Legal

Privacy Policy

How The Impossible Dream collects, uses, and protects your personal data, and what your rights are under UK GDPR.

Last updated: 25 June 2026
Compliant with: UK GDPR & the Data Protection Act 2018

Who We Are

The Impossible Dream Consultancy is the data controller responsible for your personal information. We are a UK AI consultancy specialising in the hospitality sector.

Trading name The Impossible Dream Consultancy
Co-founders Lee Lynch and Alex Hannah

What We Collect and Why

We collect personal data through three routes. The lawful basis and purpose differ for each.

AI Readiness Snapshot (free tool)

Data collected: name, business name, role (optional), email address, 33 scored quiz responses, and up to 11 free-text answers.

Article 6(1)(b) Report delivery, processing your name, business context, and quiz responses is necessary to generate the personalised AI Readiness Snapshot report you requested. Without this data the report cannot be produced.

Article 6(1)(a) Marketing emails, if you tick the separate opt-in checkbox on the Snapshot form, we may send you follow-up emails about our services. This is consent-only. You can withdraw consent at any time by emailing lee@theimpossibledream.co.uk or clicking unsubscribe in any email we send.

Pre-Session Questionnaire (paying clients)

Data collected: full name, email address, role, business name, location, business type, number of sites, staff headcount, weekly covers, approximate annual turnover, responses across nine operational sections, seven free-text pain-point fields, and session goals.

Article 6(1)(b) Contract performance, you have purchased the AI Readiness Review. Processing this data is necessary to deliver the consultation you have contracted and paid for. We cannot provide a meaningful session without it.

Payment (Stripe)

We do not collect or store payment card details. All payment processing is handled directly by Stripe, an independent payment processor. Stripe's own privacy policy governs the data you enter at the payment stage. We receive only a confirmation of successful payment and your email address from Stripe.

Stripe's privacy policy: stripe.com/gb/privacy

AI Processing Disclosure

Your AI Readiness Report is prepared by our consultants using AI assistance. We use Anthropic Claude to help analyse your questionnaire responses and structure our findings.

Your data is not used to train AI models. Anthropic operates under a Data Processing Agreement (DPA) with The Impossible Dream. Under the terms of that DPA, data submitted to Claude through our account is not used by Anthropic to train or improve its models. Anthropic acts as a processor, it processes your data only on our instructions.

We do not input your payment details, passport data, or any special-category personal data into AI tools. Only the business operational information you provide in the questionnaire is processed in this way.

Third-Party Processors

We use the following third-party services to operate our tools. Each acts as a data processor under our instruction and has agreed to appropriate data protection terms.

Processor Purpose Location Safeguard
Formspree Form submission and storage USA Data Processing Agreement + UK-US Data Bridge
EmailJS Automated email delivery USA Data Processing Agreement + UK-US Data Bridge
Stripe Payment processing USA Data Processing Agreement + UK-US Data Bridge
Anthropic (Claude) AI report generation USA Data Processing Agreement

The UK-US Data Bridge (in force since 17 October 2023) permits transfers of personal data from the UK to certified US organisations without requiring additional safeguards under Article 46 UK GDPR.

How Long We Keep Your Data

Snapshot leads (non-converting) 18 months from submission, then permanently deleted
Paying client data 5 years from the end of the engagement, then permanently deleted
Call transcripts Deleted after the AIR report is delivered to you
AIR reports Retained for 5 years as part of the client file

At the end of each retention period, we permanently delete the data from our systems and instruct our processors (Formspree, EmailJS) to do the same. If you would like your data deleted before the retention period expires, please see your rights in Section 6.

Your Rights Under UK GDPR

You have the following rights in relation to your personal data. To exercise any of them, email us at lee@theimpossibledream.co.uk. We will respond within one calendar month.

  • Right of access You can request a copy of the personal data we hold about you. We will provide this within one month of your request, free of charge.
  • Right to rectification If the data we hold about you is inaccurate or incomplete, you have the right to have it corrected.
  • Right to erasure ("right to be forgotten") You can request that we delete your personal data. We will do so unless we have an overriding legal obligation to retain it (for example, financial records required for tax purposes).
  • Right to data portability Where we process your data by automated means and on the basis of contract or consent, you can request a copy in a structured, machine-readable format.
  • Right to object You can object to processing that is based on our legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests.
  • Right to withdraw consent Where processing is based on your consent (such as marketing emails), you can withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing that took place before withdrawal.

Exercise any of these rights by emailing us directly. We will acknowledge your request within 5 working days and respond in full within one calendar month.

Email us

Your Right to Complain

If you believe we have not handled your personal data correctly, please contact us first at lee@theimpossibledream.co.uk so we can try to resolve the matter.

You also have the right to lodge a complaint with the UK's supervisory authority:

Changes to This Policy

We will update this page when our data practices change, for example, when we add a new service, switch to a different processor, or if the law requires us to update our disclosures.

The date at the top of this policy ("Last updated") will always reflect when it was last revised. We will not notify you of minor editorial changes, but we will email active clients if a change materially affects how we process their data.

Current version: 1.0  ·  Last updated: 25 June 2026