Last updated: 21 August 2026
At a glance
Josh Leonard, trading as Lendurance Coaching, is responsible for your personal information. We use it to respond to enquiries, provide and safely manage coaching, take payment, keep required records and protect our website and business. We do not sell your personal information.
1. Who we are
The data controller is Josh Leonard, trading as Lendurance Coaching. You can contact Josh at josh@lendurancecoaching.com or +44 7708 970894.
This notice applies to website visitors, people who make an enquiry, adult coaching clients and people named as emergency contacts. Lendurance Coaching does not provide personal training or coaching to anyone under 18.
2. Information we collect
- Identity and contact details: name, date of birth, address, email address, phone number and preferred contact method.
- Enquiry information: the service you are interested in, your goals and anything you include in your message.
- Coaching information: consultation answers, goals, availability, training history, session notes, programme information, progress and feedback.
- Health and safety information: PAR-Q answers, injuries, symptoms, medical conditions, medication, pregnancy or postnatal information, professional guidance and emergency-contact details. Health information is special category data and receives additional protection.
- Communications: messages and correspondence sent by email, WhatsApp or other agreed channels.
- Payment and transaction information: billing details, payment status, amounts and transaction references. Stripe processes card details; Lendurance Coaching does not normally receive or store your full card number.
- Website and security information: information needed to operate and protect the site, such as IP address, device or browser details, request logs and anti-spam checks.
If you give us another person's details, such as an emergency contact, please tell them that you have done so and direct them to this notice where practical.
3. How and why we use it
| What we do | UK GDPR lawful basis |
|---|---|
| Respond to an enquiry, discuss your needs and prepare to provide a service | Taking steps at your request before entering into a contract |
| Deliver, administer and review coaching or personal training | Performance of our contract with you |
| Manage records, communications, service quality, safety and legal claims | Our legitimate interests in running a safe, effective and accountable coaching business |
| Process health information for screening, programme design and exercise safety | Your explicit consent; where necessary, establishing, exercising or defending legal claims |
| Use emergency-contact or health information in a genuine emergency | Vital interests, where needed to protect someone's life or physical safety |
| Take payment and keep tax and accounting records | Performance of our contract and compliance with legal obligations |
| Operate, secure and prevent misuse of the website | Our legitimate interests in maintaining a secure and reliable website |
You may withdraw consent for future use of your health information at any time by contacting us. Withdrawal does not make earlier processing unlawful, but it may mean we cannot safely continue the service. We do not make decisions about you using solely automated processing that produces legal or similarly significant effects.
4. If you do not provide information
Some information is optional. However, if we do not receive the contact, payment, health or safety information reasonably required for a service, we may be unable to respond, enter into a coaching agreement or train you safely.
5. Who we share information with
We use trusted providers only where needed to run the service. These may include:
- OpenAI Sites and Cloudflare for website hosting, enquiry storage, security and anti-spam checks;
- Google Workspace to deliver website enquiries and correspondence;
- Google Drive for secure cloud storage and file management;
- WhatsApp (provided by Meta) when you choose to communicate with us through WhatsApp;
- Stripe for payment processing;
- professional advisers, insurers, regulators, courts, law-enforcement bodies or public authorities where reasonably necessary or legally required; and
- a healthcare professional where you ask or authorise us to share information, or where disclosure is necessary in a genuine emergency or required by law.
Providers may act as processors under our instructions or as separate controllers for parts of their service. We share only what is reasonably necessary and do not sell personal information.
6. International transfers
Some service providers may process information outside the United Kingdom. Where UK data-protection law requires it, we rely on an adequacy decision or appropriate safeguards such as approved contractual protections. You can contact us for more information about the safeguards relevant to your information.
7. How long we keep information
- Unsuccessful enquiries: normally 12 months after the last meaningful contact.
- Client consultation, PAR-Q, consent, coaching, training and related communication records: normally six years after coaching ends.
- Payment, invoice and accounting records: normally six years after the end of the relevant financial year.
- Routine website security logs: normally up to 30 days, unless needed for longer to investigate an incident, prevent abuse or meet a legal requirement.
We may keep a record for longer where a dispute, safeguarding concern, legal claim or legal obligation requires it. Deleted information may remain in protected backups until those backups are overwritten in the ordinary cycle.
8. How we protect information
We use reasonable organisational and technical measures, including access controls on the MacBook used for business, limited access to cloud accounts, reputable service providers and proportionate account security. No internet or storage system can be guaranteed completely secure, but we review how information is handled and limit access to what is needed.
9. Your rights
Depending on the circumstances, you may have the right to:
- ask for a copy of your personal information;
- correct inaccurate or incomplete information;
- ask us to delete information or restrict how it is used;
- receive certain information in a portable format;
- withdraw consent at any time where consent is the basis used; and
- object to processing based on legitimate interests.
Your right to object: you can object to our use of your information where we rely on legitimate interests. We will stop unless we have compelling legitimate grounds to continue or need the information for legal claims.
To exercise a right, contact josh@lendurancecoaching.com. We may need to confirm your identity. There is usually no fee, and we normally respond within one month.
10. Complaints
Please contact us first so we can try to resolve your concern. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, 0303 123 1113, Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
11. Updates and contact
We may update this notice when our services, providers or legal responsibilities change. The date at the top shows the latest version. Questions about this notice or how your information is used can be sent to josh@lendurancecoaching.com.