Privacy policy

The short version

• Anyone can search without an account. If you send a coach an enquiry, we pass your name, email, who the coaching is for (and, for a child, their age band) and your message to that coach, and keep a copy so they can read it in their account. We never ask for a child's name.
• We count how many people view each coach's page without cookies and without storing anyone's IP address.
• If you list with us, we hold your listing details and login email. Coaches' DBS details are only seen by the coach and the OneTo1 team. Card payments are handled by Stripe: we never see your card number.
• We don't sell your data, and we don't use advertising or tracking cookies.
• You can ask to see, correct or delete your data at any time through our contact page.

1. Who we are

OneTo1 (oneto1.co.uk) is run by Pete Old, trading as PCO Holdings, 17 Cheddington Road, Bournemouth BH9 3NB. We are the "controller" of the personal data described here, which means we decide how and why it's used.

Contact us about anything in this policy through our contact page.

We are registered with the Information Commissioner's Office (ICO) [registration number, once PCO Holdings' registration comes through].

2. People looking for a coach, and anyone browsing the site

Enquiries you send to coaches

When you use the enquiry form on a coach's page, we collect your name, email address, whether the coaching is for your child or for you, your child's age band if it's for a child, and your message.

We use it to send your enquiry to that coach, and we keep a copy in our system so the coach can read it in their account. Our own team can also see enquiries, to run the service and deal with any problems or complaints.

Our legal basis is legitimate interests: you've asked us to put you in touch with a coach, and doing that is the point of the site.

Once the coach has your enquiry, they are responsible for how they use your details, under their own privacy obligations. Our coach terms require them to use your details only to reply to you about your enquiry and provide the coaching you ask about.

Your child's information

We only ask for an age band, which on its own doesn't identify a child. Please don't include your child's name, school or other details in your message.

Counting page views

We count how many people view each coach's page, so coaches can see how their listing is doing. We do this without cookies and without storing your IP address.

When you open a coach's page, our server briefly combines your IP address and browser details with the date and a secret key into a one-way code. Only that code is stored. It can't be turned back into your IP address, and it changes every day, so it can't be used to follow you from one day to the next. Its only use is to count each visitor once per page per day.

Views aren't counted for people who are logged in, or for automated traffic such as search engine crawlers. Our legal basis is legitimate interests: understanding how the directory is used, and showing coaches what they're getting for their subscription.

Messaging or emailing us

If you use our contact form, we collect your name, email address, your club, organisation or business name if you give it, what your message is about, and your message. It is sent to our team by email and also kept in our system, so we can reply and keep track of it. If you email us directly, we use your details in the same way.

We use them only to reply and to deal with what you asked. Our legal basis is legitimate interests: you have asked us to get back to you.

Technical information

Like any website, our hosting provider automatically processes technical information when you visit, such as your IP address and browser type, to deliver pages and protect the site from attack. This is kept briefly in their system logs.

3. Coaches who list with us

What we hold

• Your account: the email address you log in with, and when you joined.
• Your listing: your name or business name, description, who you coach, town, postcode, photo or logo, prices, qualification, links to your website and social media, and your review link, rating and review count. Your postcode is used to place you in the right area and to show your district on a map. The full postcode is not shown publicly.
• Your contact details: the email address enquiries are sent to, and your phone number if you give it. These are never shown publicly.
• Your DBS details, if you add them: your check type, certificate number, date of issue and whether you're on the Update Service (see below).
• Your subscription: your plan, whether it's active, and when it renews, plus the reference numbers Stripe uses for your account. Payments are taken by Stripe; we never see or store your full card details.
• How your listing is doing: view counts (see above) and the enquiries you receive.
• Our own notes: occasionally our team records private notes about a listing, for example if we receive a complaint or a concern.

Why, and on what basis

We use this information to provide the listing you've paid for, to take payments, to let you manage your listing, and to keep the directory accurate and trustworthy. Our legal basis is contract: we need it to provide the service you signed up for. For our private notes, safeguarding and fraud prevention, the basis is legitimate interests.

DBS details

Adding DBS details is optional. If you do, we use them only to check your certificate and show a DBS checked badge on your listing. Our legal basis is your consent, which you can withdraw at any time by removing the details in your dashboard, which also removes the badge. Information about criminal records is handled with extra care: only the OneTo1 team can see these details, we don't record the contents of your certificate, and we delete these details when you remove them or leave.

What's public

Everything in your listing apart from your postcode, contact email, phone number and DBS details appears on your public page while your subscription is active, along with whether we have checked your DBS certificate and qualification. You choose what goes in your listing, and can change it any time from your account.

Your page also shows a map of the postcode district you're in, such as BH23, rather than your address.

4. Who we share data with

We don't sell personal data. We use a small number of trusted providers to run the site, who process data on our behalf and only as we instruct:

• Vercel, which hosts the website.
• Supabase, which stores our database, logins and coaches' photos.
• Stripe, which takes coaches' payments. Stripe is also responsible in its own right for some of the payment information it handles; see Stripe's privacy policy.
• Resend, which we use to send login links, pass enquiries to coaches, and deliver messages from our contact form to our own inbox.
• OpenStreetMap, which provides the map on coaches' pages. The map only loads when you scroll to it. When it does, your browser fetches map images from OpenStreetMap's servers, which see your IP address.
• postcodes.io, a free public service we use to find where a postcode district is on the map. Only that district is sent, never anything about visitors.

We also share an enquiry with the coach it was sent to, as described above, and we may share information if the law requires it, including with the police or children's services where we have a safeguarding concern.

Some of these providers are based in, or use servers in, the United States. Where personal data leaves the UK, we rely on the safeguards UK law allows, such as the UK Extension to the EU-US Data Privacy Framework or the UK International Data Transfer Addendum.

5. Cookies and similar technology

We don't use advertising, analytics or tracking cookies, which is why you won't see a cookie banner on our site.

If you save coaches to your shortlist, the list is stored in your own browser. It never reaches us, and you can clear it at any time by removing coaches from it or clearing your browser's data for our site.

If you're a coach and log in, your browser stores a login token so you stay logged in. This is strictly necessary for the service you've asked for, and is removed when you log out. The payment pages are run by Stripe, which sets its own cookies to prevent fraud.

6. How long we keep data

• Enquiries: up to two years from when they're sent.
• View counts: up to 25 months, so coaches can compare with the same time last year. These can't identify anyone.
• Coach accounts and listings: while your subscription is active, and for up to 12 months after it ends in case you return. After that we delete them, or sooner if you ask.
• DBS details: until you remove them or leave, whichever comes first.
• Payment and invoice records: six years, because UK tax law requires it. These are held by Stripe.
• Messages and emails to us: as long as needed to deal with your query, and no more than two years.

7. Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal data we hold about you
• have inaccurate data corrected
• have your data deleted
• object to us using your data, or ask us to restrict how we use it
• receive data you gave us in a format you can take elsewhere

Contact us to use any of these. We'll reply within one month. It's free, unless a request is clearly unfounded or excessive.

If you're unhappy with how we've handled your data, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

8. Children

OneTo1 is for adults: parents and carers looking for a coach for a child, adults looking for a coach for themselves, and coaches. It isn't for children to use themselves, and we don't knowingly collect their data. Enquiries about a child should be sent by a parent or carer, and only give us the child's age band.

9. Changes to this policy

If we change how we use personal data, we'll update this page and the date at the top. If a change affects coaches significantly, we'll email them first.