Dr Elena Carruba · Change Academy
Privacy policy
Last updated: 4 November 2026
1. Introduction
Welcome to Change Academy, founded by Dr Elena Carruba. Your privacy, trust and confidence are important to us. We are committed to handling your personal information responsibly, transparently and securely.
This privacy policy explains how we collect, use, store and protect your personal data when you visit our website, contact us, book consultations, purchase services, subscribe to memberships or engage with our educational and intellectual content. It applies to the following interconnected areas of our work:
Change Academy: strategic consultancy, transformative leadership, artificial intelligence, executive mentoring, coaching, organisational development and professional education.
Euno, Praxis & Nexus: books, publications, research, intellectual content, educational resources and speaking engagements.
Hey Girl: women's leadership, empowerment, personal development, community activities and the Hey Girl Insider digital membership.
We process personal data in accordance with UK data protection law, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Data (Use and Access) Act 2025 and the Privacy and Electronic Communications Regulations (PECR).
2. Who is responsible for your data
The data controller is Dr Elena Carruba, trading as Change Academy, based in the United Kingdom. Website: https://elena-carruba.vercel.app. Privacy contact: drelenacarruba@changeacademy.net.
Change Academy and its associated platforms operate under the professional direction of Dr Elena Carruba. For questions about this policy or the use of your personal information, please email us.
3. What personal information we collect
Depending on how you use the website and our services, we collect:
A. Contact and enquiry information
Your name and email address.
Your organisation, role and preferred timescale, if you choose to give them on the enquiry or booking form.
The type of engagement or topic you choose, and the message you write.
A telephone number or other details only where you provide them yourself, for example in a message or email.
B. Consultation and professional service information
When you book or receive consultancy, coaching or mentoring, we collect:
The appointment time you choose and your booking details.
Information about your goals, challenges and professional interests.
Details needed to prepare proposals or deliver agreed services.
Relevant correspondence, feedback and service records.
Please avoid submitting sensitive personal information, such as medical details, unless it is genuinely necessary and we have explained how it will be handled.
C. Newsletter and course waitlists
Your email address and the date you signed up, so we can send you new essays and news. If you join a course waitlist, your email and the course you are waiting for, so we can tell you when it opens.
D. Letters to Elena (Ask Elena)
The topic, your letter, an optional name to sign it with, an optional email address, and whether you allow an anonymised version to be published. We use it to read and, only if you said yes, answer your letter in Hey Girl without identifying you. Your email address is never published.
E. Membership and subscription information
When you subscribe to Hey Girl Insider or another paid service: your email address, sign-in details, your subscription status and renewal date, your transaction history and a customer reference from Stripe.
F. Payment information
All payments and card registrations are handled by Stripe on Stripe's own secure pages. We receive transaction details, payment status and limited card information, such as the card brand and last four digits. Full card numbers never reach our website or our database.
G. Technical and website usage information
Spam protection: when you send a form, a scrambled (one-way hashed) version of your internet (IP) address is kept for 24 hours to stop repeated automated submissions. We never store the address itself.
Visit statistics: Vercel Web Analytics counts page visits without cookies and without identifying you.
Hosting logs: our hosting provider processes standard technical data (such as IP address and browser type) to deliver and secure the website.
Your light or dark display choice, stored only in your own browser (see our cookie policy).
4. How we use your information
We process personal information only where we have a valid legal basis.
| Purpose | Legal basis |
|---|---|
| Responding to enquiries and consultation requests | Legitimate interests, or steps before entering a contract |
| Booking and delivering consultancy, mentoring and coaching | Contract, or steps before entering a contract |
| Managing digital memberships and purchases | Contract |
| Processing payments, subscriptions and refunds | Contract and legal obligations |
| Maintaining financial and tax records | Legal obligation |
| Protecting the website and preventing misuse | Legitimate interests |
| Sending the newsletter and course-opening emails | Consent |
| Reading, answering and (if you agree) publishing Ask Elena letters | Consent, which you can withdraw before publication |
| Publishing identifiable testimonials or client stories | Consent, asked for in advance |
| Measuring and improving website performance (cookieless, anonymous statistics) | Legitimate interests |
Where we rely on legitimate interests, these include operating our business efficiently, responding to genuine enquiries, maintaining security and improving our services, while respecting your rights.
Information needed to process a booking or deliver a purchased service is necessary for that service. Other information is optional.
5. Free 20-minute discovery consultations
Change Academy offers complimentary 20-minute introductory consultations. When you book, we collect your name, email address, the time you choose, your organisation and role (optional), the topic and a brief description of your enquiry.
Card registration
To secure a free consultation, a valid payment card is registered securely through Stripe.
The introductory consultation itself is free.
Card details are entered on Stripe's secure page, not on our website.
No charge is made for the consultation, and there is no no-show or cancellation fee.
Registering a card does not enrol you in a paid consultancy programme or membership.
Booking information is used to arrange and administer the appointment and to communicate with you about it. We do not add consultation clients to the newsletter simply because they have booked a session.
6. Paid consultancy, mentoring and advisory services
When you purchase or enquire about Change Academy services, we process relevant personal information to:
Understand your professional or organisational requirements.
Prepare proposals and agreements.
Schedule and deliver consultancy or mentoring.
Manage invoices, subscriptions and payments.
Communicate about progress, agreed deliverables and follow-up activities.
Professional information and confidential materials shared during consultancy are treated with appropriate confidentiality and security measures. Where organisational clients provide information relating to employees or third parties, the data protection responsibilities will be set out in the service agreement.
7. Hey Girl Insider membership
Hey Girl Insider is a digital membership at £6.99 per month, which opens once the member content is ready. When you join, we process your information to set up and administer your membership, give you access to paid content, take recurring payments and offer membership support.
We will not publicly identify members or publish identifiable private submissions without an appropriate lawful basis and your permission.
Members can manage or cancel their subscription from their account page (through Stripe's secure customer portal) or by emailing us. Cancelling a subscription does not require us to delete financial records that must be kept by law.
8. Publications and intellectual content
Through Euno, Praxis & Nexus and the wider site, we collect information when you:
Subscribe to the newsletter.
Enquire about speaking engagements, collaborations, books or educational resources.
Join a course waitlist.
Send professional feedback or testimonials.
Books bought through external retailers, such as Amazon, are subject to those retailers' privacy policies. Where we publish personal testimonials, photographs or identifiable client experiences, we will ask your permission first.
9. Marketing and communications
If you sign up, you may receive emails about new essays, books, research and publications, consultancy programmes and educational services, upcoming workshops, talks and events, and Hey Girl articles and membership news.
We send newsletters only to people who have signed up. You can unsubscribe at any time using the link in every email or by contacting us. Unsubscribing does not stop essential emails about bookings, purchases, account security or active services.
We never sell personal information, and we do not share it with advertisers.
10. Cookies and website analytics
The website uses only what it needs to work: a sign-in cookie when a member or the site's editor signs in, and your light or dark display choice stored in your own browser. Our visit statistics (Vercel Web Analytics) use no cookies and do not identify you. There are no advertising or tracking cookies. Our cookie policy lists every technology in use, its purpose, provider and duration.
11. Who we share personal information with
We share limited personal information with trusted service providers only when necessary to run the website and our services. They process it on our instructions:
Supabase: our database, sign-in and file storage, hosted in London.
Vercel: hosts the website and provides our cookieless Vercel Web Analytics; requests may be processed outside the UK under approved safeguards.
Stripe: payments, card registration for free consultations, and subscriptions.
Resend: delivers our emails, including booking confirmations and the newsletter; may process data in the United States under approved safeguards.
YouTube (Google): only when you press play on a YouTube video. Our video pages show preview images served by YouTube's image servers, which receive your IP address as any website would; the player itself, and any YouTube cookies, load only after you press play.
Professional advisers: accountants, legal advisers and other authorised professional service providers, where needed.
Bookings are managed on our own website and database; we do not use a separate booking or calendar service. Providers are subject to appropriate confidentiality, security and data protection requirements. We may also disclose information where the law requires it, including to regulatory authorities. We do not allow website developers or contractors to use client information for their own purposes.
12. International data transfers
Change Academy serves individuals and organisations internationally, and some of our technology providers (such as Vercel, Stripe and Resend) may process information outside the United Kingdom. Where personal data is transferred internationally, we rely on an appropriate lawful transfer mechanism, such as UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.
13. Data security
We take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure. These include:
Restricted access to personal information.
Secure payment processing through Stripe.
Account authentication and access controls.
Confidentiality obligations for authorised personnel.
Appropriate protection of electronic records.
Review of information-security risks and suspected incidents.
No online system can guarantee absolute security, so please protect your own account and email access.
14. How long we keep information
We keep personal information only as long as reasonably necessary for its original purpose or to meet legal obligations.
| Information | Retention |
|---|---|
| General enquiries without an ongoing relationship | Up to 12 months after the last substantive contact |
| Discovery consultation records | Normally up to 12 months after the appointment |
| Ask Elena letters | Up to 2 years after we receive them; a published, anonymised answer may stay online |
| Membership account information | While the account is active, then up to 12 months after closure where necessary |
| Consultancy and mentoring records | Normally up to 6 years after the engagement, where justified by contractual or legal requirements |
| Financial and tax records | For the statutory period, including UK self-employment record-keeping requirements |
| Newsletter subscriptions | Until you unsubscribe, subject to a minimal suppression record |
| Course waitlists | Until you unsubscribe, or 12 months after the course opens |
| Spam-protection records (hashed IP) | 24 hours |
| Website analytics | Anonymous, aggregate figures only, kept by Vercel for its standard reporting period |
Information may be kept longer where necessary for legal claims, regulatory obligations or resolving disputes. Information that is no longer needed is securely deleted or anonymised.
15. Your data protection rights
Subject to the law, you have the right to:
Access: request a copy of your personal information.
Rectification: ask us to correct inaccurate or incomplete information.
Erasure: request deletion where the law provides this right.
Restriction: request limits on certain processing.
Objection: object to processing based on certain lawful grounds, including direct marketing.
Data portability: request certain information in a reusable format.
Withdraw consent: where consent is the legal basis for processing.
Automated decision-making protections: rights concerning qualifying automated decisions.
To exercise these rights, email drelenacarruba@changeacademy.net. We may ask for reasonable proof of identity before releasing information, and we will reply within one month, or within the longer period the law allows for complex requests.
16. Artificial intelligence and personal data
Artificial intelligence is an important subject within Change Academy's research, consultancy and educational work. Where AI-assisted technologies are used to process personal information, we assess the purpose, legal basis, security requirements and provider arrangements. Confidential client information is not submitted to public AI tools without appropriate safeguards and a lawful basis.
We do not make solely automated decisions that produce legal or similarly significant effects on individuals. Any future introduction of such processing would require additional assessment and updated privacy information.
17. Children's privacy
Our consultancy services and paid memberships are intended for adults aged 18 and over, and the website is not intended for anyone under 16. We do not knowingly collect personal information from children. If you believe a child has provided personal information, please contact us.
18. Third-party websites and external links
Our website links to external websites, including bookshops, YouTube, social networks and Stripe's payment pages. These operate under their own privacy policies, which we encourage you to read before sharing personal information with them.
19. Privacy complaints
If you have concerns about how your personal information has been handled, please email drelenacarruba@changeacademy.net, describing your concern and any relevant details. We will acknowledge a data protection complaint within 30 days, investigate it appropriately, keep you informed and tell you the outcome without undue delay.
You also have the right to complain to the UK Information Commissioner's Office (ICO): ico.org.uk, telephone 0303 123 1113.
20. Changes to this privacy policy
We may update this policy to reflect changes in our services, website technology, the law or our data protection practices. The latest version is always published here with its revision date. Where material changes affect how we use personal information, we will tell you where required, for example by emailing newsletter subscribers and members.
21. Contact us
Dr Elena Carruba, founder, Change Academy · Euno, Praxis & Nexus · Hey Girl. Email: drelenacarruba@changeacademy.net. Website: https://elena-carruba.vercel.app.