Controller details
For the purposes of UK data protection law, the data controller for this website and related business communications is:
Scope of this policy
This policy applies to information collected through this website, including the Contact and Five-Line Brief forms, direct email contact, enquiry handling, pre-engagement discussions, and the administration and delivery of professional services.
Identity data and engagement materials
- Name and contact details — name, email address, phone number, and company details
- Information included in website Contact or Five-Line Brief forms, enquiry emails, briefs, attachments, or documents you choose to send
- Operational information relevant to a potential or active engagement, including project context, constraints, and communications history
- Technical website information that may be generated through standard server operation, such as basic logs, if processed by infrastructure providers
Client materials
In the course of this work, you may send structural materials such as workflows, contracts, notes, screenshots, internal documents, or other operational records. While these materials are often corporate in nature, they may contain personal data. They are handled only to the extent necessary to assess, scope, administer, or deliver the work. Client materials are not uploaded to public or third-party tools that store or reuse content beyond the relevant engagement.
Special category data
Do not submit patient-identifiable information, special category personal data, or criminal-offence data through the website forms. The normal enquiry process does not require it. If an engagement exceptionally requires sensitive personal data, this must be agreed in advance so that the relevant Article 6 lawful basis, any required Article 9 condition or Data Protection Act 2018 condition, and appropriate safeguards can be identified before that data is processed.
Why personal data is used
- To respond to enquiries and communicate with prospective clients
- To assess whether a matter is a fit for the services offered
- To scope, administer, and deliver professional engagements
- To maintain records relating to enquiries, proposals, agreements, invoices, and delivery
- To comply with legal, regulatory, accounting, or tax obligations
- To protect the security and integrity of the website and business communications
Legal basis for processing — mapped by purpose
Each processing purpose is linked to a specific lawful basis. The mapping is as follows:
Right to object. Where processing is based on legitimate interests, you have the right to object at any time. To exercise this right, contact hello@jamieforrester.com. Processing will stop unless there are compelling legitimate grounds that override your interests.
Who personal data may be shared with
Personal data is not sold. It is shared only where reasonably necessary to run the website and business, or where legally required.
- Website form delivery (Web3Forms) — Contact and Five-Line Brief submissions are transmitted to Web3Forms for processing and routing to the business inbox. Web3Forms states that its servers are located in the United States (US-East), that it does not store form submissions as a normal part of delivery, and that server logs containing personal information may be retained periodically for up to around two months.
- Encrypted cloud email infrastructure — used for business correspondence and receipt of website form submissions
- Encrypted cloud storage — used for secure document handling and delivery
- Professional invoicing and accounting tools — used to issue invoices and maintain financial records
- Web hosting and DNS infrastructure — used to operate the website
- Professional advisers — accountants, lawyers, or insurers where necessary
- Authorities or regulators — where disclosure is legally required
Processors
Third-party providers used to support the website or business may process data on my behalf. Where such providers are used, they are selected on the basis that they are appropriate for professional business use and provide reasonable security standards. They are not authorised to use personal data for their own purposes beyond what is necessary to provide the relevant service.
Transfer of data outside the UK
Some of the third-party providers used to operate this website and business are based outside the UK, or may process data on infrastructure located outside the UK. This includes providers of website form delivery, cloud email, storage, font delivery, and hosting services.
Where a restricted transfer of personal data outside the UK takes place, the applicable transfer rules are considered for the relevant provider and processing activity. Depending on the circumstances, this may involve a UK adequacy regulation, an approved transfer safeguard such as the UK International Data Transfer Agreement (IDTA) or UK Addendum, or a specific statutory exception where one lawfully applies.
Website forms and the United States
Website Contact and Five-Line Brief submissions are processed by Web3Forms on infrastructure it states is located in the United States (US-East). Web3Forms' public documentation does not identify a UK IDTA or UK Addendum applying to this website account. For that reason, website forms should be used only for ordinary initial enquiries and should not be used to send confidential client materials, patient-identifiable information, special category personal data, or criminal-offence data. Sensitive or engagement-specific transfer arrangements will be addressed separately where required.
Fonts and website infrastructure
This website uses Google Fonts, which may result in your browser making a request to Google's servers. Google's privacy policy governs any data processed in that context. No engagement-related personal data is transmitted via font loading.
If you have questions about the safeguards applied to any specific transfer, contact hello@jamieforrester.com.
How long personal data is kept
Personal data is retained only for as long as reasonably necessary for the purpose it was collected, including record-keeping, legal, tax, and dispute-management needs. Records are not kept indefinitely — where there is no ongoing business or legal need, they are periodically reviewed and deleted.
Unsuccessful enquiries
Retained for up to 12 months after the last communication, then deleted unless there is an active follow-up reason.
Pre-client and scoping discussions
Retained for up to 24 months after the last communication, or until the matter is clearly concluded.
Active client records
Retained for up to 6 years after completion of the engagement, to cover potential legal, tax, or dispute needs.
Financial records
Retained for at least 6 years as required under applicable UK accounting and tax rules.
How personal data is protected
- Use of encrypted, professional-grade email and cloud storage infrastructure
- Access controls and password protection for all business accounts
- Two-factor authentication where available
- Data minimisation wherever possible
Client materials and confidentiality
The analysis is not outsourced. Client materials are handled only as necessary to assess, scope, administer, or deliver the work. They are not uploaded to public tools that store or reuse content, using secured infrastructure appropriate to a sole professional practice.
AI tools and client data
Client materials and engagement data are not sent to public generative AI tools, not used to train AI models, and not shared for model training purposes. Where AI-assisted tools are used in the practice, client data is not submitted as input. They are used only for the purpose of the relevant enquiry or engagement.
No guarantee
No online system can guarantee absolute security. However, reasonable steps are taken to protect personal data against unauthorised access, misuse, loss, or disclosure.
Your data protection rights
Depending on the circumstances and the lawful basis relied on, you may have the right to:
- Request access to your personal data
- Request correction of inaccurate or incomplete data
- Request erasure of data in certain circumstances
- Request restriction of processing in certain circumstances
- Object to processing where legitimate interests are relied on — this right applies to all legitimate-interests processing on this site and will be given full weight
- Request data portability where the processing is automated and based on consent or contract performance
- Withdraw consent where consent is the lawful basis
How to exercise rights
To exercise any of these rights, use the Contact form or contact hello@jamieforrester.com. Reasonable steps may be taken to verify identity before responding. Rights requests will be handled without undue delay and normally within one calendar month. Where the law permits an extension for a complex request or multiple requests, the period may be extended by up to a further two months; if this applies, you will be told within the first month and given the reason.
Cookies and similar technologies
This website does not set non-essential cookies.
If any strictly necessary cookies are used for basic site function, they may be used without additional consent where legally permitted. If analytics, advertising, or other non-essential cookies are introduced in future, this policy will be updated and appropriate consent mechanisms will be in place before those cookies are set.
Questions, complaints, and changes
Data protection complaints
You can make a data protection complaint through the Contact form or by contacting hello@jamieforrester.com. Receipt will be acknowledged within 30 days. Appropriate steps will then be taken without undue delay to investigate the complaint, keep you informed where appropriate, and tell you the outcome without undue delay.
Complaints to the ICO
You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection. The ICO can be reached at ico.org.uk/make-a-complaint or by calling 0303 123 1113.
Policy updates
This policy may be updated from time to time to reflect legal, operational, or website changes. The most current version will always appear on this page with the date it was last revised.