Privacy Policy

1. Introduction

Future State Performance ("Future State", "we", "us" or "our") is committed to protecting the privacy and security of personal data. This Privacy Policy explains how we collect, use, disclose, retain and protect personal data when you visit our website at [www.futurestate.ie] (the "Website"), contact us, download our resources, attend our events or engage our services.

This Policy is designed to meet the requirements of the EU General Data Protection Regulation (EU) 2016/679 ("GDPR"), the Irish Data Protection Acts 1988 to 2018, and the UK GDPR and Data Protection Act 2018.

2. Who We Are

Future State Performance is a business performance and leadership advisory practice led by Shay Lynch and based in Ireland. For the purposes of applicable data protection law, Future State Performance is the data controller of the personal data described in this Policy.

• Legal entity: [registered business or company name]
• Registered address: [business address]
• Registration number: [company or business registration number]
• Email: info@futurestate.ie

We are not required to appoint a Data Protection Officer. All privacy enquiries should be sent to the email address above.

3. Personal Data We Collect

We collect only the personal data that is necessary for the purposes set out in this Policy. This may include:

• Identity and contact data: name, job title, company name, email address, telephone number and business address.
• Enquiry data: the information you provide when you complete a contact form, book a consultation or correspond with us.
• Resource and marketing data: details you provide when you download a white paper or other resource, subscribe to our newsletter, and your communication preferences.
• Client engagement data: information shared with us in the course of coaching, advisory, programme or CEO Circle engagements, which may include business, operational and performance information.
• Transaction data: billing details, invoices and payment records relating to services you purchase.
• Technical data: IP address, browser and device details, and the pages requested, as recorded in server logs when you use the Website.

We do not seek to collect special category data (such as health information) through the Website and ask that you do not submit such data through our forms. Any such information shared during a client engagement is handled in accordance with our service agreement and applicable law.

Providing your contact details is necessary for us to respond to you or to deliver our services. If you choose not to provide them, we may be unable to do so.

4. How We Collect Personal Data

• Directly from you: when you complete forms, book a call, subscribe, attend an event, enter into an agreement with us or correspond with us.
• Automatically: through server logs and similar technologies when you use the Website. Please see our Cookie Policy for further details.
• From third parties: from publicly available sources such as professional networking platforms, or from referrals made by existing clients and partners.

5. Purposes and Legal Bases for Processing

We process personal data only where we have a lawful basis to do so. The list below summarises our purposes and the corresponding legal bases under Article 6 of the GDPR and UK GDPR:

• Responding to enquiries and booking consultations: taking steps at your request before entering into a contract (Article 6(1)(b)), or our legitimate interest in responding to business enquiries (Article 6(1)(f)).
• Providing our services and managing client relationships: performance of a contract (Article 6(1)(b)).
• Sending newsletters and marketing communications: consent (Article 6(1)(a)), or, for existing clients, our legitimate interest in telling them about similar services, as permitted by Regulation 13(11) of S.I. No. 336 of 2011 and Regulation 22(3) of the UK PECR (Article 6(1)(f)). Every message includes an unsubscribe link.
• Providing downloadable resources: taking steps at your request (Article 6(1)(b)) to send you the resource you asked for.
• Invoicing, accounting and record keeping: compliance with legal obligations (Article 6(1)(c)).
• Operating and securing the Website: our legitimate interest in keeping the Website available, secure and free from misuse (Article 6(1)(f)).
• Establishing, exercising or defending legal claims: our legitimate interest in protecting our legal rights (Article 6(1)(f)).

Where we rely on legitimate interests, we have assessed that those interests are not overridden by your rights and freedoms. We do not carry out automated decision-making, including profiling, that produces legal or similarly significant effects.

6. Disclosure of Personal Data

We do not sell, rent or trade personal data. We share personal data only with the following categories of recipients, and only to the extent necessary:

• Service providers acting as processors, including appointment scheduling (Calendly), website hosting ([hosting provider]), website forms, email lists and newsletters (Kartra), email and productivity services ([email provider]), and font delivery (Google Fonts, which receives your IP address when the Website loads its fonts). All processors are bound by written data processing terms.
• Professional advisers, such as accountants, auditors, insurers and legal advisers, under duties of confidentiality.
• Public authorities, regulators or courts, where required by law or to protect our legal rights.
• A successor business, in the event of a merger, acquisition or sale of all or part of our business, subject to equivalent protections.

7. International Data Transfers

Some of our service providers are located, or process data, outside the European Economic Area ("EEA") and the United Kingdom, including in the United States. Where personal data is transferred outside the EEA or UK, we ensure that an appropriate safeguard is in place, such as:

• an adequacy decision of the European Commission or the UK Government, including the EU-US Data Privacy Framework and its UK Extension, where the recipient is certified under that framework; or
• Standard Contractual Clauses approved by the European Commission, together with the UK International Data Transfer Addendum where relevant.

[Confirm the safeguard for each provider before publication.] You may request further information about the safeguards we use by contacting us.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, accounting and reporting requirements. As a guide:

• Enquiries, consultation bookings and resource download requests that do not lead to an engagement: up to [12] months from our last contact.
• Marketing and newsletter data: until you unsubscribe or withdraw consent.
• Client and financial records: [6] years from the end of the financial year in which the engagement ends, in line with Irish tax and company law.
• Website server logs: up to [30] days, unless required for security investigations.

When personal data is no longer required, it is securely deleted or anonymised.

9. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration or disclosure. These include encrypted (HTTPS) connections, access controls, the use of reputable service providers and confidentiality obligations. While we take reasonable steps to protect personal data, no method of transmission or storage is completely secure. In the event of a personal data breach, we will notify the relevant supervisory authority and affected individuals where required by law.

10. Your Rights

Subject to applicable law, you have the following rights in relation to your personal data:

• Right of access: to obtain confirmation of whether we process your data and a copy of it.
• Right to rectification: to have inaccurate or incomplete data corrected.
• Right to erasure: to request deletion of your data in certain circumstances.
• Right to restriction: to request that we limit our processing of your data.
• Right to data portability: to receive your data in a structured, commonly used and machine-readable format.
• Right to object: to processing based on legitimate interests, and at any time to direct marketing.
• Right to withdraw consent: at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us at info@futurestate.ie. We may need to verify your identity before responding. We will respond within one month, which may be extended by up to two further months for complex requests, in which case we will inform you. No fee is normally charged.

11. Complaints

If you have concerns about how we handle your personal data, please contact us first so that we can try to resolve the matter. You also have the right to lodge a complaint with a supervisory authority, in particular in the country where you live or work, or where an alleged infringement occurred. In Ireland, the supervisory authority is:

• Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28, Ireland. Website: www.dataprotection.ie
• Information Commissioner's Office (UK), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom. Website: ico.org.uk/make-a-complaint

12. Third-Party Websites

The Website links to third-party websites and services. Those third parties are responsible for their own privacy practices, and we encourage you to read their privacy policies.

13. Children

The Website and our services are intended for business professionals and are not directed at individuals under the age of 18. We do not knowingly collect personal data from children.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The updated version will be published on the Website with a revised effective date. Where changes are material, we will take reasonable steps to notify you.

15. Contact Us

For any questions about this Privacy Policy or our data practices, please contact:

• Future State Performance, [business address]
• Email: info@futurestate.ie