PRIVACY POLICY

Catherine Morgan Limited

Trading as The Money Panel

Last Updated: February 2026

The following Privacy Policy governs the online information and data collection practices of Catherine Morgan Limited (“we”, “us”, or “our”), trading as The Money Panel, at https://catherinemorgan.com (the “Site”). This policy outlines the types of information we gather about you while you use the Site, and the ways in which we use this information.

Please read this Privacy Policy carefully. By visiting and using the Site, you agree that your use of the Site, and any dispute over privacy, is governed by this Privacy Policy. We may need to change this Privacy Policy from time to time, in which case we will post the changes on this page and update the Last Updated date. We will endeavour to notify you with 30 days’ notice of any changes. By continuing to use the Site after we post changes, you accept the Privacy Policy as modified.

We will never sell, barter, or rent your email address to any unauthorised third party.

1. About Catherine Morgan Limited

Catherine Morgan Limited is a company registered in Jersey, Channel Islands, trading as The Money Panel.

Company Name: Catherine Morgan Limited
Trading Name: The Money Panel
Registered Office: 1-3 Colomberie, St Helier, Jersey, JE2 4QB
Company Registration Number: 137407
Jurisdiction: Jersey, Channel Islands

1A. Our Company Structure

Catherine Morgan Limited operates through a dual company structure for operational and payment processing purposes. It is important that you understand how this structure works in relation to your personal data.

Service Delivery and Data Controller: Catherine Morgan Limited (registered in Jersey, Channel Islands, company number 137407), trading as The Money Panel, is the data controller for all personal data collected through this Site and in connection with all services we provide. All client contracts, service delivery, and operations are managed by Catherine Morgan Limited from Jersey.

Payment Processing: For payment processing convenience, payments are collected through our UK entity, The Money Panel Ltd (registered in England and Wales, company number 10267198, registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ). The Money Panel Ltd acts solely as a payment collection agent on behalf of Catherine Morgan Limited and processes only the limited personal data necessary to facilitate payment transactions.

What this means for your data: Catherine Morgan Limited (Jersey) is the sole data controller for all your personal data. The Money Panel Ltd (UK) processes only payment-related data (such as your name, email address, and payment card details) strictly for the purpose of collecting and transferring payments to Catherine Morgan Limited. The Money Panel Ltd does not use your personal data for any other purpose.

2. How We Collect And Use Information

We may process Personal Data when you request information from us through a contact form or our Website, when you sign up to receive our emails or other communications, when you engage us to provide you with services, or when we otherwise communicate with you via email, telephone, text, post or through our Website or other communication methods. We may also process Personal Data that you share via third parties such as Companies House, Meta, Google, Pinterest, Stripe, Calendly or YouTube or other similar analytic, advertising or information service providers or payment service providers.

We may also process Personal Data through the use of cookies or other tracking software on our Website. Please see our separate cookie policy for further details.

We also collect and store information that is generated automatically as you navigate through the Site. For example, we may collect information about your computer’s connection to the Internet, which allows us to improve the delivery of web pages and measure traffic on the Site. We may also use cookies to enhance your experience with the Site. Cookies are small files that your web browser places on your hard drive for record-keeping purposes.

The information you provide directly on the Site (e.g., comments on blog posts, membership subscriptions) is never shared or added to unauthorised mailing lists. You may request to have your details removed from our website at any time by emailing us.

3. Types of Personal Data We Process

The types of Personal Data we process will vary depending on your circumstances and our relationship with you, but typically may include:

3.1 Personal and Contact Information

Name, date of birth
Email address, phone number
Business contact details, correspondence address
IP address and any messages or communications

3.2 Customer or Client Information

Purchase and billing information
Delivery address
Payment details (processed securely by third-party payment processors via The Money Panel Ltd)

3.3 Website User Information

Comments or posts you make
Images or videos you share
Browser information, page views, pages visited, number of visits

3.4 Money StoryTypes® Assessment Information

When you complete the Money StoryTypes® assessment through our services, the following data is processed:

Name and email address
Quiz responses about your relationship with money
Generated Money StoryType® profile

Data Controller: Catherine Morgan Limited (Jersey)

Data Processor: SMA Digital Ltd (7 Bell Yard, London, WC2A 2IR, UK)

Storage: ActiveCampaign (US-based CRM)

Purpose: Generate personalised money mindset assessment report

Retention Period: 7 years after report delivery

4. Data Sharing Between Our Entities

As explained in Section 1A, your personal data may be shared between Catherine Morgan Limited (Jersey) and The Money Panel Ltd (UK) strictly for the following purposes:

Payment processing: When you make a payment for any of our services, your payment information (including name, email address, and payment card details) is processed by The Money Panel Ltd (UK) through Stripe or other payment processors. This data is shared with The Money Panel Ltd solely to facilitate payment collection on behalf of Catherine Morgan Limited.
Refund processing: Where a refund is due, it will be processed through The Money Panel Ltd (UK) as the entity through which the original payment was collected.

Legal basis for data sharing: The sharing of data between Catherine Morgan Limited and The Money Panel Ltd is necessary for the performance of our contract with you (to deliver services and collect payment) and is carried out under a formal Agency Agreement between the two entities. The Money Panel Ltd is bound by the terms of that agreement to process your data only for payment-related purposes and in accordance with applicable data protection law.

Data transferred between Jersey and the UK benefits from the adequacy arrangements in place between the two jurisdictions. Jersey has been recognised by the European Commission as providing an adequate level of data protection, and the UK maintains equivalent standards under UK GDPR.

5. Third-Party Data Processors

We share your Personal Data with the following third parties who process data on our behalf:

5.1 Payment and Commerce

The Money Panel Ltd (UK) – Payment collection agent (see Section 4)
Stripe – Payment processing
PayPal – Payment processing
Thrivecart – Shopping cart and checkout

5.2 Email, Marketing and CRM

ActiveCampaign (US) – Email marketing and CRM
SendGrid – Email delivery

5.3 Platforms and Tools

Circle – Community and course platform
Zoom – Video conferencing
Google Drive – Document storage
Memberpress – Membership management
Typeform – Forms and surveys
Slack – Internal team communications
Airtable – Database and project management

5.4 Technical Services

SMA Digital Ltd (UK) – Technical processing for Money StoryTypes®

5.5 Artificial Intelligence Tools

We use artificial intelligence (AI) tools to assist with business operations, content creation, programme development, and administrative tasks. The following AI platforms may process limited personal data in the course of our business operations:

OpenAI (ChatGPT) – AI-assisted content creation and business operations (US-based)
Anthropic (Claude) – AI-assisted content creation and business operations (US-based)

We take the following precautions when using AI tools: (a) we minimise the personal data entered into AI platforms wherever possible; (b) we anonymise or pseudonymise client data before inputting it into AI tools unless the processing of identifiable data is necessary and lawful; (c) we review the data processing and retention policies of each AI provider; and (d) we do not rely on AI tools to make automated decisions about individuals that produce legal or similarly significant effects.

General provision regarding emerging technology: We may from time to time use additional AI tools, machine learning platforms, or other emerging technology services to assist with our business operations. Where any such tool processes personal data on our behalf, we will ensure that appropriate data processing agreements are in place, that the tool meets our data protection standards, and that this Privacy Policy is updated accordingly. We will endeavour to notify you of any material changes to our use of AI tools through updates to this Privacy Policy.

When we engage with these third parties, we ensure that we have contracts in place to protect your Personal Data. If you have any queries concerning how these third parties process your Personal Data, we recommend that you review their individual privacy notices on their respective websites.

6. International Data Transfers

Some of our third-party service providers are based outside Jersey, the United Kingdom, or the European Economic Area (EEA). Where we transfer your Personal Data internationally, we ensure that one of the following conditions applies:

The European Commission or relevant authority has approved the transfer of data to the country where the third-party provider is based (an “adequacy decision”);
An adequate level of protection comparable with the protection provided in Jersey, the UK, or the EEA is in place, including through Standard Contractual Clauses (SCCs) or other approved transfer mechanisms;
The transfer is necessary for the performance of a contract between us;
You have given your express consent.

Jersey–UK Transfers

Data is transferred between Catherine Morgan Limited (Jersey) and The Money Panel Ltd (UK) for payment processing purposes. Jersey has been recognised by the European Commission as providing an adequate level of data protection. The UK also benefits from an adequacy decision. Accordingly, transfers between Jersey and the UK do not require additional safeguards.

Transfers to the United States

Data is transferred to the following US-based service providers under appropriate safeguards including Standard Contractual Clauses (SCCs) and GDPR-compliant data processing agreements with appropriate technical and organisational security measures: ActiveCampaign, OpenAI, Anthropic, Google (including Gemini), Zoom, Slack, Calendly, Meta, Circle, Kajabi, Loom, Riverside, Zapier, Stripe, Thrivecart, and Dropbox Sign (HelloSign).

Transfers to Other Countries

Data may also be transferred to Canva (Australia), Xero (New Zealand), and Typeform (Spain, with data processing that may involve US infrastructure). These transfers are made under appropriate safeguards including Standard Contractual Clauses where required.

Where the above standards do not apply, we shall only transfer your Personal Data where you have given your express consent or the transfer is legally required.

7. Data Security

We take the protection of your Personal Data seriously and have implemented suitable and reasonable measures to protect the Personal Data we hold from misuse, loss, unauthorised access, and any modification or disclosure.

Security measures include:

Bank-grade 256-bit SSL encryption across all forms and quizzes
Bcrypt password hashing with unique salts
Automatic daily backups
Intelligent IP blocking and malware prevention
Web Application Firewall (WAF) protection
Limited access to Personal Data on a need-to-know basis
Internal policies restricting the input of identifiable personal data into AI tools

We limit access to your Personal Data to only those employees, agents, contractors, or third parties that have a business need to access it. They will only process your Personal Data on our instructions and must agree to keep it safe and confidential.

Yes, you should. There are several reasons, and the level of disclosure depends on how you’re using AI. Let me break this down practically for your business.

What the law requires:

Under the GDPR (and the Jersey Data Protection Law, which mirrors it), you have a general transparency obligation — you must tell people what you do with their personal data, who it’s shared with, and why. If you’re inputting any client data, client communications, or information about clients into AI tools like ChatGPT, Claude, or Gemini, that constitutes sharing personal data with a third-party processor, and it needs to be disclosed.

Article 22 of the GDPR also requires specific disclosure if you use AI to make automated decisions that have legal or similarly significant effects on individuals. That’s unlikely to apply to your coaching business (you’re not using AI to approve or reject clients algorithmically), but the general transparency obligation still applies.

The EU AI Act, which is progressively coming into force through to August 2026, also introduces transparency obligations — particularly that individuals should be informed when they’re interacting with an AI system or when AI-generated content is being used.

What this means for your specific use:

The key question is whether any client personal data goes into these AI tools. For your business, the likely scenarios are:

Using AI to draft client emails or communications (client names/details go in), using AI to analyse client situations or prepare coaching notes, using AI to generate content that references client scenarios, or using AI tools like Zapier automations that process client data through AI steps.

If any of those apply, your privacy policy needs to cover it.

Use of Artificial Intelligence Tools

We may use artificial intelligence (AI) tools, including but not limited to OpenAI (ChatGPT), Anthropic (Claude), and Google (Gemini), to assist with business operations such as content creation, communications drafting, programme development, and administrative tasks.

Where AI tools are used in connection with our Services, we take the following steps to protect your data:

We minimise the personal data shared with AI tools and anonymise or pseudonymise client information wherever practicable. We do not use AI tools to make automated decisions about you that produce legal or similarly significant effects. Where your personal data is processed by AI tools, this is done under our instruction and subject to the data processing agreements we hold with those providers. AI-generated content is reviewed by a qualified human before being shared with you or used in your coaching programme.

Data shared with AI tools may be transferred to the United States. Please refer to the International Transfers section of this policy for details of the safeguards in place.

We do not use your personal data to train AI models. Our agreements with AI providers restrict the use of input data for model training purposes.

8. Data Retention

We retain your Personal Data for different periods depending on the type of data and the purpose for which it was collected:

Completed purchases: 21 months (for tax and reporting purposes)
Pending orders: 6 months
Failed orders: 60 days
Cancelled orders: 30 days
Money StoryTypes® assessment data: 7 years after report delivery
Email subscribers: Until you unsubscribe
Website backups: Until the next backup is created
Data processed by AI tools: Not retained beyond the session unless the AI provider’s terms specify otherwise (see individual provider policies)
9. Your Rights Under Data Protection Law

Under Jersey data protection law (the Data Protection (Jersey) Law 2018, which mirrors GDPR principles), you have the following rights:

Right to be informed about how your personal data is used
Right of access to your personal data
Right to rectification if your personal data is inaccurate or incomplete
Right to erasure (also known as the “right to be forgotten”)
Right to restrict processing of your personal data
Right to data portability
Right to object to processing of your personal data
Rights relating to automated decision-making and profiling

If you wish to exercise any of these rights, please contact us at support@catherinemorgan.com. We will respond to all legitimate requests within one month.

Additional Rights for Specific Jurisdictions

UK Residents: You have equivalent rights under the UK GDPR and the Data Protection Act 2018. You may also lodge a complaint with the UK Information Commissioner’s Office (ICO).

EU/EEA Residents: You have rights under the EU General Data Protection Regulation (GDPR). You may lodge a complaint with your local supervisory authority.

California Residents (USA): Under the California Consumer Privacy Act (CCPA), you have the right to know what personal information we collect, to request deletion, and to opt out of the sale of your personal information. We do not sell your personal information. To exercise your CCPA rights, please contact us at support@catherinemorgan.com.

Australian Residents: Your personal information is handled in accordance with the Australian Privacy Principles (APPs) under the Privacy Act 1988 (Cth). You may lodge a complaint with the Office of the Australian Information Commissioner (OAIC).

Canadian Residents: Your personal information is handled in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA). You may lodge a complaint with the Office of the Privacy Commissioner of Canada.

10. Legal Basis for Processing

We process your Personal Data under the following legal bases:

Contract performance: For paid services, memberships, and purchases
Legitimate interests: For marketing communications and business operations
Consent: For cookies, newsletters, and optional communications
Legal obligation: For tax and regulatory compliance

11. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on our Site. Cookies are small text files that your web browser places on your device. By showing how and when visitors use the Site, cookies help us deliver content, identify unique users, and track user trends and patterns.

For detailed information about the cookies we use and how to manage your cookie preferences, please see our Cookie Policy available on our website.

12. Affiliate Links and Non-Disclosure

Some links on this Site may be affiliate links. These are links to products or services that we highly recommend and are affiliates for. Should you click on one of these links and decide to purchase the service(s) or product(s), we will receive a small commission of the sale at no extra cost to you.

We only recommend products and services that we believe will provide value to our audience. Our affiliate relationships do not influence our editorial content or recommendations.

When you click on an affiliate link, we may receive information about that click (such as the date and time), but we do not receive any of your personal information unless you complete a purchase, in which case the third-party merchant may share information with us in accordance with their own privacy policy.

13. Links to Third-Party Websites

The Site may include links to websites we recommend or work with, and provide access to products and services offered by third parties, whose privacy policies we do not control.

When you access another website or purchase third-party products or services through our Site, use of any information you provide is governed by the privacy policy of that website or service provider. We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party websites or services. You further acknowledge and agree that Catherine Morgan Limited shall not be responsible or liable, directly or indirectly, for any damage or loss caused or alleged to be caused by or in connection with use of or reliance on any such content, goods, or services available on or through any such websites or services.

14. Member and Subscriber Information

Your information as a subscriber is stored in our email management database (ActiveCampaign). Your information can only be accessed by those who help manage our email lists to deliver newsletters and updates. We ensure that all team members and Virtual Assistants are GDPR-knowledgeable and compliant.

All emails sent to you include an unsubscribe link. You can remove yourself at any time from our mailing list by clicking the unsubscribe link in any communication.

If you are a member of any of our paid or unpaid membership programmes, opting out may result in cancellation of your membership. For this reason, if you are a member, we may email you once to verify that you intend to cancel your membership before we close your account.

Information about you as a member is stored on our database to ensure you have full access to all areas of the Site and Membership. The storage of your data is necessary under the legal basis of “contract” to provide the service agreed between us.

15. Security Breach Notification

In the unlikely event of a security breach, we are committed to responding promptly and transparently:

We will notify the Jersey Office of the Information Commissioner (JOIC) within 72 hours of becoming aware of any breach
Where the breach involves data of UK residents, we will also notify the UK Information Commissioner’s Office (ICO) within 72 hours
We will notify affected individuals as soon as reasonably possible, ensuring no further compromise of data
We will take immediate steps to contain the breach and prevent further unauthorised access
16. Right to Lodge a Complaint

You have the right to lodge a complaint with the relevant supervisory authority if you believe we have not handled your Personal Data in accordance with data protection law:

Jersey Office of the Information Commissioner (JOIC)

Website: https://jerseyoic.org/
Address: 2nd Floor, 5 Castle Street, St Helier, Jersey, JE2 3BT
Telephone: +44 (0)1534 716530

UK Information Commissioner’s Office (ICO)

Website: https://ico.org.uk/
Telephone: 0303 123 111
17. Changes to Business Structure

As our business grows, we may buy or sell various assets. In the event that we sell some or all of our assets, or our website is acquired by another company, information about our users may be among the transferred assets. We will always ensure that any such transfer complies with data protection law.

18. Children’s Privacy

Our services are not directed to individuals under the age of 18. We do not knowingly collect Personal Data from children. If you believe that we have inadvertently collected information from a child, please contact us immediately so we can delete it.

19. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us:

Email: support@catherinemorgan.com
Website: https://catherinemorgan.com
Company Name: Catherine Morgan Limited
Trading Name: The Money Panel
Registered Office: 1-3 Colomberie, St Helier, Jersey, JE2 4QB
Company Registration Number: 137407

20. Governing Law

This Privacy Policy and any dispute or claim arising out of or in connection with it (including non-contractual disputes or claims) shall be governed by and construed in accordance with the laws of Jersey, Channel Islands. The Royal Court of Jersey shall have exclusive jurisdiction to settle any dispute or claim.