can withdraw at any time with the unsubscribe link in every email.
You book a call or meeting Name, email address, phone number, anything you add to the booking To arrange and hold the meeting. Steps before a contract, or legitimate interests.
You buy something from our shop Name, billing and delivery address, email address, phone number, what you ordered To process and deliver your order and keep the records the law requires. Contract, and legal obligation (tax and accounting records).
You pay Payment details Payments are handled by PayPal (including the card and local payment methods it offers) or by bank transfer. We don’t see or store your full card details. Contract.
You have an account on our site (for example for the team-building scavenger hunt) Name, email address, password (stored encrypted), your orders To give you access. Contract.
You become a client Contact details, information about your business, and anything you share during the engagement. For coaching and assessments this can include your CliftonStrengths or Predictive Index results. To deliver the service. Contract. Assessment results are processed through Gallup’s and The Predictive Index’s own platforms and are covered by our client agreement.
You browse the site IP address, browser and device information, pages visited, and cookie data (see Cookies below) To keep the site secure and working, and, only if you agree, to understand how it’s used. Legitimate interests (security) and consent (analytics).

We don’t sell your personal data, and we don’t use it for automated decisions that have legal or similarly significant effects on you.

Cookies

When you first visit, a banner asks which cookies you accept. You can change your choice at any time with the cookie button in the bottom corner of every page.

  • Necessary cookies make the site work: remembering your cookie choice, your language, and the contents of your basket. They don’t need consent.
  • Analytics and marketing cookies help us understand how the site is used. We use HubSpot’s website analytics. We only set them if you accept them.
  • Embedded content from other websites behaves as if you had visited that website. This includes the Google map on our contact page and the Microsoft Bookings calendar on our bookings page, and these sites may collect data about you.

Who we share it with

We use trusted service providers who process data on our behalf and only as we instruct:

  • Website hosting: IONOS, on servers in the United Kingdom
  • Microsoft: email (Microsoft 365) and online bookings (Microsoft Bookings)
  • MailerLite: our newsletter, and sending the guides you download
  • HubSpot: customer relationship management and website analytics (EU data centre)
  • PayPal: payments
  • Google: spam protection on our forms (reCAPTCHA) and the map on our contact page
  • Gallup and The Predictive Index: assessments, for clients who take them
  • Our professional advisers (for example, our accountants), where needed

We may also disclose data where the law requires it.

International transfers

Some of these providers store or access data outside the UK and the European Economic Area, for example in the United States. Where they do, the transfer is protected by an adequacy decision (such as the EU–US Data Privacy Framework and its UK extension), or by the standard contractual clauses approved by the UK and the European Commission.

How long we keep it

Data How long
Enquiries that don’t lead to work 2 years from our last contact
Client records and correspondence 6 years after the engagement ends
Orders, invoices and accounting records 6 years after the end of the financial year, as UK and Spanish law require
Newsletter subscription Until you unsubscribe
Guide downloads 2 years, unless you become a client
Website account Until you ask us to delete it, or 3 years after you last use it
Security logs Up to 12 months

Your rights

You have the right to:

  • ask for a copy of your personal data;
  • ask us to correct it, or to delete it;
  • ask us to restrict how we use it, or object to our using it;
  • ask for it in a portable format;
  • withdraw your consent at any time, where we rely on consent (this doesn’t affect anything we did before).

To use any of these rights, email info@kcltd.es. We’ll reply within one month.

If you’re unhappy with how we’ve handled your data, please tell us first so we can put it right. You can also complain to a data protection authority:

  • UK: the Information Commissioner’s Office, ico.org.uk, 0303 123 1113
  • Spain: the Agencia Española de Protección de Datos, aepd.es

Children

Our website and services are for businesses and adults. We don’t knowingly collect data from children under 16.

Changes to this policy

We may update this policy from time to time. The date at the top shows when it last changed.