This privacy notice explains how I collect, use and protect your personal information.
Contact details
Email: privacy@michaelgrimes.co.uk
What information I collect and why
To provide goods and services
I collect or use the following information to provide services and goods, including delivery:
Names and contact details
Website user information (including user journeys and cookie tracking)
Photographs or video recordings
Call recordings
Records of meetings and decisions
Information relating to compliments or complaints
For service updates or marketing purposes
I collect or use the following information for service updates or marketing purposes:
Names and contact details
Marketing preferences
Recorded images, such as photos or videos
Call recordings
Purchase or viewing history
Website and app user journey information
Records of consent, where appropriate
Lawful bases and data protection rights
Under UK data protection law, I must have a lawful basis for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.
The lawful basis I rely on may affect your data protection rights, which are summarised below. You can find out more about your rights and any exemptions that may apply on the ICO’s website.
Your rights
Right of access
You have the right to ask for copies of your personal information. You can also request details about where I obtained your personal information and who I share it with. Some exemptions apply, which means you may not receive all of the information you request.
Right to rectification
You have the right to ask me to correct or complete personal information that you believe is inaccurate or incomplete.
Right to erasure
You have the right to ask me to delete your personal information in certain circumstances.
Right to restriction of processing
You have the right to ask me to limit how I use your personal information in certain circumstances.
Right to object to processing
You have the right to object to the processing of your personal information in certain circumstances.
Right to data portability
You have the right to ask me to transfer the personal information you have provided to another organisation, or directly to you, where applicable.
Right to withdraw consent
Where I rely on consent as my lawful basis, you have the right to withdraw your consent at any time.
If you make a request, I will respond without undue delay and, in any event, within one month.
To make a data protection rights request, please contact me using the details above.
My lawful bases for collecting and using personal information
To provide services and goods
My lawful bases for collecting or using personal information to provide services and goods are:
Consent
I have permission from you after providing all relevant information. All of your data protection rights may apply, except the right to object. You can withdraw your consent at any time.
Contract
I need to collect or use the information so that I can enter into or fulfil a contract with you. All of your data protection rights may apply except the right to object.
Legal obligation
I need to collect or use your information so that I can comply with the law. All of your data protection rights may apply except the right to erasure, the right to object and the right to data portability.
Legitimate interests
I collect or use your information because it benefits you, my business or another party, without causing an undue risk of harm.
My legitimate interests are:
Professional networking and business development
I maintain records of professional contacts and previous interactions so that I can maintain professional relationships, avoid losing important context from previous conversations, assess whether my services may be relevant to an organisation, and communicate about matters that may be relevant to the individual or organisation.
The information recorded is limited to professional contact details and notes about previous interactions. Individuals would reasonably expect a consultant or service provider to retain information about professional conversations and contacts. I do not use this information in ways that are unexpected, intrusive or likely to cause harm.
Client and project management
I collect and use personal information to manage client relationships, maintain records of communications, administer projects, issue invoices and keep accurate business records.
This helps me provide a consistent and professional service and reduces the risk of errors or misunderstandings. Individuals would reasonably expect this information to be retained while services are being provided and for appropriate business and legal record-keeping purposes.
I limit access to information and retain it only for as long as necessary.
Responding to enquiries and providing services
I collect and use personal information to respond to enquiries, discuss potential projects, provide consultancy and support services, and communicate with clients throughout our working relationship.
For more information about my use of legitimate interests as a lawful basis, please contact me using the details above.
For service updates or marketing purposes
My lawful bases for collecting or using personal information for service updates or marketing purposes are:
Consent
I have permission from you after providing all relevant information. All of your data protection rights may apply, except the right to object. You can withdraw your consent at any time.
Contract
I need to collect or use the information so that I can enter into or fulfil a contract with you. All of your data protection rights may apply except the right to object.
Legal obligation
I need to collect or use your information so that I can comply with the law. All of your data protection rights may apply except the right to erasure, the right to object and the right to data portability.
Where I get personal information from
I obtain personal information:
Directly from you
From councils and other public sector organisations
From publicly available sources
From previous employers
From suppliers and service providers
How long I keep information
I only keep personal information for as long as necessary for the purposes for which it was collected, including meeting any legal, accounting or reporting requirements.
To determine the appropriate retention period, I consider:
The amount of information held
The nature and sensitivity of the information
The potential risk of harm from unauthorised use or disclosure
Any applicable legal requirements
By law, I must keep basic information about clients (including contact, identity, financial and transaction data) for six years after they cease being clients for tax and legal liability purposes.
In some circumstances, you can ask me to delete your data. I may also anonymise personal information so that it can no longer be associated with you. Where this happens, I may use that anonymised information indefinitely for research, reporting or statistical purposes.
Who I share information with
Data processors
QuickBooks
QuickBooks manages my accounting and invoicing and integrates with HubSpot for client management.
HubSpot
HubSpot is my customer relationship management (CRM) and marketing platform. It stores information about clients and prospective clients and manages marketing consent preferences.
Microsoft
Microsoft provides my email, cloud storage and productivity services.
Other organisations I may share information with
Professional consultants
Organisations that I am legally required to share information with
Sharing information outside the UK
Where necessary, my data processors may transfer personal information outside the UK.
When this happens, they comply with UK GDPR requirements and put appropriate safeguards in place.
HubSpot
Category: CRM and marketing platform
Country: United States
Safeguard: UK Addendum to the EU Standard Contractual Clauses (SCCs)
Microsoft
Category: Email, cloud storage and productivity services
Country: United States
Safeguard: UK Addendum to the EU Standard Contractual Clauses (SCCs)
Intuit QuickBooks
Category: Accounting and invoicing software
Country: United States
Safeguard: UK Addendum to the EU Standard Contractual Clauses (SCCs)
How to complain
If you have concerns about how I use your personal information, you can contact me at:
Email: privacy@michaelgrimes.co.uk
If you remain unhappy after raising a complaint with me, you can also complain to the Information Commissioner’s Office (ICO).
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline: 0303 123 1113