01 Who is responsible

This website and Private Direction are operated by Private Direction Limited. Private Direction Limited is the controller of the personal information described in this notice. That means the company decides why and how it is used.

Contact: use the All other enquiries form on this website.

Private Direction Limited. Company Number: 17455979. Registered address: 7‑8 Portmill Lane, Hitchin, SG5 1DJ.

02 What I collect

When you use the website, limited technical information may be recorded, including your IP address, browser and device information, pages visited, referral source, approximate location and the time of your visit.

If you apply for Private Direction, I collect your name, email address, country or time zone, your answers to the application questions, how you heard about the service and your acknowledgements.

If you use All other enquiries, I collect your name, email address, nature of enquiry, message and privacy acknowledgement.

If we work together, I may also hold correspondence, notes you provide, records of our work, scheduling information, invoices, payment records and information needed to administer the relationship.

Please do not put highly sensitive personal, medical, financial or legal information into either public website form. If such information becomes relevant after we begin working together, use the private channel agreed between us.

03 Why I use it

I use application information to consider your request, decide whether a private conversation may be useful and take steps at your request before a possible engagement. The legal basis is taking steps before entering a contract and, where relevant, my legitimate interest in assessing and responding to genuine applications.

I use other-enquiry information to understand and answer legitimate correspondence. The legal basis is my legitimate interest in responding to people who contact me.

If we work together, I use relevant information to provide and administer the service, communicate with you, keep appropriate records, issue invoices and meet legal or accounting duties. The legal bases are performance of our contract, legal obligation and legitimate interests in running the practice properly and protecting legal rights.

Technical and security information is used to operate, protect and improve the website, prevent abuse and diagnose faults. The legal basis is legitimate interests.

04 Analytics and advertising

With your consent, Google Analytics is used to understand how visitors find and use the site. Google Ads may be used to measure advertising and conversions and, where separately permitted through the cookie controls, support advertising features.

Analytics and advertising tags must not activate until the relevant choice has been made. You may refuse non-essential cookies and later change your choice through the cookie settings link.

I do not send the contents of applications or enquiries to Google Analytics, Google Ads or any advertising platform. No application is scored or assessed automatically.

05 Cookies and similar technologies

Strictly necessary technologies support website security, forms, fraud prevention and the storage of your privacy choices. These do not require consent where they are essential to a service you request.

Analytics and advertising technologies are non-essential and are used only with consent. The live cookie preference panel will identify the cookies and technologies currently in use, their purposes and durations.

You can accept, reject or manage non-essential technologies at any time. Refusing them will not prevent you from reading the site or using its forms.

06 Who receives information

I do not sell personal information or add applicants and enquirers to a marketing list.

Information may be processed by suppliers that support the website and practice, including:

  • Webflow, which hosts the website and may receive website-form submissions;
  • Google, where you consent to Analytics or advertising measurement;
  • Cloudflare Turnstile, which helps protect website forms from automated abuse and spam;
  • email, document, hosting and IT providers used to communicate and keep records;
  • my accountant, insurers, legal advisers or other professional advisers where reasonably necessary; and
  • public authorities where disclosure is required by law.

Each supplier should receive only what it needs for its role. Your work will not be used as a testimonial, case study or public proof without a separate and explicit agreement.

07 International transfers

Webflow, Google, Cloudflare and some of their subprocessors may process information outside the United Kingdom, including in the United States.

Where UK personal information is transferred internationally, I rely on a valid transfer mechanism used by the relevant provider, such as UK adequacy regulations, the UK Extension to the EU–US Data Privacy Framework, the UK International Data Transfer Agreement or an approved contractual addendum, as applicable.

08 How long I keep information

Applications that do not lead to an engagement are normally retained for six months after the last meaningful contact, then deleted unless there is a legal or safeguarding reason to retain them longer.

Other enquiries are normally retained for up to twelve months after the last meaningful contact. If an enquiry becomes a client or professional relationship, the relevant record follows the retention period for that relationship.

Client, contractual and financial records may be retained for up to six years after the relationship ends where needed for tax, accounting, contractual or legal purposes. Working material that is no longer needed is deleted earlier where reasonably possible.

Google Analytics event-level data under my control should be configured for a maximum retention period of fourteen months. Security logs should normally be retained for no longer than 90 days unless an incident requires further investigation.

09 Security

I use reasonable technical and organisational measures to protect personal information. These include HTTPS, controlled access, server-side validation, spam protection and limiting access to people and providers who need it.

No online system is completely risk-free. Please use the private channel agreed with me rather than a public form for confidential client material.

10 Your rights

Depending on the circumstances, you may have the right to:

  • ask for a copy of your personal information;
  • correct inaccurate or incomplete information;
  • ask for information to be erased;
  • restrict or object to its use;
  • receive certain information in a portable format; and
  • withdraw consent where processing relies on consent.

Some rights are subject to legal limits and may depend on the lawful basis being used. To exercise a right, use the All other enquiries form and select Privacy or data request. I may need to confirm your identity before acting on the request.

11 Complaints

If you have a concern, please contact me first through the All other enquiries form so that I can try to resolve it.

You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint

12 Changes

I may update this notice when the website, service or suppliers change. The date at the top will show the latest revision.