Diald Privacy Policy

Introduction

This notice describes how we collect, store, transfer and use personal data. It tells you about your privacy rights and how the law protects you.

In the context of the law and this notice, ‘personal data’ is information that clearly identifies you as an individual or which could be used to identify you if combined with other information. Acting in any way on personal data is referred to as ‘processing’.

This notice applies to personal data collected through https://diald.coach, Diald account and marketplace features, transactional emails, support communications and our official social media pages.

We do not sell personal data. We share personal data only as described in this notice, including where necessary to operate the marketplace, process payments, provide support, prevent misuse or comply with law.

1. 1.

   Our role and the role of Coaches

Diald is the controller of personal data used to operate the marketplace, manage accounts, facilitate enquiries and purchases, administer payments, moderate reviews, provide support and protect the platform.

A Coach is normally a separate controller of personal data that a Client provides to that Coach so the Coach can respond to an enquiry or supply a Service or Plan. Coaches are responsible for their own privacy obligations when they use that information.

Where we process personal data only on a Coach's documented instructions, we act as that Coach's processor in accordance with the Diald Coach Terms and Conditions.

Diald is operated for users in Great Britain. If you access Diald from elsewhere, local privacy law may give you additional mandatory rights. Nothing in this notice limits those rights.

Contacting us about privacy

We have not currently appointed a data protection officer. Responsibility for data protection remains with Diald.

If you have questions about this notice or wish to exercise a legal right, email support@diald.coach or write to us at [REGISTERED OFFICE].

Personal data we process

1. 2.

   How we obtain personal data

The information we process about you includes information:

1. you have directly provided to us

2. that we gather from third party databases and service providers

3. as a result of monitoring how you use our website or our services

4. 3.

   Types of personal data we collect directly

When you create an account, make or respond to an enquiry, publish a Coach profile, purchase or supply a Service or Plan, submit a review or contact us, we ask you to provide personal data. This may include:

• personal identifiers and contact information, such as your name, email address, telephone number and optional social-media contact details

• account and authentication information, including your account identifier, sign-in method, session information and security records

• Coach profile and professional information, including profile photographs, biography, location or service area, qualifications, experience, availability, prices and Service or Plan listings

• enquiry and service information, including contact details, answers to Coach questions, messages, requirements and Plan content

• transaction information, including orders, prices, platform fees, payment and payout status, refunds, chargebacks, disputes and related Stripe identifiers

• communications, review content, ratings, support requests and your marketing or communication preferences

Depending on how you use Diald, we may also process:

1. information associated with Google sign-in if you choose to use it, such as your Google account identifier, name, email address and profile image

2. business and tax information supplied by a Coach, such as a trading name, company number, VAT status and Stripe Connect account status

3. identity, business and verification status information that Stripe makes available to us through Stripe Connect; Stripe normally collects the underlying identity documents directly

4. evidence supplied in connection with a complaint, purchase issue, refund, chargeback, safety concern or suspected breach of our terms

5. technical, cookie and security information described later in this notice

6. 4.

   Types of personal data we collect from third parties

We may receive personal data from service providers and other users where this is necessary to operate Diald, verify a transaction, provide sign-in, investigate a concern or comply with law.

This may include:

1. account information from Google when you choose Google sign-in

2. payment, payout, verification and fraud-prevention information from Stripe and its financial partners

3. business information supplied by a Coach or available from public registers

4. information supplied by a Client, Coach or other person in a review, complaint, dispute or safety report

5. delivery, security and diagnostic information from our hosting, database, authentication and email providers

6. 5.

   Types of personal data we collect from your use of our services

By using our website and our services, we process:

1. account, authentication and session information used to give you secure access to Diald

2. content you contribute, including Coach profiles, listings, enquiries, messages, reviews and ratings

3. records of purchases, Plan delivery, issue reports, refunds, transfers, disputes and administrative actions

4. technical information about the device and software used to access Diald, including IP address, browser type, operating system and security logs

5. usage information, including pages visited, features used, timestamps and interactions with transactional messages

6. preferences and choices relating to communications, cookies, reviews and the use of your information

7. information needed to detect, prevent and investigate fraud, abuse, security incidents and breaches of our terms

8. 6.

   Our use of aggregated information

We may aggregate anonymous information such as statistical or demographic data for any purpose. Anonymous information is that which does not identify you as an individual. Aggregated information may be derived from your personal data but is not considered as such in law because it does not reveal your identity.

For example, we may aggregate usage information to assess whether a feature of our website is useful.

However, if we combine or connect aggregated information with your personal data so that it can identify you in any way, we treat the combined information as personal data, and it will be used in accordance with this privacy notice.

1. 7.

   Special personal data

Special category data includes information about health, race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, genetics and biometric data used for identification.

Information about criminal convictions and offences is subject to separate legal protections.

Diald does not require special category data for ordinary account use. However, a Client may choose to include health, injury, accessibility or similar information in an enquiry, message or Service requirement so that a Coach can respond or provide a suitable Plan.

Where this is special category data, we process it only where an Article 9 condition applies. In most cases this will be your explicit consent. You may withdraw that consent, but doing so does not affect processing already carried out and may prevent the relevant Coach from supplying the requested service.

Do not include health information or other special category data in a public Coach profile or review. Coaches must process Client health information lawfully and only for the purpose for which it was supplied.

1. 8.

   If you do not provide personal data we need

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform that contract.

In that case, we may have to stop providing a service to you. If so, we will notify you of this at the time.

The bases on which we process information about you

The law requires us to determine under which of six defined bases we process different categories of your personal data, and to notify you of the basis for each category.

If a basis on which we process your personal data is no longer relevant then we shall immediately stop processing your data.

If the basis changes then if required by law we shall notify you of the change and of any new basis under which we have determined that we can continue to process your information.

1. 9.

   Information we process because we have a contractual obligation with you

When you create an account, submit or respond to an enquiry, purchase or supply a Service or Plan, or otherwise agree to the Diald terms, a contract is formed between you and us or you ask us to take steps before entering into a contract.

In order to carry out our obligations under that contract we must process the information you give us. Some of this information may be personal data.

We may use it in order to:

• create, authenticate and secure your account

• publish and manage Coach profiles, Services and Plans

• facilitate enquiries and communications between Clients and Coaches

• process purchases, refunds, fees, transfers and transaction records through Stripe

We process this information on the basis there is a contract between us, or that you have requested we use the information before we enter into a legal contract.

We process this information for as long as necessary to perform the contract and may retain relevant records afterwards where required for legal, accounting, fraud-prevention or dispute purposes.

1. 10.

   Information we process with your consent

We rely on consent where you make a genuine choice, including for optional marketing, non-essential cookies and, where applicable, special category data you choose to provide.

Where consent is required, we ask for a clear positive action. We do not treat silence or a pre-ticked box as consent.

We do not sell your contact information or share it with unrelated organisations for their own marketing.

We continue to process your information on this basis until you withdraw your consent or it can be reasonably assumed that your consent no longer exists.

You may withdraw consent at any time through the relevant account or cookie control, by using an unsubscribe link, or by emailing support@diald.coach.

Withdrawal of consent does not affect processing already carried out. We may continue processing where another lawful basis applies, and we will explain this if relevant.

1. 11.

   Information we process for the purposes of legitimate interests

We may process information on the basis there is a legitimate interest, either to you or to us, of doing so.

Where we process your information on this basis, we do after having given careful consideration to:

• whether the same objective could be achieved through other means

• whether processing (or not processing) might cause you harm

• whether you would expect us to process your data, and whether you would, in the round, consider it reasonable to do so

For example, we may process your data on this basis for the purposes of:

1. improving and developing Diald using aggregated or appropriately limited information

2. record-keeping for the proper and necessary administration of our business

3. responding to communications and providing support

4. preventing fraudulent, abusive or unauthorised use of Diald

5. exercising and defending legal rights, enforcing our terms and protecting users, Coaches and our intellectual property

6. obtaining insurance, legal, accounting, security and other professional advice needed to manage business risk

7. moderating reviews, investigating complaints and purchase issues, and protecting a person's interests where we reasonably believe we have a duty to do so

8. 12.

   Information we process because we have a legal obligation

Sometimes, we must process your information in order to comply with a statutory obligation.

For example, we may be required to give information to legal authorities if they so request or if they have the proper authorisation such as a search warrant or court order.

This may include your personal data.

1. 13.

   Information we process to protect vital interests

In situations where processing personal information is necessary to protect someone’s life, where consent is unable to be given and where other lawful bases are not appropriate, we may process personal information on the basis of vital interests.

For example, we may inform relevant organisations if we have a safeguarding concern about a vulnerable person.

How and when we process your personal data

1. 14.

   Who we share personal data with

We share only the personal data reasonably necessary for the purposes described in this notice. For example, Client enquiry and order information is shared with the relevant Coach; public Coach profile information and reviews are shared with website visitors; and transaction data is shared with Stripe.

1. 15.

   Information you provide

Diald allows Coaches to publish profiles and Service or Plan listings and allows users to publish reviews and ratings.

Information submitted to a public area is intended to be read by other people. We may display your name, username or profile information with that content as explained at the point of submission.

Public information may include:

• a Coach's name, profile image, biography, qualifications, location or service area, Services, Plans and social links

• a reviewer's displayed name, rating, review text and date of review

Do not publish information about another person unless you have the right to do so, and do not publish sensitive information that you do not want to be public.

We use public content to operate profiles, listings, reviews and sharing features and to moderate the marketplace.

Public content may be copied, indexed or cached by search engines and other third parties outside our control.

A Coach profile is public and may be indexed by search engines. Coaches can edit the information shown on their profile through their account, subject to moderation and record-retention requirements.

Removing content from Diald may not remove copies already held by search engines, recipients or other third parties.

You may ask us to remove personal data you have posted by emailing support@diald.coach. We will consider your request in light of your legal rights and any lawful reason to retain the information.

1. 16.

   Payment information

Payments from Clients and transfers to Coaches are processed using Stripe and Stripe Connect.

Stripe collects payment-card and bank-account information through its secure services. Diald does not store full card numbers, security codes or full Coach bank-account details.

We receive limited transaction information from Stripe, such as Stripe account and payment identifiers, payment status, amount, currency, card brand and last four digits where available, refund or dispute information, transfer status and Coach verification or onboarding status.

Stripe may act as our processor and as an independent controller for payment processing, identity checks, fraud prevention, regulatory compliance and its own services. Stripe's processing is also governed by its privacy information at https://stripe.com/gb/privacy.

A Client's payment is collected by the Diald platform and the Coach's net amount becomes eligible for transfer after the seven-day Plan review period, unless an issue, refund, chargeback, dispute or compliance hold applies.

1. 17.

   Information obtained from third parties

We receive personal data from Google when you use Google sign-in, from Stripe in connection with payments and Coach onboarding, and from Clients, Coaches or other people who submit reviews, complaints or reports.

We use that information only for the relevant account, transaction, support, safety, legal or marketplace purpose.

1. 18.

   Disputes between users

If a purchase issue, complaint or dispute arises between a Client and a Coach, we may use and share relevant order, Plan, enquiry, communication and evidence information with the parties as reasonably necessary to investigate and decide the matter.

We may also disclose relevant information to Stripe, professional advisers, insurers, regulators, law enforcement or a court where necessary to manage a refund, chargeback, fraud concern, legal claim or other lawful process.

1. 19.

   Service providers and business partners

We use carefully selected service providers to operate Diald. They may process personal data only for the services they provide to us, except where a provider is also an independent controller under its own terms.

Our main providers and recipients include:

1. Supabase, which provides database, authentication and file-storage services

2. Stripe and its financial, identity-verification and fraud-prevention partners, which process payments, Coach onboarding, transfers, refunds and disputes

3. Vercel, which hosts and delivers the Diald website and application

4. Resend, which sends transactional account, enquiry, purchase and support emails

5. Google, for business email and, where selected by you, Google sign-in

6. professional advisers, insurers, auditors, prospective buyers of the business and public authorities where reasonably necessary and lawful

7. 20.

   Automated decision-making

Diald does not currently make decisions based solely on automated processing that produce legal or similarly significant effects for you.

Stripe may use automated systems for fraud prevention, identity verification, risk assessment and payment processing under its own privacy information. Contact us if you believe an automated process has affected you unfairly.

Use of information we collect through automated systems

1. 21.

   Cookies

Cookies and similar technologies are small data files or identifiers used by a website to remember information, maintain a session or support security and payment functions.

Diald currently uses strictly necessary technologies for Supabase authentication and Stripe payment and fraud-prevention functions.

These technologies help keep you signed in, complete secure sign-in and payment flows, prevent misuse and protect the service.

Some are session cookies that expire when you close your browser. Others persist for a limited period set by the relevant provider.

You can control cookies through your browser, although blocking strictly necessary cookies may prevent account or payment features from working.

If we introduce non-essential cookies or similar technologies, we will provide a clear choice and obtain consent before using them where required by law.

We do not currently use cookies for third-party advertising or remarketing.

More information, including the cookies currently used, is available in the Diald Cookie Policy at https://diald.coach/cookies.

1. 22.

   Personal identifiers from your browsing activity

Requests made by your browser or device to Diald and our service providers may be recorded for delivery, authentication, security, diagnostics and fraud prevention.

These records may include IP address, approximate location derived from it, browser and device type, operating system, requested pages, timestamps, referring page and security events.

We use this information to deliver and secure Diald, diagnose faults, investigate misuse and understand service performance.

Where technical information can identify you or is linked to your account, we treat it as personal data.

Other matters

1. 23.

   Your rights

Depending on the circumstances and lawful basis, UK data protection law may give you the following rights:

• the right to be informed about how we use your personal data

• the right to request access to your personal data

• the right to have inaccurate or incomplete personal data corrected

• the right to request erasure of personal data in certain circumstances

• the right to request restriction of processing in certain circumstances

• the right to object to processing based on legitimate interests and to object to direct marketing at any time

• the right to data portability where the legal conditions apply

• the right to withdraw consent at any time where processing is based on consent

• rights relating to solely automated decisions that produce legal or similarly significant effects

To exercise a right, email support@diald.coach. Some rights are subject to exemptions, and we may need to verify your identity.

1. 24.

   Use of our services by children

Diald is intended only for people aged 18 or over. We do not knowingly permit children to create accounts, purchase Services or operate as Coaches.

You must not use Diald if you are under 18.

If we learn that we have collected personal data from a child, we will take reasonable steps to close the account and delete the information, subject to any legal duty to retain it.

1. 25.

   Encryption of data sent between us

We use transport encryption, access controls, authentication, service-provider security measures and other reasonable technical and organisational safeguards appropriate to the risks of processing.

No system is completely secure. You are responsible for protecting your sign-in credentials and should contact us promptly if you suspect unauthorised account access.

1. 26.

   Data may be processed outside the UK

Diald uses service providers including Supabase, Stripe, Vercel, Resend and Google. Personal data may be processed in the United Kingdom, the European Economic Area, the United States and other countries where those providers operate.

Some countries may not provide the same level of legal protection for personal data as the United Kingdom.

Where a restricted transfer occurs, we use a lawful transfer mechanism and take reasonable steps to ensure that the information remains protected.

Depending on the transfer, safeguards may include:

• United Kingdom adequacy regulations recognising the destination as providing adequate protection

• the United Kingdom International Data Transfer Agreement

• the United Kingdom Addendum to the European Commission's Standard Contractual Clauses

• an approved certification or data-transfer framework where it lawfully applies

• a transfer risk assessment and supplementary contractual, organisational or technical protections where required

You may contact support@diald.coach for more information about the safeguards used for a particular transfer.

27. Control over your own information

It is important that the personal data we hold about you is accurate and up to date. Please inform us if your personal data changes.

At any time, you may contact us to request that we provide you with the personal data we hold about you.

At any time you may review or update personally identifiable information that we hold about you, by signing in to your account on our website.

To obtain a copy of any information that is not provided on our website you should contact us to make that request.

When we receive any request to access, edit or delete personal data we first take reasonable steps to verify your identity before granting you access or otherwise taking any action. This is important to safeguard your information.

We normally respond to a valid request without charge and within one month. The law allows us to extend the time for a complex request and, in limited cases, to charge a reasonable fee or refuse a request that is manifestly unfounded or excessive. We will explain if this applies.

To ask us to remove or restrict personal data, email support@diald.coach.

This may limit the service we can provide to you.

A request to erase or stop processing is subject to legal exemptions. We may retain information needed for transactions, tax, fraud prevention, legal claims, the rights of other people or compliance with law.

28. Communicating with us

When you contact us, whether by telephone, through our website or by email, we collect the data you have given to us in order to reply with the information you need.

We keep a record of your request and our response so we can provide support, maintain an audit trail, resolve complaints and protect legal rights.

This record may include your name, contact details, account or order reference, the content of the communication and actions taken.

29. Complaining

If you have a privacy concern or complaint, email support@diald.coach.

Please include enough information for us to identify the relevant account, transaction or content and understand your concern.

We process complaint information to investigate and respond, comply with legal obligations, protect users and establish, exercise or defend legal claims.

Where a complaint relates to user-generated content, we may temporarily restrict the content while we investigate if this is reasonably necessary.

A complaint does not automatically result in removal. We will consider privacy rights, freedom of expression, our legal obligations and the rights of other people.

If an investigation reasonably requires us to contact another person, we disclose only information necessary to explain and resolve the concern or comply with law.

We may also compile statistics showing information obtained from this source to assess the level of service we provide, but not in a way that could identify you or any other person.

We will acknowledge a privacy complaint within 30 days and respond without undue delay. We will try to resolve complaints fairly and promptly.

If you are in any way dissatisfied about how we process your personal data, you have a right to lodge a complaint with the Information Commissioner's Office (ICO). This can be done at https://ico.org.uk/make-a-complaint/. We would, however, appreciate the opportunity to talk to you about your concern before you approach the ICO.

30. Retention period

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, fraud-prevention and dispute requirements. Our general periods are:

• account and profile information: while the account is active and for up to six years after closure where needed for legal claims, fraud prevention or compliance

• orders, payments, platform fees, transfers, refunds and tax records: generally six years after the relevant transaction or financial period

• enquiries and ordinary support communications that do not lead to a transaction: generally up to two years after the last activity

• purchase issues, complaints, disputes, chargebacks and related evidence: generally six years after resolution

• reviews and public content: while published and afterwards for a reasonable period where needed for moderation, records or legal claims

• security and technical logs: generally up to twelve months, unless required for an active security, fraud or legal investigation

Backups may retain information for a limited period after deletion. When retention expires, we delete or anonymise the information unless law requires longer retention.

31. Compliance with the law

This notice is intended to comply with the UK General Data Protection Regulation, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations 2003, in each case as amended by the Data (Use and Access) Act 2025 or otherwise amended or replaced from time to time.

32. Review of this privacy policy

We may update this privacy notice when our service, providers or legal obligations change. We will publish the updated version on our website, change the date at the top and provide additional notice where the change is material or the law requires it.