Privacy, Cookies & Retention Notice

Effective date: 30 September 2025
Website: shirleykavanagh.com
Controller: Kavaskew Limited registered number 735382 (“Controller”)
Contact for all data queries: admin@shirleykavanagh.com

Who we are

Kavaskew Limited ("we", "us", "our"), is the controller of the personal data described in this Notice. This includes personal data processed through this website, through our consulting, coaching and advisory services, and through the Leadership Discoveries® podcast. Kavaskew Limited is a company limited by shares, incorporated and registered in Ireland (registered number 735382), with its registered office at 65 Yellow Walls Road, Malahide, County Dublin, Ireland.

1. Privacy Notice

This Notice explains how we collect and use personal data in a way that is lawful, fair and transparent, in line with the General Data Protection Regulation (GDPR), the Data Protection Acts 1988 to 2018, and the guidance of the Data Protection Commission (DPC).

1.1 What personal data we collect

•     Enquiries: name, work email, organisation, role and the content of your message when you email us or submit a form.

•     Newsletter (if you subscribe): name and email address.

•     Events and meetings: name, email, organisation, role and scheduling preferences.

•     Clients and programme participants: name, contact details, organisation and role, together with information shared in the course of our consulting, coaching, facilitation and advisory work, such as interview and survey responses, session notes and feedback.

•     Podcast guests: name, contact details, biography, photograph and professional details; the audio, video, images and transcript of the recorded conversation; and the signed podcast release form.

•     Technical and cookie data: limited technical information needed to operate the website securely (see Section 2).

We do not seek to collect special category data, such as information about health. If such information is shared with us in the course of coaching or advisory work, we keep it to the minimum necessary and process it only with your explicit consent or as otherwise permitted by law.

1.2 How we use your data (purposes & lawful bases)

•     Responding to enquiries: replying to your email or contact-form message. Lawful basis: legitimate interests (to operate our website and respond to queries). You can object at any time.

•     Providing services and preparing to contract: scoping work, proposals, scheduling and delivering sessions and programmes. Lawful basis: contract (or steps prior to entering a contract) and, where we are engaged by your organisation, legitimate interests in delivering the agreed work.

•     Producing and promoting the Leadership Discoveries® podcast: preparing for, recording, editing, publishing and promoting episodes, including clips, transcripts, articles and social media content. Lawful basis: contract (the podcast release form) and legitimate interests in producing and promoting the podcast.

•     Newsletter and updates (if you opt in): occasional emails about articles, events and podcast episodes. Lawful basis: consent, which you can withdraw at any time.

•     Protecting our website and complying with law: security, legal obligations and record-keeping. Lawful basis: legitimate interests or legal obligation.

1.3 Where we get your data

•     Directly from you, through emails, forms, calls, meetings and recordings.

• From the organisation that engages us, where you take part in a programme or engagement we deliver for your employer.

  •  Occasionally from a colleague who introduces you by email or provides your work email for scheduling. Where this happens, we will inform you within a reasonable period and provide this Notice where required by Article 14 GDPR.

1.4 How long we keep your data (retention)

We keep personal data only for as long as necessary for the purposes described in this Notice. Our retention periods are set out in the Records Retention Schedule in Section 3. We may keep data for longer where this is needed for legal claims or to comply with the law.

1.5 Who we share data with

Service providers ("processors"): we use trusted providers to run our business, including website hosting, email, cloud storage and productivity tools, calendar and video-meeting tools, our newsletter platform, podcast recording, editing and hosting services, and transcription and AI-assisted tools. They process data only on our instructions, under contract and with appropriate security. Where we use AI-assisted tools, we use them for business purposes such as transcription, drafting and editing, under terms that do not permit the provider to use your data to train its models.

Podcast platforms: published episodes are distributed through public platforms such as Apple Podcasts, Spotify, YouTube and LinkedIn. These platforms are responsible for any personal data they collect from their own users.

•Client organisations: where you take part in a programme commissioned by your employer, we share outputs with that organisation only as agreed for the engagement, normally in aggregated or anonymised form.

•Professional advisers and authorities: our accountants, legal advisers and insurers where necessary, and public authorities where required by law.

We do not sell personal data.

1.6 International transfers

Some of our providers may be located, or store data, outside the European Economic Area. Where this happens, we rely on adequacy decisions of the European Commission (including, for certified United States providers, the EU-US Data Privacy Framework) or on Standard Contractual Clauses approved by the European Commission, with additional safeguards where needed.

1.7 Your data protection rights

• You have the right to:

  •     access your personal data;

  •     have inaccurate data corrected;

  •     have your data erased;

  •     restrict processing;

  •     object to processing based on legitimate interests, including direct marketing, at any time;

  •     data portability; and

  •     withdraw consent where we rely on consent.

  To exercise any of these rights, please contact admin@shirleykavanagh.com. We will respond without undue delay and in any event within one month. Where a request is complex, this period may be extended by up to two further months, and we will tell you if this is the case.

  If you have appeared on the Leadership Discoveries® podcast, we will consider any request to remove or amend published content in line with your podcast release form and will explain our decision. Please note that copies of published content already shared or downloaded by others may be outside our control.

1.8 Complaints

If you have concerns, please contact us first at admin@shirleykavanagh.com. You also have the right to lodge a complaint with the Data Protection Commission (DPC) in Ireland. Visit www.dataprotection.ie to contact the DPC.

1.9 Security

We use appropriate technical and organisational measures to protect personal data, including access controls, encryption in transit where applicable and least-privilege access. Our service providers are bound by confidentiality and security obligations.

1.10 Children

This website and our services are not intended for children under 16. We do not knowingly collect children’s data via the site.

1.11 Do you have to provide data?

Some information is necessary for us to respond to your enquiry, deliver our services or produce a podcast episode with you. If you do not provide it, we may be unable to proceed.

1.12 Automated decision-making

We do not use automated decision-making or profiling that produces legal or similarly significant effects via this website. If that changes, we will inform you and explain your rights.

1.13 Changes to this Notice

We may update this Notice from time to time to remain compliant and transparent. We will post the latest version here with an updated effective date.

2. Cookie Notice

This Cookie Notice explains how shirleykavanagh.com uses cookies and similar technologies.

2.1 What are cookies?

Cookies are small text files placed on your device when you visit a website. They help the site function and remember your preferences.

2.2 How we use cookies

We currently use only strictly necessary cookies, which our website platform needs in order to operate securely. We do not currently use preference or marketing cookies. If we introduce them, we will ask for your consent before setting them and will update this Notice.Some pages contain embedded content, such as podcast players from Spotify or YouTube. These providers may set their own cookies when you play that content, and we will ask for your consent before loading it.

2.3 Legal basis for cookies

Strictly necessary cookies do not require consent under the European Communities (Electronic Communications Networks and Services) (Privacy and Electronic Communications) Regulations 2011. We rely on our legitimate interests in providing a functional and secure website. Any non-essential cookies will be set only with your consent, which you can withdraw at any time.

2.4 Managing cookies & withdrawing consent

Use the Cookie Settings link or banner on our site to manage your preferences at any time.

You can also control cookies via your browser settings, but disabling essential cookies may affect site functionality.

2.5 Cookies we use

Strictly necessary cookies are used for security byt the website host for session management and site performance If we deploy new tools (e.g., Google Analytics), we will update this table and obtain consent before setting non-essential cookies.

3. Records Retention Schedule

The periods below are our standard retention periods, which we review regularly. We may keep data for longer where this is needed for a complaint, legal claim or legal obligation.

•     Enquiries: name, work email, organisation and message content. Lawful basis: legitimate interests. Retained for up to 12 months from last contact.

•     Client and service records: proposals, contracts, session notes and invoices. Lawful basis: contract and legal obligation. Retained for up to 7 years from the end of services, to meet tax, accounting and professional requirements.

•     Event and meeting scheduling: name, email, organisation and availability. Lawful basis: contract or legitimate interests. Retained for up to 24 months from the last meeting.

•     Newsletter subscribers: name, email and subscription status. Lawful basis: consent. Retained until you unsubscribe or after 24 months of inactivity, with prompt removal on opt-out.

•     Podcast: published episodes and related content: lawful basis: contract and legitimate interests. Retained for as long as the episode remains publicly available.

•     Podcast: unedited recordings: lawful basis: contract and legitimate interests. Retained for up to 12 months after the episode is published, or 12 months after recording if the episode is not published.

•     Podcast: guest contact details and preparation materials: lawful basis: legitimate interests. Retained for up to 24 months after the episode is published.

•     Podcast: release forms: lawful basis: contract and legal obligation. Retained for as long as the episode remains available, plus 6 years.

•     Website technical logs: IP address (short-term) and browser information. Lawful basis: legitimate interests. Retained for up to 12 months, for security and troubleshooting.

3. Records Retention Schedule

This schedule outlines typical retention periods/criteria. We retain the minimum necessary and review periodically. We may retain data longer where required for legal claims or compliance.