How I handle your information.

Who is holding your information

What information I collect

I only collect personal data when I genuinely need it. The information I hold falls into a few categories:

• From visitors to this website: if you click through to a Calendly booking page, Calendly will collect your name, email address, and the times you select. This data is held by Calendly and shared with me to facilitate the meeting.
• From people who email me: if you email me at laura@theopshouse.co.uk or use any other contact link on this site, I keep a copy of our correspondence so I can respond and follow up.
• From clients: once we start working together, I'll hold the information you'd expect: your name, contact details, business name, billing address, and records of the work we do together.

This site does not use any analytics, tracking pixels, or advertising cookies. The site uses only essential cookies needed for basic functionality.

Why I collect it

I collect personal data when I need to:

• Reply to enquiries you send me
• Schedule and run meetings with prospective and current clients
• Deliver the services you've contracted me to provide
• Invoice you and keep proper financial records
• Meet my legal obligations (tax, accounting, contractual)

I do not sell, rent, or trade your data. I do not share it with marketing or advertising platforms, data brokers, or any party not directly involved in delivering services to you.

How I use AI in client work

Where AI tools support service delivery, I use them in line with the following:

• I use Anthropic's Claude and OpenAI's ChatGPT for drafting content, transforming client recordings into written form, and assisting with research, planning, and operational work.
• I use these tools on plans where model training is explicitly disabled. Client data submitted through these tools is not used to train or improve their AI models.
• With training disabled, conversation data is retained by Anthropic for up to 30 days for safety and abuse monitoring purposes, then permanently deleted. OpenAI applies a Data Processing Addendum with Standard Contractual Clauses.
• All AI-generated content is reviewed and edited by me before being shared with clients. Final approval always rests with the client. AI assists, it does not replace human judgment.
• AI is not used for any decision-making about individuals.
• If you'd prefer your work to be handled without AI tools, that's available on request.

Third parties I share information with

I share information with the following third parties solely for service delivery:

• Cloud storage: Notion (delivery hub), Google Drive (file storage)
• AI tools: Anthropic (Claude), OpenAI (ChatGPT), with training disabled
• Communication: Google Workspace email, WhatsApp where used for client correspondence
• Scheduling: Calendly
• Hosting: Netlify (this website is hosted with Netlify, which may log IP addresses for security and analytics)
• Accounting: FreeAgent and a UK-based accountant for financial records

All third parties are bound by data protection obligations.

Data transfers outside the UK and EU

Yes, some of the providers I use are based in the US (Anthropic, OpenAI, Notion, Calendly, Netlify, Google). These transfers are protected by:

• Standard Contractual Clauses (SCCs): EU-approved contract terms ensuring GDPR-level protection
• Encryption: in transit and at rest in secure data centres
• Limited retention: data is held only as long as necessary, with shorter retention periods (often 7-30 days or less) on AI providers
• No use for provider purposes: model training is disabled across all AI tools I use

How long I keep your data

• While we're working together: client content, recordings, and work files are stored securely in Notion, Google Drive, or other approved platforms.
• After we stop working together: all client data is returned or exported within 30 days. Files are deleted from my systems within 30 days. Platform backups may retain data for up to 90 days (automatic).
• Financial records: invoices, contracts, and business correspondence are retained for 6 years (UK tax law requirement). These contain only business contact details and transaction records.
• You can request early deletion at any time by emailing me.

Cookies

This site uses only essential cookies needed for basic functionality. There are no tracking cookies, no analytics cookies, no advertising cookies. You can disable cookies in your browser settings at any time without affecting your experience of this site.

Your rights

Under UK GDPR, you have the right to:

• Know what information I hold about you, and ask for a copy
• Correct anything that's inaccurate or out of date
• Ask me to delete information I hold about you (subject to legal limits, e.g. financial records I'm required to keep)
• Object to or restrict how I use your data
• Withdraw consent at any time, where consent is the basis for me processing your data

To exercise any of these rights, email me at laura@theopshouse.co.uk. I'll respond within 30 days.

Automated decision-making

I do not use any automated decision-making or profiling tools that produce legal or significant effects on individuals.

Children

I do not knowingly collect information about anyone under 16.

How to raise a concern

If you have concerns about how I handle your personal data, please contact me first by emailing laura@theopshouse.co.uk. I'll respond within 30 days.

If you're not satisfied with my response, you can escalate to the UK's data regulator, the Information Commissioner's Office (ICO):

Changes to this policy

I review this policy periodically and may update it as the business or the tools I use change. The date at the top of this page reflects the most recent update. If you've engaged with me as a client, I'll notify you directly of any significant changes.