Privacy
Privacy policy
How DeepRest collects, uses and protects your personal information, and your rights under UK data protection law: the UK GDPR and the Data Protection Act 2018.
Who we are
DeepRest is the mentoring practice of Nicholas Finnemore (Nick). Nick is responsible for your personal information: he is its “data controller”. In this policy, “we” and “us” mean DeepRest and Nick.
You can contact us about your information at hello@deepestrest.com.
The information we collect
- When you book. Bookings are made through Calendly. It collects your name and email address, the session and time you choose, your time zone, anything you write in answer to the booking form’s optional question (“Please share anything that will help prepare for our meeting.”), and the email address of any guest you add. If you cancel or move a session, Calendly also records that, and any reason you give.
- Your session. Calendly adds the booking to Nick’s Google Calendar, and creates the Google Meet video call link for the session, which Google provides.
- When you email us. Your email address and what you write. Email sent to hello@deepestrest.com passes through Cloudflare, which forwards it to Nick’s Google email account.
- When you visit this website. The website uses no analytics and sets no cookies of its own. It is hosted on GitHub Pages, which logs the IP address of every visitor for security purposes. If you choose to load the booking calendar, Calendly and the services its page uses collect information about your device and store cookies and other items on it, as Services the booking calendar loads and the cookie notice explain.
- If you come from one of our adverts. A link in one of our adverts on Facebook or Instagram adds tags to the web address that name the platform and the advert, such as
utm_source=igandutm_content=ad_b. The tags say nothing about you. The website keeps them in its links as you move between pages, and passes them to Calendly if you book, which records them with your booking. That lets us see which adverts lead to bookings. This website’s own pages have no Meta code, such as Meta’s Pixel, and send Meta nothing about your visit or your booking. Inside the booking calendar, Calendly’s page loads Meta’s code only if you accept Calendly’s optional cookies (see Services the booking calendar loads). What Meta collects when you see or tap an advert on its apps is covered by Meta’s Privacy Policy (external site).
We don’t ask for information about your health. If you choose to tell us about it, for example in the booking form or in a session, we handle it with the extra care the law requires for health information.
How we use it, and our lawful bases
The law allows us to use personal information only where we have a lawful basis under Article 6 of the UK GDPR. For health information we also need a condition under Article 9.
| What we use it for | Lawful basis |
|---|---|
| Arranging and holding the sessions you book, and sending you what you need for them | Providing the mentoring you ask for: Article 6(1)(b) |
| Replying to your emails | Our legitimate interest in answering the questions people send us: Article 6(1)(f) |
| Using any health information you choose to share, only to mentor you | Providing the mentoring you ask for: Article 6(1)(b); and your explicit consent, which you can withdraw at any time: Article 9(2)(a) |
| Loading the Calendly booking calendar, and the cookies and other items Calendly and the services its page uses then store | Your consent, given when you choose to load it: Article 6(1)(a) |
| Recording which advert led to a booking, from the tags in the advert’s link | Our legitimate interest in knowing which adverts help people find us, so that we spend only on those: Article 6(1)(f) |
| Sharing information where the law requires it, or to protect you or someone else from serious harm | Legal obligation, or vital interests: Article 6(1)(c) or 6(1)(d) |
| Keeping the website secure (GitHub’s logs) | Legitimate interests in keeping the website safe and available: Article 6(1)(f) |
We do not sell your information, share it with advertisers or use it to choose who sees our adverts, and we do not make decisions about you based solely on automated processing.
The services that hold it
We use these services to run DeepRest. Each holds the information described above for us:
- Calendly, LLC, which provides the booking system. Its privacy notice (external site) explains its own practices.
- Google LLC, which provides Nick’s calendar and email, and the Google Meet video calls. See Google’s privacy policy (external site).
- Cloudflare, Inc., which forwards email sent to hello@deepestrest.com. See Cloudflare’s privacy policy (external site).
- GitHub, Inc., which hosts this website and keeps the security logs described above. See GitHub’s privacy statement (external site).
We share your information with anyone else only if the law requires it, or if it is needed to protect you or someone else from serious harm.
Services the booking calendar loads
The booking calendar is Calendly’s own page, shown inside ours. When you load it, Calendly’s page connects your browser to the services below, which Calendly chooses. We list what we saw when we last checked, on 23 October 2026, by loading the calendar and opening its booking form; Calendly can change them. Each collects your IP address and details of your browser, as any connection does, and the information described.
Whatever you answer to Calendly’s cookie banner:
- Calendly, LLC. Provides the booking calendar and the booking form. It collects what you enter in the booking form and, like any website, your IP address, browser, device and operating system, your approximate location, and how you use the booking page. See its privacy policy (external site).
- Cloudflare, Inc.. Protects Calendly’s website from automated traffic. It sets its cookies through Calendly’s own address. It collects a score of how likely your visit is to be automated, and an identifier that tells apart visitors who share an IP address, kept in two cookies on calendly.com. See its privacy policy (external site).
- OneTrust, LLC. Runs the cookie banner Calendly shows inside the calendar. It collects your approximate location, looked up from your IP address so that the banner suits your country, and your answer to the banner, kept in cookies on calendly.com. See its privacy policy (external site).
- Stripe. Fraud prevention. Calendly’s page runs Stripe’s script even though the free sessions involve no payment. It collects information about your device and browser, and about how you use the page, such as mouse movements and time spent. Stripe says it uses this only for fraud detection and security, and never for advertising. See its privacy policy (external site).
- Google LLC. reCAPTCHA, which checks on the booking form that a person, not a program, is booking. Calendly’s page also loads Google’s sign-in script. It collects hardware and software information, such as device and application data. Google says it uses this only to run and improve reCAPTCHA and for security, and not for personalised advertising. See its privacy policy (external site).
- Airbrake. Error monitoring for Calendly’s page, which fetches Airbrake’s settings so that faults in the page can be reported. It collects reports of faults in the page, if any occur. See its privacy policy (external site).
Only if you accept Calendly’s optional cookies. Calendly’s banner says it uses optional cookies “to improve and personalize your experience, to understand website interactions (including clicks, cursor movement and screen recordings), and for marketing”. If you accept them, Calendly’s page also loads:
- Google Analytics and Google Tag Manager (Google LLC): measure how people use Calendly’s website.
- Meta Platforms (the Meta Pixel): Meta’s advertising code, for Calendly’s own marketing.
- Segment (Twilio Inc.): collects how people use Calendly’s page, and passes it on to Calendly’s other tools.
- Braze, Inc.: customer messaging.
- Sprig: surveys and recordings of how people use the page.
- Survicate: surveys.
These are Calendly’s tools, used for Calendly’s own purposes under its privacy notice (external site); DeepRest receives nothing from them. If you decline Calendly’s optional cookies, none of them was loaded when we checked. The cookie notice lists what each service stores on your device.
Transfers outside the UK
Calendly, Google, Cloudflare and GitHub are based in the United States. Each states that it complies with the UK Extension to the EU-U.S. Data Privacy Framework, under which UK law regards personal data sent to certified US organisations as adequately protected.
The other services Calendly’s page loads are Calendly’s choice. Their own privacy policies, linked above, explain where they hold information and how they protect it.
How long we keep it
We keep booking details and emails only for as long as we need them to mentor you and to deal with any questions afterwards, and then delete them. You can ask us to delete your information sooner.
GitHub decides how long it keeps its security logs, as its privacy statement explains.
Your rights
Under UK data protection law you have the right to:
- be informed about how your information is used, which is what this policy is for;
- access your information and receive a copy of it;
- rectification: have inaccurate or incomplete information corrected;
- erasure: have your information deleted;
- restriction: ask us to limit how we use your information;
- data portability: receive information you gave us in a format you can take elsewhere;
- object to our using your information on the basis of our legitimate interests;
- withdraw your consent at any time, where we rely on it.
To use any of these rights, contact us at hello@deepestrest.com. You don’t usually have to pay. We will respond within one month; if your request is complex, the law lets us take up to two further months, and we will tell you if we need to.
Complaints
If you are unhappy with how we have handled your information, please tell us first, so we can try to put it right.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator: make a complaint on the ICO’s website (external site), or call the ICO’s helpline on 0303 123 1113.
Cookies and changes to this policy
The cookie notice explains what is stored on your device and the choices you have.
We will update this policy whenever the way we use personal information changes. It was last updated on 23 October 2026.