Privacy Policy & GDPR Notice

Last updated: 21/08/2026

1. Introduction

This Privacy Policy explains how Heather Elizabeth Crowther, a sole trader trading as “Tombalina Consulting” (“we”, “us”, “our”), collects, uses, shares and protects your personal data when you visit www.tombalinaconsulting.com (the “Website”), join a waiting list, subscribe to our communications, or use our services. We are committed to protecting your privacy and handling your personal data in an open and transparent manner. We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025, and — where it applies to visitors in the European Economic Area — the EU General Data Protection Regulation (EU GDPR). Please read this Policy carefully. By using the Website and providing your personal data, you acknowledge the practices described here.

2. Who we are — the data controller

For the purposes of data protection law, the data controller responsible for your personal data is:

Heather Elizabeth Crowther, trading as Tombalina Consulting
Address:7 Rhododendron Close, Ascot, SL5 8PL, Berkshire
Email: info@tombalinaconsulting.com

We are a sole trader and are not required to appoint a Data Protection Officer, but the person named above is responsible for data protection matters and is your point of contact for any privacy questions or requests.

3. The personal data we collect

Depending on how you interact with us, we may collect and process the following categories of personal data:

Information you give us directly, for example when you join a waiting list, complete a contact or enquiry form, subscribe to our newsletter, sign up for any coaching and councelling or communicate with us:

your name;
your email address;
any other contact details you choose to provide (such as phone number or country);
the content of any messages, enquiries or feedback you send us;
your marketing preferences.

Information about payments (only if and when you purchase paid services in future):

billing details and transaction records. Full card/payment details are handled directly by our third-party payment provider and are not stored by us.

Information we collect automatically when you use the Website:

technical data such as your IP address, browser type and version, device information, time zone setting and location (at a general level);
usage data such as the pages you visit, the links you click, and how you navigate the Website;
data collected through cookies and similar technologies (see Section 11).

We do not intentionally collect special category data (such as data about health, religion or beliefs) through the Website. Please do not send us sensitive personal information unless we specifically ask for it and explain why.

4. How we collect your personal data

We collect personal data:

directly from you, when you fill in a form, join a waiting list, subscribe, buy a course, or contact us;
automatically, through cookies and similar technologies as you interact with the Website;
from third parties, such as our website hosting provider, email marketing platform, and analytics providers, who process data on our behalf.

5. The lawful bases for processing your data

Under data protection law, we must have a lawful basis for processing your personal data. We rely on the following bases:

Consent — where you have given us clear consent to process your data for a specific purpose, such as sending you marketing emails or setting non-essential cookies. You can withdraw your consent at any time.
Contract — where processing is necessary to perform a contract with you, or to take steps at your request before entering into a contract (for example, administering a paid service you have purchased).
Legal obligation — where we need to process your data to comply with the law (for example, keeping records for tax purposes).
Legitimate interests — where processing is necessary for our legitimate business interests and those interests are not overridden by your rights. We rely on legitimate interests to operate, secure and improve our Website, to respond to your enquiries, and to keep basic business records. Where we rely on legitimate interests, you have the right to object (see Section 9).

6. How and why we use your personal data

We use your personal data for the following purposes:

to respond to your enquiries and provide the information or services you request;
to administer waiting lists and registrations of interest, and to notify you when a place, course or webinar becomes available;
to send you newsletters, updates and marketing communications where you have consented to receive them;
to provide, manage and deliver any paid services you purchase (in future);
to operate, maintain, secure and improve the Website and our services;
to keep records and manage our business, including for accounting and tax;
to comply with our legal and regulatory obligations;
to detect, prevent and address fraud, security issues or misuse.

7. Marketing communications

Where you have consented, we will send you marketing emails about our services, content, webinars and offers.

You can withdraw your consent and opt out of marketing at any time by clicking the “unsubscribe” link in any marketing email, or by contacting us at info@tombalinaconsulting.com. If you unsubscribe, we will stop sending you marketing communications but may still contact you about matters relating to a service you have purchased.

We comply with applicable direct-marketing laws, including the UK Privacy and Electronic Communications Regulations (PECR), and — for recipients in other countries — equivalent rules such as the US CAN-SPAM Act (we include our postal address and a working unsubscribe link in every marketing email) and Canada’s CASL (we send marketing only on the basis of appropriate consent).

8. Who we share your personal data with

We do not sell your personal data. We may share it with trusted third parties who provide services to us, acting as our data processors under contract and only on our instructions. These include:

website hosting and infrastructure providers;
email marketing and communications platforms (for example, the service we use to manage subscriptions and send emails);
analytics providers who help us understand how the Website is used;
payment processors (only if and when you make a payment), who handle your payment details directly and securely;
professional advisers such as accountants, where necessary;
regulators, law enforcement or other authorities, where we are required to do so by law.

9. International visitors and international data transfers

The Website is available to visitors internationally. If you access it from outside the United Kingdom, please be aware that your information will be processed in accordance with this Policy and UK data protection law. Some of the third-party providers we use may store or process personal data in countries outside the UK and the European Economic Area, including the United States. Where we transfer personal data internationally, we take steps to ensure it is protected by appropriate safeguards, such as an adequacy decision, the UK’s International Data Transfer Agreement or Addendum, or the EU Standard Contractual Clauses, as required by law.

10. Your rights

Under the UK GDPR and EU GDPR, you have the following rights in relation to your personal data:

The right to be informed about how we use your data (which this Policy provides).
The right of access — to request a copy of the personal data we hold about you.
The right to rectification — to have inaccurate or incomplete data corrected.
The right to erasure — to ask us to delete your personal data in certain circumstances.
The right to restrict processing — to ask us to limit how we use your data in certain circumstances.
The right to data portability — to receive your data in a portable format, or have it transferred to another controller, where applicable.
The right to object — to object to processing based on legitimate interests, and to object to direct marketing at any time.
Rights in relation to automated decision-making and profiling — we do not make solely automated decisions that produce legal or similarly significant effects about you.
The right to withdraw consent — where we rely on consent, you can withdraw it at any time.

To exercise any of these rights, please contact us at info@tombalinaconsulting.com. We will respond within one month. This period may be extended by up to two further months for complex or numerous requests, in which case we will let you know. When responding to access requests, we will carry out reasonable and proportionate searches for your data. We will not usually charge a fee, but we may charge a reasonable fee, or refuse to act, if a request is manifestly unfounded or excessive. We may need to verify your identity before acting on a request.

11. Cookies and similar technologies

Cookies are small text files placed on your device when you visit a website. We use cookies and similar technologies to make the Website work, to understand how it is used, and to improve it. We use the following broad categories:

Strictly necessary cookies — required for the Website to function and to provide services you request. These do not require your consent.
Functional cookies — remember your preferences (such as language) to improve your experience.
Analytics/statistical cookies — help us understand how visitors use the Website so we can improve it.
Marketing cookies — used to deliver and measure relevant content and advertising (only if we use them).

Under UK law (PECR and the UK GDPR as amended by the Data (Use and Access) Act 2025), we will ask for your consent before setting any non-essential cookies. Certain low-risk cookies used purely for statistical/analytics purposes to improve our service, and cookies used only to remember your display preferences, may be exempt from prior consent where they collect only aggregated, non-identifying information — but where we are uncertain, we ask for consent. You can accept or reject non-essential cookies through our cookie banner, and you can change or withdraw your choices at any time. You can also control cookies through your browser settings; blocking some types may affect how the Website works.

12. How long we keep your personal data

We keep your personal data only for as long as necessary for the purposes for which we collected it, including to satisfy any legal, accounting or reporting requirements.

Marketing and waiting-list data: we keep this while you remain subscribed or interested, and for a reasonable period afterwards, and we delete or anonymise it if you unsubscribe or ask us to.
Enquiry and correspondence data: kept for as long as needed to deal with your enquiry and for a reasonable period afterwards.
Transaction and financial records (in future): kept for the period required by tax law (generally at least six years in the UK).

When we no longer need your personal data, we securely delete or anonymise it.

13. How we protect your personal data

We take appropriate technical and organisational measures to protect your personal data against unauthorised or unlawful processing, accidental loss, destruction or damage. These include using reputable service providers, restricting access to personal data, and using secure connections. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

14. Children’s privacy

The Website and our services are intended for adults and are not directed at children. We do not knowingly collect personal data from children under the age of 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

15. Your right to complain

If you have any concerns about how we handle your personal data, please contact us first at info@tombalinaconsulting.com so we can try to resolve the matter. We will acknowledge your complaint and aim to respond without undue delay.

If you are not satisfied, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO), the UK supervisory authority:

Website: ico.org.uk
Helpline: 0303 123 1113

If you are in the European Economic Area, you may also complain to your local data protection authority.

16. Notice to US residents (including California)

If you are a resident of the United States, additional rights may apply to you under your state’s laws. In particular, if you are a California resident, the California Consumer Privacy Act (as amended by the CPRA) may give you the right to know what personal information we collect and how we use it, the right to request access to or deletion of your personal information, the right to opt out of the “sale” or “sharing” of personal information, and the right not to be discriminated against for exercising your rights. We do not sell your personal information. To exercise any applicable rights, please contact us at info@tombalinaconsulting.com.

17. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. Where changes are significant, we will take reasonable steps to notify you. Please review this Policy periodically.

18. Contact us

If you have any questions about this Privacy Policy or how we handle your personal data, please contact:

Tombalina Consulting —Heather Elizabeth Crowther Email: info@tombalinaconsulting.com Address: 7 Rhododendron Close, Ascot, SL5 8PL, Berkshire

Heather Crowther