Legal
Privacy policy
Clear information about how Forthfield AI collects and uses personal data.
Last updated: 18 August 2026
- Data controller
- Only The Kind Media Limited, trading as Forthfield AI
- Company number
- 15062874 (registered in England and Wales)
- Privacy contact
- rachel@forthfield.ai
- Last updated
- 18 August 2026
In short: we collect only the information needed to answer enquiries, arrange and deliver training, run the business and meet legal duties. We do not sell personal data.
1. About this policy
This policy explains how Forthfield AI collects and uses personal data when you visit forthfield.ai, book a call, enquire about or buy training, complete a questionnaire, attend a session, communicate with us, interact with our business on social media, or otherwise deal with us.
It applies to prospective clients, clients, training participants, business contacts and website visitors. It should be read with our Cookies notice and any additional privacy information we give at the point of collection.
2. Who is responsible for your data
Only The Kind Media Limited, trading as Forthfield AI (referred to as 'Forthfield AI', 'we', 'us' or 'our'), is usually the controller of the personal data described in this policy. This means we decide why and how that data is used.
You can contact us about privacy at rachel@forthfield.ai. We are not required to appoint a data protection officer, but privacy enquiries are handled by the director.
3. Personal data we collect
Enquiries and bookings
Your name, work contact details, organisation, job title or role, preferred appointment time, booking answers, and the content of messages or calls. Calendly processes booking information when you use our scheduling page.
Training and service delivery
Pre-training questionnaire responses, the AI tools you use, the tasks and workflows you want help with, accessibility or session preferences you choose to tell us, training notes, attendance details, follow-up questions, and materials or examples you decide to share.
Please use redacted, fictional or non-sensitive examples wherever possible. Do not send special-category data, criminal-offence data, passwords, confidential third-party material or unnecessary personal data unless we have agreed a safe way to handle it in advance.
Client administration and payment
Business contact details, proposals, contracts, purchase orders, invoices, payment status, transaction references and relevant correspondence. We do not normally receive or store full payment-card details; those are handled by the relevant payment provider if card payment is offered.
Feedback, testimonials and recordings
Feedback you provide and, only with clear permission, your name, role, organisation, photograph, testimonial, case-study content or a session recording. We will explain the intended use when asking for permission.
Website and device information
Our website and hosting providers may process IP address, device and browser type, pages requested, referring page, date and time, and security or error logs. We may use aggregate page and event counts to understand which content is useful. See the Cookies notice for details of cookies and similar technologies.
Marketing preferences
Your email address, organisation, areas of interest, consent record, and whether you have unsubscribed or objected to marketing.
Data received from other sources
Most information comes directly from you. We may also receive business contact details from your employer or a colleague who arranges training, from a referral you have authorised, from Calendly or another service provider used to complete your request, or from professional information you have made public, such as a company website or LinkedIn profile. If we obtain personal data indirectly, we provide privacy information within the period required by law.
4. Why we use personal data and our lawful bases
Where we rely on legitimate interests, we consider the purpose, necessity and possible effect on you. You can ask for more information about that assessment and may object to processing based on legitimate interests.
To respond to enquiries and scope training
Purpose: to answer questions, understand your needs, recommend an appropriate service, prepare a proposal and arrange a call.
Lawful basis: our legitimate interests in responding to business enquiries and developing our services, and taking steps at your request before entering a contract.
To arrange and deliver services
Purpose: to schedule sessions, tailor training, communicate with participants, deliver agreed work and provide follow-up materials.
Lawful basis: performance of a contract with you, or our legitimate interests in delivering the contract with your employer or organisation where you are a participant or business contact.
If information you voluntarily provide for an accessibility adjustment reveals health or disability information, we use that special-category data only to arrange the adjustment and rely on your explicit consent. You may withdraw that consent, although we may then need to discuss another way to meet your needs.
To administer the business
Purpose: contracts, invoicing, payment records, account management, service records, complaints, insurance and professional advice.
Lawful basis: performance of a contract, compliance with legal obligations, and our legitimate interests in operating and protecting the business and establishing or defending legal claims.
To improve and secure our services
Purpose: quality assurance, troubleshooting, website security, fraud prevention, service improvement and understanding website use.
Lawful basis: our legitimate interests in maintaining secure, effective services. Where a non-essential cookie requires consent, we rely on consent instead.
To send relevant marketing
Purpose: to send updates about Forthfield AI services, workshops or useful content and to measure engagement where permitted.
Lawful basis: consent where required; otherwise our legitimate interests where UK data protection and electronic-marketing rules permit this, including relevant business-to-business communications and the customer 'soft opt-in'. Every marketing email provides a simple way to opt out.
To publish a testimonial or case study
Purpose: to show the experience and results of working with Forthfield AI.
Lawful basis: your consent. You may withdraw consent for future use at any time, although we may not be able to recall material already lawfully printed or republished by others.
5. When client or participant data appears in training
Training is often based on real workflows. If an organisational client provides personal data about employees, customers or other people, that organisation is responsible for ensuring it has a lawful basis and authority to provide it. We ask clients to minimise, redact or replace personal data before sharing it.
Depending on the arrangement, Forthfield AI may act as a separate controller for ordinary client administration and as a processor when handling personal data solely on an organisational client's documented instructions. Where required, the contract or a separate data-processing agreement will set out the relevant responsibilities.
During live training, participants decide what to enter into their organisation's or their own AI account. The AI provider's terms and privacy information apply to that account. We encourage the use of approved business accounts and redacted, fictional or non-sensitive examples. Forthfield AI will not deliberately enter identifiable client or third-party data into a consumer AI service unless the use has been agreed, is necessary and has an appropriate lawful basis and safeguards.
We do not use client-confidential material or personal data from a private training session to create public examples, marketing content or case studies without permission.
6. Who we share personal data with
We share personal data only where needed with service providers that support scheduling, email, documents and response storage, website and database hosting, transactional email, online meetings, accounting, payments, customer administration, IT support and security. Current core services include Calendly and Google Workspace, including Google Sheets. Providers act under their own privacy terms and, where they process data for us, under appropriate contractual obligations.
We may also share data with professional advisers, insurers, regulators, tax authorities, courts, law-enforcement bodies or prospective buyers or advisers in a genuine business reorganisation, but only where lawful and necessary.
We do not sell or rent personal data. We do not allow service providers to use it for their own unrelated marketing.
7. International transfers
Some service providers may store or access personal data outside the United Kingdom. Where UK data-protection law requires protection for an international transfer, we use an applicable adequacy regulation or appropriate safeguards such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful mechanism. You may contact us for information about the safeguards relevant to your data.
8. How long we keep personal data
We keep data only for as long as reasonably needed for the purpose collected, including legal, accounting, tax, insurance and dispute requirements. Our normal periods are set out below, but a shorter or longer period may apply where the circumstances or law require it.
- Enquiries and booking information: up to 24 months after the last meaningful contact.
- Questionnaires, training notes and routine delivery records: up to 24 months after the engagement ends, unless the contract requires a different period or earlier deletion is appropriate.
- Contracts, invoices and tax records: normally six years after the end of the relevant financial period.
- Marketing records: until you withdraw consent or object, or until we decide the information is no longer current or useful. We may retain a minimal suppression record to ensure we respect an opt-out.
- Website security and technical logs: for the period reasonably required for security, troubleshooting and provider operations, normally no longer than 12 months unless an incident requires longer retention.
- Testimonials and case studies: while the permission remains valid and the material is in active use, subject to periodic review.
9. Security
We use proportionate technical and organisational measures designed to protect personal data, including access controls, password and account security, encrypted connections, restricted sharing and data-minimisation practices. Access is limited to people and providers who need it for their role.
No internet or storage system is completely secure. If a personal-data breach is likely to risk people's rights and freedoms, we will assess it, record it and notify the Information Commissioner's Office and affected people where the law requires.
10. Cookies and external services
The website uses technologies needed to operate securely and may use limited analytics. Non-essential cookies or similar technologies are used only where the applicable rules allow and, where required, after consent. You can change available choices through the website's cookie controls. Please read our Cookies notice for the current details.
Our website may link to or embed services operated by others, such as Calendly, LinkedIn or Instagram. Those organisations may act as separate controllers and their own privacy policies apply when you use their services.
11. Your data-protection rights
Depending on the circumstances, UK data-protection law gives you the following rights. These rights are not all absolute, and exemptions may apply.
Access
Ask for confirmation that we process your personal data and obtain a copy, with related information.
Correction
Ask us to correct inaccurate data or complete incomplete data.
Erasure
Ask us to delete personal data where there is no continuing lawful reason to keep it.
Restriction
Ask us to limit how we use personal data in certain circumstances.
Objection
Object to processing based on legitimate interests. You have an absolute right to object to the use of your personal data for direct marketing.
Portability
Receive certain data you provided in a structured, commonly used and machine-readable format, or ask us to transfer it, where the legal conditions apply.
Withdraw consent
Withdraw consent at any time where consent is the lawful basis. This does not affect processing that was lawful before withdrawal.
12. How to exercise a right
To exercise a right, email rachel@forthfield.ai. We may need enough information to verify your identity and locate the relevant data. We normally respond within one month and do not charge a fee, although the law permits a reasonable fee or refusal in limited cases involving manifestly unfounded or excessive requests.
13. Complaints
Please contact us first so we can try to resolve your concern. You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority. Visit ico.org.uk, telephone 0303 123 1113, or use the contact details published by the ICO. If you are outside the UK, you may also have the right to contact your local data-protection authority.
14. Automated decisions
We do not make decisions about people based solely on automated processing that produce legal or similarly significant effects. If that changes, we will provide the information and safeguards required by law before the processing begins.
15. Children
Forthfield AI provides business training and is not directed at children. We do not knowingly collect personal data directly from children through the website. Please contact us if you believe a child has provided personal data to us in error.
16. If you do not provide information
You do not have to provide personal data simply to browse ordinary website pages. However, if you do not provide contact, booking, delivery or payment information needed for an enquiry or contract, we may be unable to arrange a call, tailor or deliver training, or complete the transaction.
17. Changes to this policy
We may update this policy when our services, providers or legal obligations change. The current version will be published at forthfield.ai/privacy with a revised 'last updated' date. We will draw attention to material changes where appropriate.
18. Contact
Privacy enquiries and rights requests: rachel@forthfield.ai.
Data controller: Only The Kind Media Limited, trading as Forthfield AI, company number 15062874, registered in England and Wales.