Obvious Candidate
Effective date: 1 January 2024
Last reviewed: 28 February 2026

1. Introduction

Obvious Candidate respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store, and protect your personal data when you visit our website, contact us, enquire about our services, sign up to receive updates, or work with us as a client.

For the purposes of UK data protection law, Obvious Candidate is the data controller of the personal data covered by this policy.

Contact details
Sam Waterfall
Founder, Obvious Candidate
Email: sam [at] obviouscandidate.com

2. The personal data we may collect

We may collect and process the following categories of personal data:

your name

your email address

your phone number

your company name and job title

information you provide in an enquiry form, booking form, or email

information you share during discovery calls or coaching conversations

billing and payment-related information, where relevant

technical data such as IP address, browser type, device information, and website usage data

marketing preferences and communication choices

Personal data is broadly defined under UK GDPR as information relating to an identified or identifiable person.

3. How we collect your data

We may collect your data when you:

complete a website contact form

book a call or submit an enquiry

sign up for emails, downloads, or updates

purchase or enquire about coaching services

communicate with us by email, phone, social media, or video call

browse our website

provide information during coaching or related services

4. How we use your data

We may use your personal data to:

respond to enquiries

arrange and deliver discovery calls or coaching services

manage our relationship with you

send service-related communications

provide requested resources or updates

send marketing communications where permitted

manage bookings, records, administration, and payments

improve our website, services, and client experience

protect our business, website, and users from misuse or unlawful activity

5. Lawful bases for processing

Under UK GDPR, organisations must identify a lawful basis for processing personal data. Depending on the situation, Obvious Candidate may rely on:

consent, for example where you opt in to receive marketing emails

contract, where processing is necessary to provide services to you or to take steps at your request before entering into a contract

legitimate interests, where it is reasonable for us to use your data for purposes such as responding to enquiries, operating and improving our business, maintaining records, and protecting our website and services, provided those interests are not overridden by your rights and freedoms

legal obligation, where we need to comply with applicable law or regulatory requirements

6. Sensitive or special category data

In the course of career coaching, you may sometimes choose to share sensitive personal information, such as information relating to health, wellbeing, diversity, or other personal circumstances.

Where special category data is involved, we will only process it where a valid additional condition applies under data protection law. In practice, this will usually be because you have given your explicit consent, or because another lawful condition clearly applies. We do not seek to collect more sensitive information than is reasonably necessary. UK GDPR treats data concerning health and certain other sensitive categories as “special category data,” and explicit consent is one recognised condition for processing it.

7. Marketing communications

If you opt in to receive updates, newsletters, or other marketing from Obvious Candidate, we may send you relevant communications by email.

You can unsubscribe or opt out at any time by using the unsubscribe link in an email or by contacting us directly. ICO guidance states that electronic direct marketing will often require consent, and organisations must stop direct marketing covered by an opt-out when someone unsubscribes.

8. Sharing your data

We do not sell your personal data.

We may share your personal data with trusted service providers where reasonably necessary to run the business and deliver services, for example:

website hosting providers

email and newsletter platforms

CRM or contact management tools

calendaring and booking tools

payment processors

cloud storage providers

video conferencing platforms

accountants, legal advisers, or other professional advisers

contractors or associates supporting service delivery, where appropriate and confidential

Where we share personal data, we expect third parties to handle it securely and lawfully. Under ICO guidance, organisations must identify a lawful basis before sharing personal data.

9. International transfers

Some third-party providers may process or store personal data outside the UK.

Where this happens, we will take reasonable steps to ensure that any restricted transfer is handled in accordance with UK data protection law, for example by relying on UK adequacy regulations or other appropriate safeguards where required. ICO guidance says restricted transfers must be covered by adequacy regulations, appropriate safeguards, or a valid exception.

10. Data security

We take appropriate technical and organisational measures to help protect personal data against unauthorised access, loss, misuse, alteration, or disclosure.

No method of transmission or storage is completely secure, but we aim to use systems and processes appropriate to the nature of the data we handle. The ICO states that organisations must process personal data securely and have appropriate security measures in place.

11. Data retention

We keep personal data only for as long as reasonably necessary for the purposes for which it was collected, including to meet legal, accounting, tax, contractual, or record-keeping requirements.

Retention periods may vary depending on the type of data and the reason we hold it. When data is no longer needed, we will delete it or securely dispose of it where appropriate. ICO guidance says personal data should not be kept longer than necessary or held indefinitely “just in case.”

12. Your data protection rights

Depending on the circumstances, you may have the right to:

be informed about how your data is used

access the personal data we hold about you

request correction of inaccurate or incomplete data

request erasure of your data

request restriction of processing

object to certain processing

request transfer of certain data to you or another provider

withdraw consent where we rely on consent

The ICO explains these rights in its guidance for organisations and the public.

To exercise your rights, please contact us using the details above.

13. Complaints

If you have a concern about how we handle your personal data, please contact us first and we will try to resolve it.

You also have the right to complain to the Information Commissioner’s Office (ICO). ICO guidance for the public says people should usually raise concerns with the organisation first, and the ICO can then consider a complaint if the issue is not resolved.

14. Cookies

Our website may use cookies and similar technologies to help the site function, remember preferences, understand website usage, and improve performance.

Where required, we will ask for your consent before placing non-essential cookies on your device. Essential cookies that are strictly necessary for the website or service you request may be used without consent. ICO guidance says websites must explain what cookies do and why they are used, and must get consent for non-essential cookies, with limited exceptions for strictly necessary cookies.

15. Third-party links

Our website may contain links to third-party websites. Once you leave our website, we are not responsible for the privacy practices or content of those external sites.

16. Changes to this policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated effective date.