1. Who is responsible for your information?
Dr Darren Stevens is the controller of personal information described in this notice.
If you have a question, want to exercise a privacy right, or want to make a complaint to me, email dr@darrenstevens.co.uk.
2. Information I collect
The information I collect depends on how you use the website and whether you contact or work with me. It may include:
- Contact information, such as your name, email address, telephone number, organisation and role.
- Enquiry and correspondence information, including the content of messages and any information you choose to provide.
- Appointment information, such as your chosen meeting time, time zone and answers supplied when booking through Calendly.
- Client and transaction information, such as services requested, contracts, invoices, payment records and relevant service correspondence.
- Technical and usage information, such as your IP address, browser and device type, referring page, pages viewed, approximate location derived from an IP address, and the date and time of a visit.
Please do not send health information or other sensitive personal information through an ordinary website enquiry or email unless it is necessary and we have agreed a suitable way to handle it.
3. Where the information comes from
Most information comes directly from you when you email, telephone, book a meeting, make an enquiry, enter into a contract, or otherwise communicate with me. Technical information may be generated by your browser, the website hosting service, Calendly or Statcounter when you use the site.
4. How and why I use your information
| Purpose | Typical information | Lawful basis |
|---|---|---|
| Respond to enquiries and discuss requested services | Contact details and correspondence | Steps requested before entering a contract, and legitimate interests in communicating about my work |
| Arrange meetings and provide services | Contact, appointment, client and transaction information | Contract, or steps requested before entering a contract |
| Manage records, invoices, tax and legal obligations | Client and transaction information | Legal obligation and legitimate interests in administering and protecting the business |
| Protect the website and diagnose technical problems | IP address, device, browser and server-log information | Legitimate interests in security, fraud prevention and maintaining the website |
| Understand website use and improve content | Technical and usage information collected through analytics technologies | Consent where required for non-essential cookies or similar technologies |
| Send news or marketing that you asked to receive | Name, email address and communication preferences | Consent, or legitimate interests where direct-marketing law permits |
Where I rely on legitimate interests, those interests are communicating with people who approach me, operating and improving the business, keeping appropriate records, and protecting the website. I consider whether those interests are proportionate and whether your rights override them.
5. Cookies, analytics and embedded services
Cookies and similar technologies can store or read information on your device. You can block or delete cookies using your browser settings, although this may affect how some features work.
Calendly
The website embeds a Calendly booking calendar. Loading or using that calendar connects your device to Calendly and may allow Calendly to process technical information and place cookies. If you book, Calendly processes the information you enter so that the appointment can be arranged. Calendly displays its own cookie choices and publishes a privacy notice.
Statcounter
The website uses Statcounter to understand visits and how people use the site. Statcounter may process technical and usage information and may use cookies or similar technologies. Non-essential analytics technologies require consent where applicable. Statcounter publishes a privacy and legal notice.
Hosting and server logs
The hosting and content-delivery services may record technical information in server logs to deliver the website, maintain security and investigate faults.
6. Who I share information with
I do not sell your personal information. I may share only what is reasonably necessary with:
- website hosting, content-delivery, email and IT service providers;
- Calendly for appointment scheduling;
- Statcounter for website analytics;
- video-conferencing, accounting, payment or professional-adviser services used to administer or deliver work; and
- courts, regulators, law-enforcement bodies or other parties where disclosure is required by law or necessary to establish, exercise or defend legal rights.
Third-party websites reached through links are responsible for their own privacy practices.
7. International transfers
Some service providers may process information outside the United Kingdom. Where UK data-protection law requires safeguards, information should be protected using a UK adequacy regulation, the UK International Data Transfer Agreement or Addendum, or another lawful transfer mechanism. You may contact me for further information about the safeguards relevant to your information.
8. How long I keep information
- General enquiries: normally up to 24 months after the last meaningful contact.
- Appointment records: normally up to 24 months after the appointment.
- Client, contract, invoice and tax records: normally up to seven years after the relationship or relevant financial period ends.
- Marketing records: until you unsubscribe or consent is withdrawn, with minimal suppression information retained where necessary to respect that choice.
- Security and server logs: normally up to 12 months, unless they are needed for an active investigation.
I may keep information for longer where law requires it or where it is reasonably necessary for a legal claim. I may delete it sooner when it is no longer needed.
9. Your rights
Depending on the circumstances, UK data-protection law may give you the right to:
- ask for a copy of your personal information;
- correct inaccurate or incomplete information;
- ask for information to be deleted or its use restricted;
- object to processing based on legitimate interests or to direct marketing;
- receive certain information in a portable format; and
- withdraw consent at any time, without affecting earlier lawful processing.
Your right to object: You can object at any time to the use of your personal information for direct marketing. You may also object to processing based on legitimate interests; I will consider your circumstances and stop unless there are compelling lawful reasons to continue.
You will not normally have to pay to exercise a right. I may need to confirm your identity before acting on a request. Email dr@darrenstevens.co.uk to make a request.
10. Complaints
Please contact me first if you have a concern so I can try to resolve it. You also have the right to complain to the UK Information Commissioner’s Office (ICO). Visit the ICO’s data-protection complaints page for current contact details and guidance.
11. Security
I use reasonable technical and organisational measures intended to protect personal information. No internet or email system is completely secure, so please do not send confidential or sensitive information by ordinary email unless we have agreed that it is appropriate.
12. Changes to this notice
I may update this notice when the website, services or legal requirements change. The date at the top shows when it was last revised. Material changes will be brought to people’s attention where appropriate.