Privacy Policy

Last updated: October 2026 · Version 1.5

Plain English summary: This website sets no cookies. It has one optional form: on the Commercial Readiness Checklist you can choose to send me your results, and nothing is sent unless you do. The site also counts page views and clicks on links, using its own measurement rather than a third-party tool, and that counting records nothing that identifies you. Your personal data only reaches me if you choose to send me your checklist results, or contact me directly by email, telephone, or through the booking calendar. I hold data only for as long as I need to, I never sell it, and you can ask me to delete it at any time.

This policy explains how I handle personal data under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who I am and how to contact me

This privacy policy applies to helenforsyth.com and the commercial services offered through it, operated by:

Data Controller: Helen Forsyth
Trading as: Something Other
Email: helen@something-other.com
ICO registration number: 00015877632

As a sole trader, I am not required to appoint a Data Protection Officer. For any data-related queries, contact me directly using the details above.

2. What personal data I collect, why, and the legal basis

I collect personal data only when you voluntarily provide it. The table below sets out what I collect, why, and the legal basis under UK GDPR Article 6:

What I collect	Why	Legal basis (UK GDPR Art. 6)
Name, email address, and message content (when you email me)	To respond to your enquiry and assess a potential commercial relationship	Legitimate interests (6(1)(f))
Name and telephone number (when you call me)	To follow up on your enquiry	Legitimate interests (6(1)(f))
Name and email address (via Notion Calendar booking)	To confirm and manage the appointment	Legitimate interests (6(1)(f))
Email address, name (if given), your checklist answers and score, and any message you add (when you choose to send me your results from the Commercial Readiness Checklist)	To read your results and reply to you personally by email about them. Nothing else. You are not added to a mailing list and receive no marketing unless you separately ask for it.	Consent (6(1)(a))
Contact details, correspondence, and business information (during an active engagement)	To deliver contracted commercial advisory services	Contract performance (6(1)(b))
Financial records, invoices, and payment information (clients only)	To meet statutory tax and accounting obligations	Legal obligation (6(1)(c))

Legitimate interests assessment: Where I rely on legitimate interests, I have assessed that processing is necessary, proportionate, and does not override your rights and freedoms. You have the right to object at any time (see Section 7).

Website analytics: This site counts page views and clicks on links so that I can see which pages are read and which links are used. It is measured by the site itself rather than by Google Analytics or any other third-party tool, and it is deliberately built to record nothing that identifies you. Each event stores only the type of event, the label of the link clicked, the page path, the destination of an outbound link, the hostname of the site that referred you, whether the screen is a mobile or a desktop size, and the date and time. No cookie is set, no identifier is assigned to you, no profile is built, and two visits by the same person cannot be connected to each other. Your IP address and browser user agent are not recorded. Separately, the site also counts visits by AI crawlers, which are automated programs rather than people; for those the crawler’s published name is recorded and nothing else. Because nothing in this counting identifies a living individual, it is not personal data under UK GDPR, and no consent is required. Section 6 sets this out in full.

The Commercial Readiness Checklist: The checklist itself is free to use and requires no personal data. Your answers are scored inside your own browser and are not transmitted anywhere. Sending your results to me is a separate, optional step that only happens if you enter your email address and tick the consent box. If you would rather keep your results to yourself, the page also lets you email them to yourself from your own email app, save them as a PDF, or copy them, none of which sends anything to me or to this website.

3. How long I keep your data

Enquiries that do not lead to an engagement: Retained for no longer than 12 months from our last communication, unless you ask me to remove it sooner.
Client engagement records and correspondence: Retained for the duration of the engagement and for two years after it ends, unless a longer period is required by law or contract.
Financial records and invoices: Retained for a minimum of six years from the end of the relevant tax year, as required by HMRC.
Checklist results you send me: Retained for no longer than 12 months from our last communication, and deleted sooner on request or if you withdraw your consent. Deleting the submission removes it both from my inbox and from the form submission store held by Netlify.
Website analytics counts: Retained for 12 months and then deleted automatically. These records contain no personal data, so there is nothing in them to identify or remove on request.
Booking calendar records: Managed by Notion. Notes from calls where no engagement follows are retained for up to 12 months.

4. Who I share your data with

I do not sell, rent, or share your personal data with third parties for marketing purposes.

Your data may be processed by the following third-party service providers:

Google LLC (Google Workspace: email, calendar, document storage): Processes data under Standard Contractual Clauses. Privacy policy: policies.google.com/privacy
Notion Labs Inc. (booking calendar and note-taking): Processes data under Standard Contractual Clauses. Privacy policy: notion.so/privacy
Netlify, Inc. (website hosting, handling of the checklist results form, and the database holding the site’s own analytics counts): Receives a form submission only when you choose to send me your checklist results, stores it so it can be emailed to me, and processes it under its Data Processing Addendum and Standard Contractual Clauses. Privacy policy: netlify.com/privacy
HM Revenue & Customs: Financial information is disclosed where required by law.

5. International transfers of personal data

Google LLC, Notion Labs Inc. and Netlify, Inc. are headquartered in the United States. When these services process your data, it may be transferred outside the United Kingdom.

All three providers use Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner as the lawful transfer mechanism. This means they are contractually required to protect your data to UK GDPR standards.

No other international transfers of your personal data take place.

6. Cookies and analytics

This website sets no cookies. Nothing is written to your browser’s storage, and no cookie consent banner is required.

There is no third-party tracking. The site carries no Google Analytics, no advertising pixels, no social media trackers, and no fingerprinting. Nothing you do here is shared with an advertising network or used to target you anywhere else.

The site does count its own traffic. A small script on each page sends a page view to this website’s own server, and sends an event when you click a link such as the booking calendar or an email address. The counts are stored in a database that only I can read. Here is exactly what each record contains:

Whether the event was a page view or a click
For a click, a label describing the link, for example “book_intro_call” or “email_helen”
The path of the page, for example “/about”
For a click leading off the site, the destination address
The hostname of the site that referred you, for example “google.com”, reduced to the hostname in your browser before it is sent, and omitted entirely when you move between pages on this site. Where your browser sent no referrer but the link you followed carried a “utm_source” tag naming its origin, that tag is recorded in its place
Whether your screen is a mobile or a desktop size
The date and time

Here is what is deliberately not recorded about you: your IP address, your browser user agent, any cookie or identifier, any visitor or session number, any fingerprint, and the full referring address beyond its hostname. No profile is built and no identifier links one page view to another, so a sequence of pages cannot be attributed to a single person, and neither I nor anyone else can work backwards from these records to you.

My purpose is to understand which pages are useful and whether people find the booking calendar, which is a legitimate interest under UK GDPR Article 6(1)(f). Because the records identify no one, they are not personal data, and the Privacy and Electronic Communications Regulations do not require consent as no information is stored on or read from your device.

This site also counts visits by AI crawlers, the automated programs that search engines and AI assistants use to read web pages. A crawler is not a person, so this involves no personal data at all. When one fetches a page, the crawler’s published name (for example “GPTBot”) and the page path are recorded; the user-agent string it sent is used to identify it and is then discarded rather than stored. These counts exist so I can see which pages AI assistants are reading.

The counts are held for 12 months and then deleted automatically.

The Notion Calendar booking page (linked from this site) is operated by Notion and subject to their own cookie practices.

If this website ever adds cookies or third-party tracking, this policy will be updated and an appropriate consent mechanism will be put in place before any such tracking begins.

7. Your rights under UK GDPR

You have the following rights. Exercising them is free of charge. I will respond within one calendar month (extendable by two further months in complex cases, with notice to you).

Right of access (Article 15): Request a copy of the personal data I hold about you and information about how it is processed.
Right to rectification (Article 16): Request correction of inaccurate or incomplete data without undue delay.
Right to erasure (Article 17): Request deletion of your data. This right is subject to legal retention requirements.
Right to restriction of processing (Article 18): Request that I limit use of your data while a dispute about accuracy or lawfulness is resolved.
Right to data portability (Article 20): Receive your data in a structured, machine-readable format where processing is based on consent or contract and carried out by automated means.
Right to object (Article 21): Object at any time to processing based on legitimate interests. I will stop unless I can demonstrate compelling legitimate grounds that override your interests, or the processing is for legal claims.
Right to withdraw consent: Where processing is based on your consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal. This applies to checklist results you have sent me. Email me and I will delete them, with no need to give a reason. Most other processing described in this policy is based on legitimate interests or contract rather than consent.

To exercise any of these rights, contact me at helen@something-other.com. I may need to verify your identity before processing your request.

8. Automated decision-making and profiling

I do not carry out any automated decision-making or profiling as defined under Article 22 of the UK GDPR. No decisions with legal or similarly significant effects are made about individuals through automated means. Human review is involved in all commercial decisions.

9. Data security

I implement appropriate technical and organisational measures to protect personal data against unauthorised access, accidental loss, destruction, or disclosure. These include:

Google Workspace encryption in transit (TLS) and at rest for all stored data
Password protection and two-factor authentication on all accounts used to process personal data
Access to personal data limited to me alone
Secure deletion of data no longer required in line with the retention periods in Section 3

In the event of a personal data breach that poses a risk to your rights and freedoms, I will notify the ICO within 72 hours of becoming aware of it, and will notify affected individuals without undue delay where the risk to them is high.

10. Right to complain to the ICO

You have the right to lodge a complaint with the UK supervisory authority if you believe your data has been handled unlawfully:

Information Commissioner’s Office (ICO)
Website: ico.org.uk
Telephone: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

I would welcome the opportunity to address any concerns directly before you contact the ICO. Please email me first at helen@something-other.com.

11. Changes to this policy

This policy may be updated to reflect changes in how I operate, in applicable law, or in the services I use. The version number and last updated date at the top of this page always reflect the current version. Where changes are material, I will notify active clients directly.

12. Contact

Helen Forsyth
Something Other
helen@something-other.com