Privacy policy

Version 0.2, prepared 9 October 2026.

This policy describes how information is handled. Nothing here binds you by your reading it: the terms for a project take effect when you accept its written scope and price, and the version cited in that acceptance is the one that governs your project. Please ask about any part of them before you accept anything.

Who is responsible for your information

The data controller is Alexander Watson, a sole trader, trading as Alexander Watson Studio, of [business address]. Contact: hello@alexanderwatson.co.uk. [Confirm whether ICO registration is required and, if so, add the registration number.] ⚖

I aim to collect as little personal information as possible, and to be specific about what happens to it. Your information is never sold, and it is never shared with third parties for marketing.

Information about your own therapy clients

I do not need, want or ask for any information about the people you work with. Please do not send client names, session notes, case material, referral details, correspondence or health information: not in your website copy, not in screenshots, not in testimonials, not in the Practice Discovery questionnaire, and not in anything you email me or put in a folder you share with me.

If identifiable client information reaches me by accident, I will tell you, delete it and confirm that I have done so. Where you want to publish a client's words, that person's clear, informed and recorded consent is your responsibility to obtain and to hold.

What is collected, and why

1. Enquiries

If you use one of the enquiry forms or email me, you provide your name, email address and whatever you choose to tell me about your practice: on the main enquiry form at /contact/, a few lines about your practice and, if you add them, your current website and any questions about the website; on the smaller-work enquiry form at /other-services/enquiry/, what you need help with and anything optional you add.

Both forms send what you type to me through Netlify Forms. Netlify, Inc. hosts this website and operates that form service as my processor, on the terms described under Practice Discovery below. I use what you send only to reply to you, and delete it from Netlify once I have copied it into my own records. Netlify checks every form submission for spam using Akismet, a spam-detection service, so what you send may be passed to it for that check. If you would rather not use a form, email me instead. ⚖

Lawful basis: your consent, and my legitimate interest in responding to people who contact my business.

2. Payment

There is no checkout on this website, and no card payment of any kind. When you have agreed the scope and the price for a Practice Identity & Website in writing, I send you an invoice and you pay it by bank transfer.

To raise the invoice I ask you for the name it should be made out to, a billing address, and an email address to send it to. That is all the billing information I hold.
No card details are involved at any point. None are entered on this website, none are sent to me, and I never see or store any.
The transfer itself passes between your bank and the Studio's bank. Your bank and mine each hold the information a payment carries (your name, the amount, the date and the reference) as independent controllers under their own regulatory obligations and their own privacy notices, not on my instructions.
I keep the invoice, and the record of what was paid and when, as a business record. Everything else I hold about your project came from you directly, by email or through the Practice Discovery questionnaire.

Lawful basis: performance of our contract; and my legal obligation to keep accurate financial records.

3. The Practice Discovery questionnaire

Once your place is reserved, I send you a link to Practice Discovery, a questionnaire on this website. It collects the written answers you choose to give about your practice and your work. Most questions are optional; nine questions are required, together with the final confirmation before submission.

The questionnaire submits the answers you enter. Netlify may also process ordinary technical information, such as an IP address, when operating and securing the service, as described under hosting below.

No files are uploaded through the questionnaire. It has no upload field of any kind. If you want me to see a logo, photographs or documents, you share a folder link (Google Drive, Dropbox or WeTransfer) or email the files to me. Files sent that way are handled by whichever email or file-sharing provider you choose for that transfer, under that provider’s own terms, and they do not pass through Netlify Forms. The sharing link itself is part of your written response, so Netlify does store the link.

The questionnaire is built into this website, and the answers you submit are received and stored by Netlify, Inc., which hosts this site and operates its form service as my processor, on my instructions, and for no purpose of its own. [Confirm that Netlify's Data Processing Addendum has been read and applies to this account, and record the plan and the account name.] Netlify, Inc. is based in the United States. Netlify’s privacy statement says personal data may be transferred to and stored outside the country in which it was collected. Your Practice Discovery answers may therefore be processed outside the United Kingdom.

Netlify’s Data Processing Addendum, which forms part of its subscription terms, governs that processing and sets out the transfer arrangements in a defined order. Where the UK Extension to the EU–US Data Privacy Framework applies, the transfer takes place under that Extension. If it is unavailable, invalid or Netlify fails to re-certify, Netlify’s Data Processing Addendum provides for the Standard Contractual Clauses amended by the UK International Data Transfer Addendum. I am describing the arrangement Netlify states, not offering a view on whether it is legally sufficient. Netlify sets out what it does in its own words in its privacy notice and its data processing documents. ⚖

I use your answers only to create and support your Practice Fundamentals and website, and I copy them into my own project files. Netlify’s Forms documentation does not state an automatic deletion schedule for form responses. Responses remain available until I delete them, so deleting them is my responsibility rather than something that happens on its own. [Confirm the period actually operated before Practice Discovery responses are deleted from Netlify, e.g. deleted once copied into the project files, and in any event at launch.] ⚖

The questionnaire asks about your practice and your work, not your health. Please do not share information about your own health unless you want it taken into account, and do not send client names, session notes, case material or anything else about the people you work with: not in the questionnaire, not in a folder you share with me, and not by email.

Lawful basis: performance of our contract.

4. Contract and project administration

During a project I hold our correspondence, your approvals, the scope and terms in force, drafts and feedback, and the files you supplied. This is how the project is run and how either of us can later show what was agreed.

Lawful basis: performance of our contract; and my legitimate interest in keeping a record of what was agreed and delivered.

5. Payment and accounting records

Invoices, receipts, and the record of what was paid and when are kept as business records.

Lawful basis: legal obligation (tax and company record keeping).

Who else handles your information

I use a small number of established suppliers to run the studio. They handle your information on my instructions, or as independent controllers where they are named as such.

The Studio's bank: [name the bank that receives client payments] (independent controller for payment information, under its own privacy notice). ⚖
Netlify, Inc.: hosting of this website, and the form service that receives enquiries sent through this website's forms and your written answers to the Practice Discovery questionnaire, on my instructions (processor). Its servers also produce ordinary technical information, including IP addresses, in ordinary logs kept for security and reliability. Netlify, Inc. is based in the United States, and its privacy statement says personal data may be transferred to and stored outside the country in which it was collected, so this information may be processed outside the UK, under its Data Processing Addendum and the transfer arrangements set out below. [Confirm that Netlify's Data Processing Addendum has been read and applies to this account, and record the plan and the account name.] ⚖
Email and file storage: [name the email provider and any file-sharing or cloud storage service actually used, e.g. Google Workspace, Microsoft 365, Dropbox]. ⚖
Accounting: [name the bookkeeping or accounting software or accountant, if any].

Information is otherwise disclosed only where the law requires it, or where it is necessary to establish or defend a legal claim.

Where your information is held

Information is held in the United Kingdom and the European Economic Area where possible. Some suppliers are international and may transfer information outside the UK. Where that happens, the transfer relies on the safeguards those suppliers put in place, such as the UK Extension to the EU–US Data Privacy Framework, or the European Commission’s Standard Contractual Clauses with the UK International Data Transfer Addendum.

One supplier is worth naming plainly. Netlify, Inc., which hosts this website and receives your Practice Discovery answers, is based in the United States. Netlify’s privacy statement says personal data may be transferred to and stored outside the country in which it was collected. Your Practice Discovery answers may therefore be processed outside the United Kingdom. Where the UK Extension to the EU–US Data Privacy Framework applies, the transfer takes place under that Extension. If it is unavailable, invalid or Netlify fails to re-certify, Netlify’s Data Processing Addendum provides for the Standard Contractual Clauses amended by the UK International Data Transfer Addendum. If you would rather not send something through the questionnaire, email it to me instead. [Confirm the actual transfer mechanism for each supplier named above.] ⚖

How long information is kept

Enquiries that do not become projects, from either enquiry form once copied out of Netlify, or sent by email: kept while a reply is useful, then deleted. [Confirm the period actually operated, e.g. 12 months.]
Practice Discovery answers held by Netlify: written answers only; no files are uploaded through the questionnaire. Netlify’s Forms documentation does not state an automatic deletion schedule, and responses remain available until I delete them, which I do once they have been copied into the project files. [Confirm the period actually operated before Practice Discovery responses are deleted from Netlify, e.g. deleted once copied into the project files, and in any event at launch.]
Project files and correspondence: kept for the life of the project and for a reasonable period afterwards so the website can be supported. [Confirm the period, e.g. 6 years from the end of the project, to match the limitation period.]
Payment and accounting records: kept for as long as tax law requires. [Confirm the statutory record-keeping period that applies to the business's legal form.]

⚖

Security

Accounts are protected with strong, unique passwords and two-factor authentication where the supplier offers it. Devices are encrypted and kept up to date. Access to project files is limited to me and to any specialist brought in for a specific piece of work, who is told what they may and may not see. [Confirm the security measures actually in place before publication; do not describe controls that are not operated.] ⚖

Cookies and analytics

This website sets no cookies of its own, and uses no advertising and no cross-site tracking, on any page. It offers one optional thing: Google Analytics.

Why. I am one person deciding what to write next and where to spend my time. Analytics tells me which pages people actually read, how long the longer articles hold somebody, and whether visitors arrive from a search, a directory or a link somebody sent. Without it I am guessing.

What is measured. Pages viewed and the order they are viewed in, roughly how long a page is open, which of a few named links are selected (such as the enquiry and “See the work” links), whether an enquiry form was sent (that one was sent, never what it said), the approximate part of the country or the world a visit comes from, and the kind of device and browser. Google is not given your name, your email address or your precise location, and nothing you type on this site is ever measured: not the enquiry form, not the Practice Discovery questionnaire, not a single field. Google Analytics is used for measurement only. It is not connected to any advertising product, no audience or remarketing list is built from it, and nothing about you is sold or shared for marketing.

It is optional, and it is off until you say otherwise. On your first visit a short notice asks whether you are willing; on a phone it appears once you begin to scroll, so that it does not cover the opening of the page. Until you answer it, and forever if you answer no, this site requests nothing from Google, sets no analytics cookie and reports no visit. Nothing about the site works differently either way, and there is nothing you cannot read or do because you declined.

If you allow it, Google Analytics sets cookies in your browser (their names begin _ga) which let it recognise a repeat visit without knowing who you are. They last up to two years. Your answer itself is not a cookie: it is a single word kept in your browser's local storage, so that you are asked once rather than on every page. If you have allowed analytics and you send one of the enquiry forms, a short note is also kept in your browser's session storage so that the confirmation page can count the enquiry once. It holds the form's name and the time, never what you wrote, and it is removed when it is counted or when you close the tab.

Changing your mind. At the bottom of every page, beside the Privacy and Terms links, there is a small control showing your current choice. Select it to change your answer at any time. Turning analytics off also deletes the Google Analytics cookies already in your browser, so declining removes what allowing created rather than only stopping more of it. Clearing your browser's site data has the same effect, and means you will be asked again on your next visit.

Google Analytics is provided by Google, who process this information on my behalf and may do so outside the UK. Their own explanation of what the service collects is published at policies.google.com/technologies/partner-sites.

External websites

Some pages link to other websites: YouTube, LinkedIn, Instagram. Those websites have their own privacy policies, which are outside my control.

Your rights

You can ask me to:

give you a copy of the personal information I hold about you;
correct it, if it is wrong;
delete it, where there is no longer a lawful reason to keep it;
restrict or object to a particular use of it;
provide it in a portable format, where that right applies;
withdraw consent, where consent is the basis being relied on.

Email hello@alexanderwatson.co.uk and I will respond within one month. There is no charge for a reasonable request.

Complaints

If you are unhappy with how your information has been handled, please tell me first so I can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk, or by telephone on 0303 123 1113.

Contact

hello@alexanderwatson.co.uk

Version 0.2, prepared 9 October 2026. Written by the Studio in plain English; not reviewed by a solicitor. The version cited in your written acceptance governs your project. Superseded versions are kept for reference.