Who is responsible for your information
Hadi Khalaf, trading as IN-PACT Leadership Institute ("IN-PACT", "we" or "us"), is the controller responsible for the personal information described in this notice.
- Email: info@in-pactleadership.com
- Postal address: 29 Kings Drive, London HA9 9HN
Contact us using these details to ask about this notice, to use your rights or to make a data protection complaint.
Joining and using the Community
We collect your name and email address to create your account, let you sign in and save your Readiness Score result. You need to give both to join, and we cannot create an account without them. You can read every public page without joining.
We record your Newsletter choice, any request for a 30-minute coaching session, and the Interests you choose, such as becoming an Associate or hearing about the Retreats or the Summit. The Founders receive an internal email with your name, email address, coaching request and chosen Interests, so they can deal with your request. Choosing an Interest does not sign you up to ongoing promotional messages.
We email you a six-digit code to sign in. Our account service records sign-in activity, including your internet address and browser information, to help prevent misuse and protect accounts.
You can leave the Community at any time from your Profile on the Community page. That removes your account and takes you off the Newsletter.
Our lawful basis for creating and running your account and saving your result is the performance of our agreement with you. We rely on legitimate interests to secure accounts and to deal with coaching requests and Interests: our interests are protecting our services and answering what you have asked for.
Your Readiness Score
Your twenty answers stay in your browser while you complete the questionnaire. We receive them only if you join the Community and save your result. We then keep your answers, score and level with your account, and email you a copy.
The score uses a fixed formula to place your answers on one of five readiness levels. It is an indicative self-assessment, not a decision about your eligibility for employment, services or opportunities. We make no solely automated decisions about you through it that have legal or similarly significant effects.
We use this information to give you the assessment and the saved result you asked for, on the contractual basis described above.
Enquiries and WhatsApp
When you write to us through Contact us, we collect your name, email address, message, topic and any organisation you give. For a Retreat enquiry, we also collect the role, the number of people and the dates you give. We use this information to answer you and discuss your request.
When you message us on WhatsApp, we receive your phone number, your WhatsApp name and your messages. The Founders can read those messages on their phones and linked devices. Where the website shows a WhatsApp button, it is a plain link: it loads nothing from WhatsApp before you tap it. WhatsApp also handles your information under its own privacy notice.
We rely on legitimate interests in answering enquiries and managing our correspondence. Where you personally ask us to take steps before a contract, we rely on that pre-contractual basis for those steps. An enquiry made on behalf of an organisation is handled under legitimate interests.
We use an enquiry's contact details to deal with the request you make. We do not treat an enquiry as permission to add you to our Newsletter.
Associate applications
We collect your name, email address, country, CV, what you tell us about your background and any LinkedIn profile you choose to give. We use them to assess your suitability and to write to you about your application.
Our lawful basis is legitimate interests in finding suitable coaches and practitioners. Where we need to take steps you ask for before a contract with you personally, we use that basis for those steps.
Please do not include photographs, identity documents, health information, ethnicity, religion, criminal records or other sensitive information in an application. We do not ask for them. If you send sensitive information we do not need, we will restrict access to it and remove or redact it where appropriate, and we will not use it to assess you without a lawful basis and any additional condition the law requires.
The application form marks the details it needs. Without them, we may not be able to consider your application.
Newsletter and marketing choices
We send the dotHAI monthly Newsletter only if you actively opt in. Our lawful basis is your consent. The Newsletter is optional, and it is not a condition of joining the Community, taking the Readiness Score or making an enquiry.
You can withdraw your consent at any time with the unsubscribe link in each Newsletter, or by emailing us. Withdrawing it does not affect what we did before.
When you unsubscribe, we keep only what we need to respect your choice. Unsubscribing does not stop the account, security, legal or requested service emails you need.
Where information comes from
We get information from you, and automatically from your use of our website and account systems, as this notice describes.
Who receives your information
Information is available to the Founders, Hadi Khalaf in the UK and Annie-Mariel Arroyo in Puerto Rico, where they need it to manage the Community and answer requests.
Our web developer, in Puerto Rico, has access only as needed to build, run and support the website, on our instructions.
We use the service providers below for the purposes listed. We check their contractual roles. Some providers may also use limited information for their own purposes, under their own privacy notices.
- Cloudflare: website hosting, delivery and security.
- Supabase: Community accounts, sign-in, sign-in records and saved Readiness Score results. The database is in London.
- Resend: sign-in codes, result emails and the emails the website sends to us.
- GoDaddy: our business email.
- Kit: Newsletter subscriptions and sending the Newsletter.
- Umami: optional visitor numbers, only with your consent (see Cookies and similar technologies).
- GitHub: the website's code and deployment files. What you send through the website is not kept there.
- WhatsApp: the messages you choose to send through its service.
We may share relevant information with professional advisers and authorities where necessary for advice, legal compliance, or establishing, exercising or defending legal claims. We do not sell your personal information, and we do not give it to anyone for their own marketing.
International access and transfers
Some information can be reached from outside the UK, including from Puerto Rico, the United States and Germany. A database kept in London does not stop support staff elsewhere from reaching it. Cloudflare may handle information across its global network.
For our service providers, we rely on UK adequacy regulations where they apply, such as for Germany, or on appropriate safeguards: the EU standard contractual clauses with the UK Addendum in their data processing terms. We rely on the UK Extension to the EU–US Data Privacy Framework only where a provider is currently certified and the transfer is within its cover.
For our web developer in Puerto Rico, we are putting in place a data processing agreement with the ICO's International Data Transfer Agreement, supported by a transfer risk assessment. They are not yet signed, and we will change this notice when they are.
Write to us for information about the safeguards for your information and how to get a copy, with confidential details removed where appropriate.
How long we keep information
- Contact us messages, Retreat enquiries and WhatsApp chats: two years after our last contact, unless a resulting contract or legal matter needs a different period, which we will explain to you.
- Associate applications and CVs that do not succeed: twelve months after we receive them. If you become an Associate, your records are kept as we explain for that relationship.
- Community accounts, saved Readiness Score results, Interests and coaching requests: while your account stays open. When you leave, we delete them within thirty days.
- Your sign-in sessions, with their internet address and browser: until you sign out or leave the Community.
- Newsletter subscriptions: until you unsubscribe. After that, we keep only what we reasonably need to show your consent and respect your opt-out.
- Optional visitor numbers: six months.
- Hosting and security logs: Cloudflare's logs three days, Supabase's one day, and its sign-in log one hour. Resend keeps the emails it sends for thirty days.
- Records the law asks us to keep, or needed for a legal claim: for the period the law sets, or as long as the claim reasonably needs, with access restricted.
We delete or anonymise information once we no longer need it.
Cookies and similar technologies
The website sets no cookies, and shows no adverts. It keeps a few things in your browser's own storage:
- Signing in: when you sign in, Supabase keeps your sign-in key (
sb-fiurzrweurbulyxmiidh-auth-token), and the website keeps a copy of your account (inpact-member): your name, email address, Newsletter choice, coaching request, Interests and Readiness Score answers, so each page shows them at once. Both go when you sign out. - Within one tab: your Readiness Score answers while you join to see your result (
inpact-score-waiting), and a short message for the next page (inpact-toast). Both go when you close the tab. - Your choice about visitor numbers:
inpact-count-visitswhen you switch them on, andumami.disabledwhen you switch them off.
These are needed for things you ask for, and are not used for advertising.
Optional visitor numbers. Only with your prior consent, Umami records the pages you visit and their titles, the website you came from, your browser and device, screen size, language, approximate location, and steps such as starting the Readiness Score. It uses your internet address and browser information to make a changing identifier. We do not treat the absence of names or cookies as proof that this information is anonymous.
We do not start Umami until you switch it on with the switch below. You can use the website fully without it, and switch it off again at any time; switching off does not affect what was counted before. Our lawful basis for optional visitor numbers is your consent. The delivery and security work that keeps the website running rests on our legitimate interests in running and protecting it, or on contract where it is needed for an account feature you ask for.
Your data protection rights
Depending on the circumstances, you can ask for access to your personal information, for it to be corrected or erased, for its use to be restricted, and for a portable copy of information you gave us that we process automatically on the basis of consent or contract.
You can object to our use of your information based on legitimate interests, on grounds relating to your situation. You have an absolute right to object to the use of your information for direct marketing, including related profiling. Where we rely on your consent, you can withdraw it at any time.
Write to info@in-pactleadership.com to use your rights. We normally answer without undue delay and within one month. Where the law allows more time, asks us to clarify a request or to check your identity, we will explain. Requests are normally free; in limited cases the law allows a reasonable fee or a refusal.
Children
Our website and Community are for adults aged eighteen and over. We do not knowingly invite children to join. If you believe a child has given us personal information, contact us so we can look into it and act, deleting it where appropriate.
Complaints
If you have a concern about our use of your information, write to info@in-pactleadership.com. We acknowledge a data protection complaint within thirty days, look into it properly, keep you informed and tell you the outcome without undue delay.
You have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator. The ICO generally asks you to raise the matter with us first.
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
Changes to this notice
We change the date above whenever this notice changes. Before we use your information in a materially different way, we will tell you, and ask for your consent again where the law requires it. We will tell Members directly where appropriate.