What I hold,and why.

Who is responsible for your data

The data controller is Sarra Richmond, trading as The Ghost, of 2 Blackworth Court, Highworth, SN6 7NS, United Kingdom.

Data protection queries: [email protected]. There is no separate data protection officer, which is not required for an organisation of this size.

What is collected

• When you enquire or book a call. Your name, email address, telephone number if you give it, company or trade, and whatever you write in the message or booking form.
• When you become a client. Billing details, invoicing address, correspondence, and the material you supply for the work. That includes voicenotes, call recordings where agreed, transcripts, documents and background notes.
• When you visit this website. Standard server log data such as IP address, browser type and pages requested, collected by the hosting provider for security and reliability.
• Third party platforms. If you contact The Ghost through LinkedIn, Substack, WhatsApp or a booking tool, that platform processes your data under its own notice as well.

Special category data, meaning health, beliefs, ethnicity and similar, is not sought. If work touches on it, for example a personal story you want written, it is processed only with your explicit consent, and you can withdraw that consent at any time.

Why it is held, and the lawful basis

Your data is not sold, and it is not used to train any third party artificial intelligence model.

Recordings and transcripts

Calls are recorded only where you have agreed in advance. Recordings and transcripts are working material. They are used to capture how you speak, and for nothing else.

You can ask for a recording to be deleted at any time and it will be, subject to any record that must be kept for a legal reason.

Who else sees it

2 sets of people and systems, and no others.

A small team. The Ghost works with a small number of people who work solely for this business. No agencies, no freelance subcontractors, no work passed to third parties. Everyone on the team is bound by written terms that carry the same confidentiality and data protection obligations set out in this notice, and each sees only what a specific piece of work requires.

The software the business runs on. Ordinary business tools, each acting on instruction under its own contract:

• Website hosting and domain services
• Email and file storage
• Scheduling and video call software
• Transcription software
• Accounting software and, where needed, an accountant
• Payment processing

Data may also be disclosed where the law requires it, or to establish or defend a legal claim.

Transfers outside the UK

Some of the software providers above are based outside the United Kingdom, usually in the United States or the European Economic Area. The team is UK based. Where data goes outside the UK, it is protected by an adequacy decision, by the International Data Transfer Agreement, or by the UK Addendum to the European Commission's standard contractual clauses.

How long it is kept

• Enquiries that do not become work. 12 months, then deleted.
• Client correspondence and working material. For the engagement and 2 years after it ends, unless you ask for it sooner.
• Recordings and transcripts. 12 months after the engagement ends, unless you ask for them sooner.
• Invoices and accounting records. 6 years after the end of the relevant tax year, as required by HMRC.
• Marketing contacts. Until you unsubscribe, then a suppression record only, so you are not contacted again.

How it is kept safe

Accounts are protected by strong unique passwords and 2 factor authentication. Devices are encrypted and locked. Client material is stored in access controlled storage, not on shared drives. Access is limited to Sarra Richmond alone unless you have agreed otherwise in writing.

Cookies

This site sets no advertising or analytics cookies and does not track you across other sites. Only cookies strictly necessary to serve the page may be set by the host, and those do not require consent under the Privacy and Electronic Communications Regulations 2003.

If analytics or embedded video are added later, a consent banner will appear first and nothing non essential will be set until you agree. Current status: Confirm before launch.

Your rights

Under the UK GDPR you have the right to:

• Be told what data is held about you, and get a copy of it
• Have inaccurate data corrected
• Have data erased, where there is no overriding reason to keep it
• Restrict how data is used while a question about it is resolved
• Receive your data in a portable format, or have it sent to somebody else
• Object to processing based on legitimate interests, including any direct marketing, which will always be stopped on request
• Withdraw consent at any time, where consent was the basis
• Not be subject to a decision made solely by automated means. No such decisions are made here.

To exercise any of these, write to [email protected]. There is no charge, and you will get a reply within one calendar month.

Complaining

If you are unhappy with how your data has been handled, please raise it directly first. You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint, or by telephone on 0303 123 1113.

Changes to this notice

This notice may be updated. The version number and date at the top of the page show when it last changed. Where a change materially affects you, you will be told directly.