This policy explains what personal data Paul Myers collects, why, how it’s used and kept safe, and the rights you have over it. It’s written to be read, so if anything isn’t clear, get in touch and I’ll explain.
Last updated: 2 November 2026
Who’s responsible for your data
Paul Myers is a sole trader. For the purposes of UK data protection law, Paul Myers is the data controller for the personal data described in this policy.
- Address: Liverpool Innovation Park, 360 Edge Lane, Liverpool L7 9NJ
- Email:
What data I collect
When you get in touch or request a free assessment: your name, email address, website, and anything you choose to tell me in the form, such as what you need help with, your goals, timing and budget range.
When you book a call: your name, email address, the time you choose and any notes you add.
When you message on WhatsApp: your phone number, name as shown in WhatsApp, and the messages you send.
When you use the free tools: nothing. The tools run inside your browser, so the files and addresses you put into them stay on your own computer and are never sent to me.
When you visit the site: the standard information any web server records to serve a page, such as your IP address, browser and the page requested.
When you sign up for the newsletter: your email address, your first name if you give it, and the record that proves you agreed: the exact wording you ticked, the date and time, the page you signed up from and the IP address you signed up with. That record exists because the law expects me to be able to show consent was given, not assumed. Nothing is sent until you click the confirmation link in the first email, and every email after that carries a one-click unsubscribe.
When you agree to analytics: Google Analytics records the pages you view, roughly where you are from an anonymised IP address, your device and browser, and how you arrived. It runs only if you accept the cookie choice, and until you do it stores nothing on your device. The cookie policy covers the cookies themselves.
One thing is described here but isn’t running yet, so that this policy is ready when it is: the SEO checker’s emailed report (name and email address, with your consent to follow up).
When you become a client: contact and billing details, and access to business data such as Google Search Console, Google Analytics and Google Ads. Client data is covered by the terms we agree, as well as this policy.
How I use your data, and the legal basis
| Purpose | Legal basis |
|---|---|
| Replying to enquiries, assessment requests and messages | Legitimate interests: responding to people who contact me |
| Arranging and holding calls | Legitimate interests, or steps before entering a contract |
| Delivering the free assessment or checker report | Legitimate interests, or consent where you’ve given it |
| Sending the newsletter, and keeping the record of that consent | Consent, which you can withdraw from any email or by emailing me |
| Following up after a checker report | Consent |
| Providing services to clients, invoicing and record keeping | Contract, and legal obligation for financial records |
| Analytics to see which pages are worth keeping | Consent, given through the cookie choice and withdrawable from the footer |
| Preventing spam and abuse of forms and tools | Legitimate interests: keeping the site and tools secure |
I don’t sell your data, and I don’t use it for automated decisions that have legal or similarly significant effects on you.
Who I share data with
I don’t sell, rent or share your data for anyone else’s marketing. It’s only handled by the services I use to run the site and reply to you, each under its own terms requiring it to be protected, and only for the purposes below.
| Service | What it handles | Why |
|---|---|---|
| Hostinger | Website hosting, the site database and the mailbox | Runs the site and stores enquiries |
| Google (Gmail) | Receives a forwarded copy of enquiry emails, and sends my replies | So I can read and answer you |
| Google (Calendar appointment scheduling) | The booking page on the contact page, if you book a call: your name, email and anything you write in the booking form | Arranges the call and sends the invitation |
| Google Analytics | Pages viewed, device, anonymised IP and referrer, but only once you accept | Shows me which pages are worth keeping |
| Cloudflare (cdnjs) and jsDelivr | Serve the code libraries the free tools need, which means they receive your IP address on those pages | Makes the tools work |
| Meta (WhatsApp) | Only if you choose to message me there, under WhatsApp’s own privacy terms | Lets you reach me informally |
Two things worth being clear about. The free tools do their work inside your own browser: the files you load into them are never uploaded to me or to anyone else. The newsletter carries no open or click tracking, and analytics runs on the site only for people who accept it. If I add analytics later, this policy is updated first and it will only run with your consent.
Data may also be shared if the law requires it, or with an accountant for invoicing once you become a client.
International transfers
Some of the services above are based outside the UK, so your data may be processed abroad.
Hosting and email run on Hostinger’s servers in the European Economic Area, which UK law recognises as offering equivalent protection, so no extra safeguard is needed. Google and Meta are United States companies, and their transfers rely on the UK Extension to the EU to US Data Privacy Framework, backed by standard contractual clauses and the UK International Data Transfer Addendum where that applies.
In practice, what leaves the UK is small: your enquiry once it reaches Gmail, your booking details if you book a call, your message if you use WhatsApp, and the IP address your browser shares with the code libraries the free tools load.
How long data is kept
Data is kept only as long as it’s needed:
| Data | How long it’s kept |
|---|---|
| Enquiries that don’t lead to work | Up to 12 months after the last contact |
| Newsletter subscribers | Until you unsubscribe, then the record of your consent and unsubscribe is kept for 12 months as proof I acted on it |
| Client project data and access to your tools | Up to three months after the work ends, with no personally identifiable data retained |
| Client records and invoices | Six years after the end of the tax year they relate to, for legal and tax reasons |
| Analytics data | 14 months, the shortest retention Google offers for these reports |
| Enquiries stored on the site itself | Alongside the email copy, deleted on the same schedule |
Your rights
Under UK data protection law you have the right to:
- ask for a copy of the personal data I hold about you
- ask for inaccurate data to be corrected
- ask for your data to be deleted
- object to processing based on legitimate interests
- ask for processing to be restricted
- withdraw consent at any time, where processing is based on consent
- ask for your data in a portable format, where that applies
To use any of these rights, email . I’ll respond within one month. There’s no charge in most cases.
How your data is protected
Access to personal data is limited to what’s needed, accounts are protected with strong passwords and two-factor authentication where available, and data is held with reputable providers. Client platform access is read-only wherever that’s enough to do the work.
AI tools
Some work uses AI tools to help analyse data and draft documents. How that works, and what they never do, is set out in the AI use statement.
Complaints
If you’re unhappy with how your data has been handled, please contact me first so I can put it right. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk.
Changes to this policy
If this policy changes, the updated version will be published here with a new date.