Legal

Company details

Lightning Oak Limited

Registered in England and Wales, company number 14222576, incorporated on 8 July 2022. Registered office: 66 Paul Street, London, EC2A 4NA.

Names and logos of organisations on this site belong to their owners. They show where James has worked, served or been published, and do not imply endorsement.

Contact

Email james@lightning-oak.co.uk. Telephone +44 7453 360 077.

Professional indemnity insurance

Hiscox Insurance Company Limited, 22 Bishopsgate, London, EC2N 4BQ. The cover applies worldwide, except claims brought in the United States of America or Canada.

Professional bodies

James Walker is a Fellow of the Association of Chartered Certified Accountants (FCCA). He is a Chartered Internal Auditor (CMIIA, Chartered Member of the Institute of Internal Auditors) and a Certified Internal Auditor of The Institute of Internal Auditors (CIA). He is also a Chartered Member of the Chartered Institute for Securities and Investment (Chartered MCSI) and a Full Member of the Association of Business Mentors (MABM).

Data protection

Registered with the Information Commission, still known as the ICO, registration number ZC127643.

Privacy notice

Last updated 16 October 2026.

Who we are

Lightning Oak Limited is the practice through which James Walker works. We are registered in England and Wales, company number 14222576. Our registered office is 66 Paul Street, London, EC2A 4NA.

We are the data controller for the information described in this notice. That means we decide why your information is held and how it is used.

If you have a question about this notice, or about how we handle your information, contact James Walker at james@lightning-oak.co.uk.

What this notice covers

This notice covers your visit to this website, and what happens when you contact us by email, by telephone or through the contact form. It also covers what happens after that, if we go on to work together.

It does not cover personal information we handle inside a client engagement. Who decides how that information is used depends on the engagement. Where we follow the client’s instructions we act for them. Where our own professional duties, working papers and records are concerned, we decide. Either way it is set out in the engagement documents, not here.

The information we collect

When you visit the website. Our hosting provider records technical information automatically. This includes your internet protocol address, the type of browser and device you are using, the pages you looked at and the date and time. This is standard for any website and is used to keep the site running and safe.

If you accept analytics cookies. Google Analytics and Microsoft Clarity record how the site is used: which pages are read, how people arrived, and how visitors move around a page, including clicks and scrolling. Clarity keeps this as a replay of the visit, with what you type into forms hidden. Neither runs unless you accept.

When you contact us. If you email or telephone us, or use the contact form, we hold your name and your contact details. We also hold the organisation you are from, and whatever you choose to tell us. On the contact form that includes the boxes you tick to show what your enquiry is about, such as a service, speaking or introducing a client, and, if you answer it, how you heard about James.

If we work together. We hold the records needed to run the engagement and to meet our legal and professional obligations. That includes correspondence, notes, invoices and payment details.

Cookies. The website uses cookies. Some are needed to make the site work. Analytics cookies from Google and Microsoft are only used if you agree. The Calendly booking calendar on the Contact page sets its own cookies when it opens, which happens only if you accept it or choose “See available times”. There is a separate cookie notice with the detail.

We do not collect sensitive information about you through this website, such as health information or details of your race, religion or political opinions. Please do not send that kind of information by email or through the contact form unless we have agreed a secure way to do it.

This website is not aimed at children and we do not knowingly collect information about anyone under 18.

Do you have to give us your information? No. There is no legal requirement to contact us. But if you want a reply, we need enough to reply with, which in practice means a name and an email address or telephone number. If we go on to work together, we will need enough information to run the engagement and to meet our legal and professional obligations. Without it we cannot take the work on.

If your details reach us from somewhere else. Work often comes by referral, and we sometimes look up publicly available information before a meeting. In that case we may hold your name, your role, your organisation and your contact details. We will have got them from the person who introduced us, from your organisation, or from a public source such as Companies House or LinkedIn.

If we go on to contact you, we will tell you where we got your details at the latest in our first message. The rest of this notice applies in the same way.

Why we use your information

The law requires us to have a reason for using your information. Ours are set out below.

• Replying to an enquiry, by email, telephone or the contact form. Your name, contact details, the boxes you ticked, how you heard about James if you said, and what you told us. Lawful basis: legitimate interests. Someone who contacts a business expects a reply, and knowing how people heard about James shows which introductions bring work.
• Booking a call, through the calendar on the Contact page. Your name, email address, the time you choose and anything you add. Lawful basis: legitimate interests. Someone who books a call expects it to go ahead at the time they chose.
• Discussing and agreeing a piece of work. Your contact details and our notes of the discussion. Lawful basis: taking steps at your request before entering a contract.
• Carrying out the work. Engagement records and correspondence. Lawful basis: performance of our contract with you or your organisation.
• Sending and chasing invoices. Your contact and payment details. Lawful basis: performance of our contract, and our legitimate interest in being paid.
• Keeping accounting and tax records. Invoices and payment records. Lawful basis: legal obligation.
• Keeping the website working and secure. Technical information from server logs. Lawful basis: legitimate interests. We need the site to stay available and free of abuse.
• Understanding how the website is used. Analytics cookie information from Google Analytics and Microsoft Clarity. Lawful basis: consent, which you can withdraw at any time through Cookie settings at the bottom of every page.
• Defending or bringing a legal claim. The records relevant to that claim. Lawful basis: legitimate interests, and where required, a legal obligation.

Where we rely on legitimate interests, we have weighed our reason against your rights. It is fair: the information is limited, you would expect it to be used this way, and we do not use it for anything you would find surprising.

You can ask us for that assessment in writing at any time.

How long we keep it

• Enquiries and bookings that do not lead to work, including everything sent through the contact form or the booking calendar: 12 months from our last contact, then deleted.
• Client and engagement records: 6 years after the engagement ends, or longer where a claim could still be brought or an insurer requires it.
• Accounting and tax records: 6 years from the end of the accounting period they relate to.
• Website server logs: for the period set by our hosting provider.
• Analytics information: 14 months in Google Analytics. Microsoft sets the periods for Clarity.
• Your cookie choice: 6 months, then we ask again. You can change it at any time.

The six-year periods reflect the time limit for bringing most legal claims in England and Wales, and the period tax law requires records to be kept. Company law sets a shorter minimum for accounting records, so we keep to the longer period.

Who we share it with

We share your information only with the suppliers and advisors who help us run the practice, and only where they need it to do their job:

• Our website host. The site is built and hosted on Webflow, which stores the site and its server logs, and receives messages sent through the contact form.
• Our email and telephone providers. They carry the messages and calls.
• Our accountant and bookkeeper. For invoicing, accounts and tax.
• Our professional advisors. Lawyers and insurers, where a matter requires it.
• Google and Microsoft, which provide our analytics. Only where you have accepted analytics cookies. Both also use this information for their own purposes, under their own privacy policies.
• Calendly, which runs our booking calendar. If you book a call it receives your name, email address and anything you add.
• Video calls are hosted by Zoom or Microsoft Teams.
• Spam protection. The contact form uses Cloudflare Turnstile to check that it is being sent by a person.
• Regulators, His Majesty’s Revenue and Customs, the courts and law enforcement. Where the law requires it, or where we have a professional duty to report.

Where someone handles information on our behalf, such as our website host and our email provider, they are bound by a contract. They act on our instructions and may not use it for their own purposes.

The others act in their own right, under their own legal and professional duties. That covers Google and Microsoft for their own uses of analytics information, our accountant, our lawyers and insurers, and any regulator, court or authority.

We never sell your information and we never share it for advertising.

Where your information is held

Some of our suppliers are based outside the United Kingdom, mainly in the United States. Webflow, which hosts this site, is a United States company, and so are Google and Microsoft, which provide our analytics.

When information leaves the UK it stays protected to the standard UK law requires. Webflow holds two safeguards at once:

• It is certified under the UK Extension to the EU-US Data Privacy Framework.
• Its data processing agreement also includes the standard contractual clauses and the UK International Data Transfer Agreement.

Calendly, which runs our booking calendar, is also a United States company. It is certified under the UK Extension to the EU-US Data Privacy Framework. Zoom, which hosts some of our video calls, is also a United States company.

You can ask us which safeguard applies to any other supplier, and ask for a copy of it. Write to James Walker at james@lightning-oak.co.uk and we will send it.

Cookies

The website uses cookies. Cookies the site needs to work are set when you arrive. Analytics cookies from Google and Microsoft are set only if you accept them, and you can change your mind at any time through Cookie settings at the bottom of every page. The cookies Calendly sets for the booking calendar on the Contact page are set only when the calendar opens: if you accept it in the cookie panel, or when you choose “See available times”.

Our cookie notice explains each category, and how to change your mind.

Your rights

You have the following rights over the information we hold about you.

There is usually no charge, and we will reply within one month. If your request is complicated, or you have made several, we may need up to two months more. We will tell you why within the first month.

If we need to confirm who you are, or ask what you are looking for, the month runs from when we have that. Where a request is clearly excessive or unfounded we may charge a reasonable fee or decline it, and we will explain why.

• See it. You can ask for a copy of the information we hold about you.
• Correct it. You can ask us to put right anything that is wrong or incomplete.
• Delete it. You can ask us to erase it. We can refuse where a law or a professional duty means we must keep the record.
• Limit how we use it. You can ask us to pause using it while a question about it is sorted out.
• Object to us using it. Where we rely on legitimate interests, you can object and we will stop unless we have a strong reason to continue.
• Take it with you. Where we hold information because you gave it to us and we use it under a contract or with your consent, you can ask for it in a common file format you can pass to someone else.
• Withdraw your consent. Where we rely on consent, you can withdraw it at any time. That does not affect anything done before you withdrew it.
• Complain to us. If you think we have handled your information wrongly, you have a right to complain directly to us. We have to acknowledge it within 30 days, look into it, and tell you the outcome.

We never make a decision about you by computer alone, and we do not build a profile of you.

To use any of these rights, contact James Walker at james@lightning-oak.co.uk. We may need to confirm who you are before we act, which protects you as much as us.

How to complain

If you think we have handled your information wrongly, you can complain to us. Write to james@lightning-oak.co.uk, or ask us for a complaint form and send it back by post or by email.

We will acknowledge your complaint within 30 days. We will then look into it and tell you the outcome as soon as we can.

You can also complain to the Information Commission, the UK regulator for data protection, still known as the ICO. It recommends giving us the chance to resolve your complaint first.

Information Commission, 4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester M1 7BL

Helpline: 0303 123 1113

Website: ico.org.uk/make-a-complaint

Changes to this notice

We review this notice when something changes about how the site or the practice works, and at least once a year. The date at the top shows when it was last updated. If we make a significant change we will say so on this page.

Registration

Lightning Oak Limited is registered with the Information Commission, still known as the ICO, registration number ZC127643.

Course bookings and your information

Last updated 16 October 2026.

What this section covers

This adds to the privacy notice above for anyone who books or attends a Suicide First Aid® course. The rest of the notice, including your rights and how to complain, applies in the same way.

What we collect

When you book: your name, email address, phone number and the name for your certificate, and a postal address if you add a printed workbook. For an organisation's course, the same details for each learner, from the organisation. Before or during the course: any access need you choose to tell us about. Afterwards: whether you attended the whole course, your certificate and your feedback.

Health information

We do not ask about your health or your own experience. If an access need involves your health, we use it only to make the adjustment, and you can ask us for a call rather than write it down. If a learner may be at risk during a course, we keep a short note of what happened and what we did.

Why we use it

To book your place, take payment, send joining details and run the course: performance of our contract with you or, where an organisation booked you, our legitimate interests. To issue certificates and meet NCSPET's licence and quality checks: legitimate interests. Payment records: legal obligation. An access need that involves your health: your explicit consent, which you can withdraw. Keeping someone safe: vital interests where a life is at risk, and otherwise the safeguarding condition in the Data Protection Act 2018.

Who we share it with

Stripe takes payments and also uses your booking details for its own fraud and legal checks. NCSPET receives a booking form for each course, with no learner names, and runs the feedback form through Coursecheck, which learners fill in directly; both act under their own privacy policies. Zoom hosts online courses, which are never recorded, and an NCSPET observer may join a course for quality checks. An organisation that books a course may receive a feedback summary, and hears about a learner's welfare only with their agreement. Where a life is at risk, we tell the emergency services.

How long we keep it

We keep course records only as long as we need them. Payment records: six years from the end of the accounting period, as the law requires. Booking, attendance and certificate records: up to six years after the course, so attendance can be confirmed. Access needs: only until the course and any follow-up are over. Safeguarding notes: up to six years, or longer only where a safeguarding or legal matter needs it. Records of a course for an organisation: six years after the course, as for other client records. NCSPET, Stripe and Zoom keep what they hold under their own policies.

Where it is held

Course records are kept on Lightning Oak's own password-protected systems, such as its email and cloud storage. Zoom is a United States company, and Stripe may process payment information outside the UK; both move it under safeguards recognised by UK data protection law, and the section above on where your information is held applies.

Cookie notice

Last updated 2 October 2026.

What a cookie is

A cookie is a small text file that a website saves on your device. It lets the site remember something about your visit. Some cookies are needed to make a site work at all. Others count visitors, or track people across different sites.

The same rules apply to similar technologies, such as tracking pixels, local storage and device fingerprinting. Where this notice says cookies, it means all of them.

The rule we follow

We may only store information on your device, or read it, without asking you first where one of the exceptions in the Privacy and Electronic Communications Regulations applies. Two of them matter on this site: cookies needed to send a communication across a network, and cookies strictly necessary to provide something you asked for.

There is also an exception for low-risk cookies used only to collect statistics, but it applies only where what they collect is used for nothing except improving the site. Google Analytics and Microsoft Clarity do not meet that condition, because Google and Microsoft also use the information for their own purposes. So we ask before either of them runs.

Anything outside the exceptions needs your consent before we set it. On this site that means the analytics cookies, which you accept in the cookie panel, and the booking calendar, which you accept there or by choosing “See available times”. Advertising, cross-site tracking and profiling would need it too, and we do none of them.

The strictly necessary cookies carry no right to object. That is why they cannot be switched off.

These rules changed on 5 February 2026. Schedule A1 to the Privacy and Electronic Communications Regulations, added by the Data (Use and Access) Act 2025, replaced the two original exceptions with five: transmission, strictly necessary, statistics, appearance and emergency assistance.

The categories we use

Strictly necessary

These make the website work and keep it secure. They are set as soon as the site needs them and you cannot turn them off, because the site would not function without them. They also remember the choice you made about the other cookies, from the moment you make it, so we do not ask again on every page.

• lib-consent (Lightning Oak, kept in your browser’s local storage). Remembers your cookie choice and when you made it. First party. 6 months.
• Cloudflare Turnstile (Contact page only). Checks that the contact form is being sent by a person rather than an automated program. It keeps the form secure.
• _cfuvid (Cloudflare, for our website host). Helps protect the site from abuse by telling apart visitors who share an internet connection. First party. Deleted when you close your browser.

Set without asking. You cannot object to these.

Appearance and functionality

These remember a choice you made, such as a display setting, so the site behaves the way you left it. We do not use any at present.

Analytics

These count visits and show us which pages are read and how people arrived (Google Analytics), and how visitors move around a page, including clicks and scrolling (Microsoft Clarity). We use that to improve the site.

Google and Microsoft also use what these tools collect for their own purposes, under their own privacy policies. We do not use them to advertise to you, and we tell both tools that advertising use is not permitted.

• _ga (Google Analytics). Tells one visitor apart from another. First party. 13 months.
• _ga_4VV6JDLNLZ (Google Analytics). Keeps track of the current visit. First party. 13 months.
• _clck (Microsoft Clarity). Tells one visitor apart from another. First party. 1 year.
• _clsk (Microsoft Clarity). Links the pages viewed in one visit. First party. 1 day.
• _cltk (Microsoft Clarity, kept in your browser’s session storage). Tells apart browser tabs during a visit. First party. Deleted when you close the tab.

Only set if you accept. You can switch them off at any time, and they are deleted when you do, apart from _cltk, which goes when you close the tab.

Booking calendar

This shows the Calendly booking calendar on the Contact page, so you can book a call. Calendly, a United States company, sets its own cookies when the calendar loads: two security cookies from Cloudflare, one lasting 30 minutes and the other until you close your browser; a fraud-prevention cookie from Stripe, which lasts up to 400 days, and four entries Stripe keeps in your browser’s session storage for the same check, deleted when you close the tab; one entry Calendly keeps in your browser’s local storage, which stays until you clear your browser’s data; and, if you answer Calendly’s own cookie notice inside the calendar, a record of that choice, which lasts 1 year. These are set only when the calendar opens: straight away on the Contact page if you have accepted the booking calendar in the cookie panel, or when you choose “See available times” if you have not. You can change the cookie panel choice at any time. When it opens, the calendar also connects to three services Calendly uses: Google reCAPTCHA, which checks that a person rather than an automated program is booking; a Google sign-in service; and Airbrake, which reports errors to Calendly.

Advertising and targeting

These follow people between websites to build a picture of their interests and show them advertising. We do not use any. If that ever changes we will ask your permission first, because these are not covered by any exception.

First party means the cookie belongs to this site’s address rather than to another company’s.

How to change your mind

On this site. Select Cookie settings at the bottom of any page, or the button below. Choose Reject analytics cookies, or untick Analytics under Manage cookies and save. The change takes effect at once and the analytics cookies are deleted; Clarity’s _cltk entry goes when you close the tab.

Change cookie settings

In your browser. Every browser lets you block or delete cookies. The setting is usually under Privacy or Site settings. Blocking strictly necessary cookies may stop parts of this site working.

Clearing this site’s data in your browser also clears the record of your choice, so you will be asked again on your next visit. We also ask again after six months.

More information

Our privacy notice explains what we do with personal information more generally, including your rights and how to complain.

The Information Commission, still known as the ICO, publishes plain English guidance on cookies at ico.org.uk.

If you have a question about this notice, contact James Walker at james@lightning-oak.co.uk.

Terms

Last updated 16 October 2026.

These terms

These terms cover your use of this website and how Lightning Oak Limited takes on work, talks and courses. Each piece of work also has its own written terms, such as an engagement letter, a proposal or a booking confirmation. Where those differ from this page, they apply.

Using this website

The content is general information, not advice on your own situation. We work to keep it accurate and current, but cannot promise it is complete. Links to other websites are there for convenience, and we are not responsible for what those sites say. The words, design and pictures belong to Lightning Oak Limited or are used with permission; please ask before reusing them.

Working together

Work begins once the scope, fees and timing are agreed in writing.

Paying

Fees are as agreed in writing, and invoices are due by the date shown on them. Payments made online are taken by Stripe, so we never see or store your card details.

Cancelling

Cancellation and refund terms are set out when you book or agree the work. Nothing on this page affects your legal rights as a consumer.

Liability

Our liability for a piece of work is set out in its written terms. Nothing on this page limits any liability that the law does not allow to be limited.

Questions and complaints

Email james@lightning-oak.co.uk, and James will reply himself.

The law

These terms are governed by the law of England and Wales. If you are a consumer living elsewhere in the UK, you can also bring a claim in your local courts.

Changes

We may update these terms. The date at the top shows when they last changed.

Course booking terms

Last updated 16 October 2026.

Who your booking is with

Your contract is with Lightning Oak Limited, company number 14222576, which runs Suicide First Aid® courses under licence from the National Centre for Suicide Prevention Education and Training UK CIC (NCSPET). Courses are for adults aged 18 and over.

Booking and paying

Open course places are booked online from each date on the course page, at £103 for the one day or £55 for the half day, with no VAT to add. Stripe takes the payment, emails a receipt and asks for your name, email, phone number and certificate name, and a postal address if you add a printed workbook. James emails joining details within two working days, and bookings close seven days before each course.

What is included

Your place and a digital workbook to keep for your own use, which is NCSPET's copyright. A printed copy costs £2.40 (half day) or £3.00 (one day), requested at least two weeks ahead.

Cancelling or changing your place

Individuals can cancel within fourteen days of booking for a full refund, unless the course has already taken place. After that, a place cancelled at least fourteen days before the course is refunded in full or moved to another date, and a place cancelled later can be passed to someone else or moved at no charge. To cancel, email james@lightning-oak.co.uk.

If a course cannot run

If a date cannot run, or James has to move it at short notice, for example through illness, each person chooses a full refund or another date.

Certificates

Learners who attend the whole course and complete the short feedback form at the end receive a certificate of attendance. Anyone who misses part of a course can join a later open course once, free of charge, subject to availability.

Joining online

Online learners join for the whole course with their camera on where they can, from a quiet, uninterrupted space, and each learner is responsible for their own device and connection. Anyone who needs an adjustment can say so in reply to the joining email.

Behaviour and safety

Nobody has to share their own experience, and anyone can step out at any time. James may ask someone to leave if their behaviour puts others at risk.

Courses for organisations

James confirms the fee, the date and any cancellation terms in writing first, and Lightning Oak Limited invoices the organisation, payable on receipt.

Costs and your rights

We are not responsible for travel or other costs you have paid because of the course, unless the law says otherwise. Nothing in these terms affects your legal rights as a consumer.

Complaints

Tell James first, at james@lightning-oak.co.uk. If it is not resolved, you can tell NCSPET, which licenses the courses, through suicidefirstaid.uk.

The law

These terms are governed by the law of England and Wales.

Safeguarding and learner welfare

Last updated 16 October 2026.

Not a support line

The courses teach people how to help someone stay safe until other help takes over. They are training, not therapy, and this website is not a support line. If you need help now, call Samaritans free on 116 123, day or night. If a life is at risk, call 999.

Our policy

Lightning Oak has its own safeguarding policy and learner welfare procedure, and we follow them on every course, online and in person. Our tutor, James Walker, is responsible for safeguarding on the courses he runs and holds NHS Level 1 and Level 2 safeguarding training, renewed each year. You can ask us for a copy of the policy.

Before the course

Everyone hears beforehand what the course will cover, including the films. Anyone recently bereaved, or unsure whether now is the right time, can talk to us before booking. The joining email suggests thinking of someone you could talk to afterwards.

On the day

Support details are given at the start as well as the end. Each group agrees ground rules: no detail of how anyone died, and what is shared stays in the room unless someone may be at risk of serious harm. Nobody is asked to share their own experience.

Stepping out

Anyone can step out without explaining why. We ask only for a quick word or message that you are all right, and we check in with anyone who steps out. If someone leaves an online course and does not come back, we contact them by phone or message, using the number given when booking.

Courses for organisations

We agree a wellbeing contact with the organisation beforehand: someone learners can turn to on the day and afterwards.

If someone is at risk

If a learner says during a course that they are thinking about suicide, we talk with them privately, listen without pressing for detail, help them agree who they will turn to, and follow up within two working days. If a life is at risk, we call 999. We share information only as far as needed to keep someone safe, and with their agreement wherever possible.

Adults only

The courses are for adults aged 18 and over. If we find that a learner is under 18, we speak with them privately, make sure they are safe and know where to find support, and refund the place. A concern about a young person's safety goes to the local council's children's services, or to 999 if they are in danger.

Raising a concern

Anyone worried about safety on a course can email james@lightning-oak.co.uk. We talk safeguarding concerns through with NCSPET, and a concern about our tutor can be raised with NCSPET directly through suicidefirstaid.uk.