Privacy Policy

Last updated: 7 June 2026

1. Who we are and how to contact us

This website and its associated materials, products, and services (the "Services") are owned and maintained by Forward Business Solutions Ltd, a private limited company registered in England & Wales with Company No. 16359150, registered office 2 South Pasture, South Kelsey, LN7 6RF ("Forward Business Solutions", "Company", "we", "us", "our").

For your own account, membership, and billing data, we are the controller of your personal data, as set out below, in respect of the Services defined in our Terms & Conditions, which incorporate this Privacy Policy by reference. You can contact us at [email protected] about this policy.

Where you load other people's personal data (your own contacts, clients, leads, or subscribers) into tools we provide or set up for you, you are the controller of that data and we act as your processor; this is governed by Schedule 2 of our Terms & Conditions. Where you take the separate Velocity Web Hosting service, the provider of that service (see section 5) acts as your processor under its own terms.

2. What this policy covers

This policy explains what data we collect and why, our lawful bases, how we share data with trusted third parties, how long we keep it, your rights, and how to exercise them. We process data in accordance with the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018 ("DPA 2018").

3. Data we collect

We collect and process the following categories of personal data:

• Identity and contact data - your name, business or trading name, email address, telephone number, billing and postal address, and country.
• Account and login data - your username, password (held in encrypted form), and access and activity logs on the Platform.
• Payment and billing data - your subscription and transaction history and billing records. Card payments are processed by our payment processor; we do not store full card numbers.
• Membership and engagement data - the courses, modules, and resources you access; attendance at coaching and clinic sessions; worksheet, audit, and form submissions; community posts; and support requests.
• Communications data - emails, SMS and WhatsApp messages, support tickets, and audio/video recordings and machine transcriptions of consultations, coaching, and clinic sessions (see clause 3 of the Terms).
• Marketing and website data - your marketing preferences, and cookie, analytics, and advertising data (for example Meta Pixel and Google Analytics identifiers) collected when you use our website, VSL, and booking pages.
• Other information you provide - anything you choose to share in calls, forms, or content you submit.

We collect this directly from you, automatically through your use of the Services, and occasionally from a named partner where you have opted in to share your details (section 8).

4. Why we use your data, and our lawful bases

Purpose	Lawful basis (UK GDPR)
Provide, administer, and give access to the Services and the Membership (accounts, delivery, scheduling)	Performance of a contract
Take payment and operate recurring/subscription billing	Performance of a contract
Provide support, including the WhatsApp/SMS support lifeline	Performance of a contract; our legitimate interests
Record and machine-transcribe sessions for delivery, training, quality, and support	Our legitimate interests (Legitimate Interests Assessment completed); and performance of a contract for delivery recordings
Send marketing emails or SMS	Your consent, or the "soft opt-in" where legally permitted
Use non-essential analytics and advertising cookies	Your consent
Publish testimonials or material that identifies you	Your consent
Meet our legal, accounting, and tax obligations	Compliance with a legal obligation
Secure our systems, prevent fraud, and establish, exercise, or defend legal claims	Our legitimate interests

We do not rely on your consent for session recording; we rely on legitimate interests (and contract for delivery). You may object to a recording before a session by emailing [email protected], and we will discuss alternatives where practicable.

4A. Special-category data

Our Services are not designed to collect special-category data (such as health or family information) and we do not ask you to share it. If it is incidentally captured (for example in a session or recording), we process it only where you have given explicit consent under UK GDPR Article 9(2)(a) or another Article 9 condition applies, and you may ask us to delete it. Please keep sensitive information out of recorded sessions. For your own clients' sensitive data loaded into tools we provide, you are responsible for the Article 9 condition (Schedule 2 of the Terms).

5. Third-party services we use

We use trusted third parties to deliver the Services. Each is bound by a written data-processing agreement where it acts as our processor and, where applicable, by Standard Contractual Clauses / the UK IDTA for international transfers. The main providers are:

• Platform / CRM - GoHighLevel (HighLevel Inc.) - hosts our client portal, courses, the Membership, order forms, and email/SMS delivery.
• Payment processing - Stripe - processes card payments and recurring billing.
• Communications - Meta Platforms (WhatsApp) and our SMS/email providers - for messaging, including the WhatsApp support lifeline.
• Web hosting - defineXTEND Ltd (trading as High-Velocity X), Co. No. 08031789 - provides the separate, optional Velocity Web Hosting service. Where you take it, you contract with that provider directly under its own terms and privacy notice, and for the data in that hosting it acts as your processor (not ours).
• Advertising and analytics - Meta (Meta Pixel) and Google (Google Analytics).

Publication channels (independent controllers). We may publish success stories on our website, emails, and social media. Those platforms act as independent controllers under their own terms and privacy notices; please review them.

6. International transfers

Some providers process data outside the UK (for example in the United States). Where they do, transfers are made under UK adequacy regulations, or under Standard Contractual Clauses with the UK Addendum / the UK IDTA, with a transfer risk assessment where required. Copies of the safeguards are available on request.

7. Data retention

We keep personal data only as long as needed for the purposes above or to meet legal, accounting, or regulatory obligations:

• Account and Membership records: the term plus 12 months.
• Financial, billing, and tax records: 6 years from the end of the relevant tax year (HMRC).
• Session recordings and transcripts: a defined window (target 90 days; maximum 12-24 months) unless retained for a legal claim.
• Communications and support: 24 months.
• Marketing-consent records: while active plus 24 months after withdrawal.
• Suppression / opt-out list: indefinitely, to honour your opt-out.
• Analytics and advertising identifiers: per the relevant provider's retention.

We delete or anonymise data when it is no longer needed.

8. Marketing and cookies

We send marketing emails or SMS only if you opt in, or under the "soft opt-in" where legally permitted. You can unsubscribe at any time using the link in our messages, and we maintain a suppression list. Service messages relating to your membership (including the WhatsApp support lifeline) are sent as part of providing the Services and are not marketing.

Joint-venture or partner marketing, and any sharing of your details with a named partner, occur only if you explicitly opt in to share your details with that named partner.

We use cookies and similar technologies on our website, VSL, and booking pages for functionality, analytics, and advertising (for example Meta Pixel and Google Analytics). Non-essential cookies are disabled until you consent. On your first visit, a cookie banner lets you choose; you can update or withdraw consent at any time via the "Manage cookies" link or your browser settings.

9. Your rights

You may: access your data (a Subject Access Request); correct inaccuracies; request deletion; restrict or object to processing; request data portability (where applicable); and withdraw consent for marketing or cookies.

To exercise any right, email [email protected]. We will acknowledge promptly, verify your identity, and respond within one month (extendable by up to two further months for complex or numerous requests, and we will tell you if so). We may refuse or charge a reasonable fee for manifestly unfounded or excessive requests. Where we act as a processor for your own contacts' data, we will assist you to meet your obligations to those individuals (Schedule 2 of the Terms).

10. Security

We apply proportionate technical and organisational safeguards, including encryption at rest where supported, access control, device security, staff confidentiality agreements, and ongoing vendor assessments. No online system is completely secure; you share information at your own risk. If a personal-data breach affects your data and is likely to result in a risk to your rights, we will notify you and the ICO as required by law.

11. Children

Our Services are intended for adults (18+). We do not knowingly collect data from children.

12. Changes

We may update this policy to reflect legal or operational changes. The new version and date will appear on this page. Material changes will be notified by email or on-platform announcement.

13. Contact and complaints

For questions, requests, or to exercise your rights: [email protected].

Postal address: Forward Business Solutions Ltd, 2 South Pasture, South Kelsey, LN7 6RF, United Kingdom.

If you are not satisfied with our response, you may complain to the UK Information Commissioner's Office (ICO) at www.ico.org.uk.