Privacy Policy

Last updated: June 2026 

This Privacy Policy explains how Elements OBM ("we", "us", "our") collects, uses, and protects your personal data when you visit our website (holliegriffiths.co.uk), engage us for services, or otherwise interact with us. It also explains your rights under UK data protection law.

We are the data controller for the personal data described in this policy.

Who we are

Elements OBM Ltd, 121 Lansdown Rd, Cardiff, CF5 1PS, United Kingdom Email: hollie@elements-obm.co.uk

If you have any questions about this policy or how we handle your data, contact us at the email above.

1. The Data We Collect

We may collect and process the following categories of personal data:

  • Contact details - name, email address, phone number

  • Business/account information - company name, role, information you provide when enquiring about or engaging our services

  • Communications - messages, emails, call notes, and voice/video recordings where calls are recorded (with your knowledge)

  • Payment information - processed via our payment providers (e.g. Kajabi); we do not store full card details ourselves

  • Usage data - automatically collected data about how you use our website, such as IP address, browser type, pages visited, and time spent on the site

  • Cookies - see Section 6 below

We do not knowingly collect special category data (e.g. health, religious, or biometric data) unless you volunteer it to us in the course of our work together, in which case we will only use it for the purpose you provided it.

2. How We Use Your Data, and Our Lawful Basis

  • Delivering our services - managing client accounts, projects, and communications under a contract. Lawful basis: performance of a contract.

  • Responding to enquiries - replying to messages, discovery call bookings, and questions. Lawful basis: legitimate interests / pre-contractual steps at your request.

  • Discovery calls - taking notes, recording (where applicable), and follow-up. Lawful basis: legitimate interests / pre-contractual steps at your request.

  • Invoicing and payment - processing payments and keeping financial records. Lawful basis: performance of a contract / legal obligation.

  • Marketing communications - sending updates, offers, or newsletters. Lawful basis: consent (you can opt out any time).

  • Website analytics - understanding site usage to improve the service. Lawful basis: legitimate interests (non-essential cookies require consent - see Section 6).

  • Legal and compliance - meeting our legal, accounting, and regulatory obligations. Lawful basis: legal obligation.

We will never use your data for a purpose incompatible with the one it was collected for without telling you.

3. Use of AI Tools

We use artificial intelligence tools as part of how we deliver our services. This section explains how.

What we use AI for:

  • Assisting with drafting, summarising, and formatting written communications (e.g. cleaning up voice-to-text notes)

  • Supporting note-taking, summarisation, or transcription of discovery calls and client meetings

  • General operational and administrative support (e.g. document drafting, research)

What this means for your data:

  • Where a discovery call or meeting is recorded and/or processed using an AI transcription or summarisation tool, we will tell you this is happening before or at the start of the call, and you can ask for the recording/AI processing to stop at any time.

  • Where client information is entered into an AI tool (for example, to help draft a message or summarise notes), we take reasonable steps to avoid inputting more personal data than necessary, and we have reviewed the relevant tool providers' data processing terms.

  • Our AI tool providers act as data processors and are contractually bound (via data processing agreements) not to use your data to train their own models, where that provider offers such terms, and not to use it for any purpose beyond providing the service to us.

  • We do not use AI to make solely automated decisions about you that produce legal or similarly significant effects (for example, decisions about pricing, onboarding, or contract terms are always made or reviewed by a human). If this ever changes, we will update this policy and tell you directly.

AI tool providers we currently use include, but are not limited to: Anthropic (Claude), Loom, Zoom, ClickUp. We review this list periodically and will keep it up to date.

If you have questions about our use of AI in relation to your data, or would prefer we didn't use AI tools when working on your account, contact us at hollie@elements-obm.co.uk.

4. Who We Share Your Data With

We share personal data only where necessary, with the following categories of recipient:

  • Service providers / processors we use to run our business and deliver services, including:

    • Kajabi (course hosting, email, payments)

    • ClickUp (project management)

    • Squarespace (website hosting)

  • Professional advisers - our accountant, legal advisers, or insurers, where necessary

  • Legal or regulatory authorities - where we're required to disclose data by law, or to protect our legal rights

We do not sell your personal data. We do not have a parent company or corporate affiliates that this data is shared with.

Some of these providers are based outside the UK (for example, in the United States). Where this is the case, we ensure an appropriate safeguard is in place, such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or reliance on an adequacy decision, before data is transferred.

5. How Long We Keep Your Data

We keep personal data only for as long as necessary for the purpose it was collected, including to meet legal, accounting, or reporting requirements. As a guide:


  • Client contract and financial records: retained for 6 years after the end of the relationship, in line with UK tax and accounting requirements

  • Marketing contact data: retained until you unsubscribe or request deletion

  • Discovery call notes/recordings: retained for 24 months after the call, unless you become a client, in which case retained per the client record above

  • Website usage/analytics data: retained for 24 months, per your analytics tool's default

If you'd like specifics on how long we hold your particular data, just ask.

6. Cookies

We use cookies and similar technologies on our website. These fall into the following categories:

  • Strictly necessary cookies - required for the website to function; no consent required

  • Functionality cookies - remember your preferences; used with consent where not strictly necessary

  • Analytics cookies - help us understand site usage; used only with your consent

You can manage or withdraw cookie consent at any time via [your cookie banner/settings tool, if you have one - currently the policy doesn't mention a cookie consent banner; if your Squarespace site doesn't show one, this should be added, since UK PECR rules require consent for non-essential cookies].

7. Your Rights

Under UK GDPR, you have the right to:

  • Access the personal data we hold about you

  • Rectification of inaccurate or incomplete data

  • Erasure of your data ("right to be forgotten"), in certain circumstances

  • Restriction of processing, in certain circumstances

  • Object to processing based on legitimate interests or for direct marketing

  • Data portability - receive your data in a portable format, where applicable

  • Withdraw consent at any time, where processing is based on consent (this won't affect processing carried out before withdrawal)

  • Complain to the ICO if you're unhappy with how we've handled your data - the Information Commissioner's Office can be contacted at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to resolve any concerns directly first, but this is your right regardless.

To exercise any of these rights, contact hollie@elements-obm.co.uk. We'll respond within one month.

8. Children's Privacy

Our services are directed at businesses and business owners, not children. We do not knowingly collect personal data from anyone under 18. If you believe a child has provided us with personal data, please contact us and we will delete it.

9. Security

We take reasonable technical and organisational measures to protect your personal data, including access controls and secure storage via our service providers. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be updated on our website, and the "Last updated" date will be revised accordingly.