Privacy

Privacy
Notice

This notice explains what happens to your personal information when you contact me through this site, book a call with me, register for a session of The Small Print, or hear from me about my work.

Who is responsible

I am. That is Hugh O'Keeffe, an independent disability, access and inclusion consultant working as a sole trader in London. Under UK data protection law I am the data controller for the information described here, and I am registered with the Information Commissioner's Office.

You can reach me at hugh@hughokeeffe.com. My postal address is OK Talk, Office 22178, 182-184 High Street North, East Ham, London E6 2JA.

The contact form

When you use the contact form, I receive your name, your email address, your message, and your organisation if you choose to give it. The form service also records when you sent it and technical details your browser sends, including your IP address, which is used to filter out spam.

I use what you send me to reply and to continue the conversation. If your enquiry touches on work I offer, I may also follow up about that, as explained under contacting organisations about my work. My lawful basis is legitimate interests under Article 6(1)(f) of the UK GDPR, because you have chosen to contact me and I need your details to answer. If we go on to work together, I rely on Article 6(1)(b), because processing is necessary for a contract with you or to take steps before one.

Please do not send details of a health condition or a diagnosis through the form. If something like that is relevant, describe it in general terms and we can find a more secure route.

Booking a call

Booking is handled by Calendly. Nothing from Calendly, including its cookies, runs on this site until you press the button that loads it. If you book, you give Calendly your name, your email address and whatever you write in its booking form, and Calendly passes that to me. If you would rather not use it, email me and I will arrange a time directly.

Cookies and analytics

This site sets no cookies. To understand which pages are useful and how people find The Small Print, I use Plausible Analytics. It counts visits without cookies and without building a profile of you. It records the page you visited, the site that sent you there, the campaign tags in the link you followed, your browser and operating system, your type of device, your approximate location down to the town or city, and how far down the page you read. It also counts a few actions, such as opening the booking calendar, clicking a link to another site or sending the contact form, but never what you type into the form. Your IP address is used only to produce a daily count of visitors and is never stored. I only ever see totals.

My lawful basis is legitimate interests. I need to know which pages and sessions are worth the time, and the information cannot be used to identify you.

If you would rather not be counted, the button below stops this browser from being counted. It saves a single setting in your browser so it remembers your choice. A content blocker will also stop the script.

With JavaScript switched off the button cannot work, so use a content blocker to stop the count instead.

If you use the Reduce motion switch at the bottom of any page, your browser saves that choice. It stays on your device and is never sent to me. Netlify keeps ordinary server logs for security and reliability, and fonts are served from this domain.

Emails I send from HubSpot, or from my mailbox with HubSpot connected, do not track whether you have opened them or which links you click. Links to my website may carry a campaign tag so Plausible can count, in total and without identifying anyone, which emails bring people to the site.

The Small Print sessions and email

I run The Small Print, a free monthly online session. If you register, you give Luma your name and email address, and your organisation and role if you choose to share them. Luma passes these to me so I can send you the joining link, a reminder, and afterwards the recording with captions and the slides, plus a transcript if you ask for one when you register. My lawful basis is Article 6(1)(b) of the UK GDPR, because you have asked to attend.

If you register through a link I have shared, for example a LinkedIn post or a partner's newsletter, Luma records which link it was, and I ask how you heard about the session. I use this to see which ways of sharing the sessions work, on the basis of legitimate interests.

Your organisation and role help me understand who the sessions reach and what to cover next. If you tell me about a situation you would like covered, I will only use it in a way that does not identify anyone, and I may email you about it. Please leave out names or anything else that would identify someone.

I keep a short record of how you took part in each session, such as whether you attended, sent in a situation, asked a question or joined in the chat. I note the topic and leave out the detail of what you said. This helps me understand what is useful to you and what to write to you about. I rely on legitimate interests for this, and you can ask me to stop at any time.

If you tell me about access requirements that relate to your health or a disability, that is special category information. I rely on your explicit consent under Article 9(2)(a), I use it only to make the adjustments you have asked for, and I delete it once the session has happened. It never goes into my contact records. Claude may help me plan the adjustments, and my task list records only the adjustment itself, such as sending slides early.

If you register with a work email address, I will email you now and then about future sessions, my writing and how I could help your organisation. I tell you this when you register, and every email has a one-click unsubscribe. I rely on legitimate interests for this, and you can say no at any time. I treat an address at a company, public body or other organisation with its own legal identity as a work address.

If you register with a personal address, or you work for yourself or in a partnership, there is one optional box, which is never ticked for you. Tick it and I will add you to my mailing list on the basis of your consent. If you leave it, you will only hear from me about the sessions you registered for, unless you write to me first.

If you registered before 23 October 2026, the boxes you saw then still apply. If you ticked a box, I email you about what you agreed to. If you did not, I will not add you to my mailing list, and I will only write to you about my work one to one, at a work address, when there is a real reason, as explained in the next section.

Some sessions may be run with a partner organisation. If so, the event page will say who the partner is and whether they receive your registration details.

The Margin

The Margin is a small paid working session. If you book, Luma takes your payment through Stripe and passes me your name, email address, organisation and role, and anything you tell me when you book. My lawful basis is Article 6(1)(b) of the UK GDPR, because you have booked a place. If your organisation pays by invoice, I keep the invoice details as business records.

Sessions of The Margin are not recorded. I don't write down anything said in the session that would identify someone.

Contacting organisations about my work

Sometimes I email people at organisations, one to one, about my work when it relates to their job. I only do this with work email addresses at companies, public bodies and other organisations with their own legal identity, and only when I have a real reason to think it is relevant to you, for example a session you came to, a referral from someone who knows us both, or a question you have asked me.

I rely on legitimate interests for this. Every email says who I am and how to say no, and if you do, I add your email address to my do-not-contact list. If you work for yourself or in a partnership, or I cannot tell what kind of organisation you work for, I treat your address like a personal one. I only email personal addresses about my work if you have agreed to hear about it or asked me about it yourself.

Where I get your details

Most of what I hold comes from you, through a session registration, my contact form, a booked call or an email. Sometimes it comes from someone else, for example a colleague who refers you to me, or the work details you have made public on your organisation's website or LinkedIn. When that happens I only keep your name, role, organisation, work email and how we were introduced, and I will tell you where I got your details the first time I am in touch.

My mailing list

My mailing list is in HubSpot. It sends invitations to new sessions of The Small Print, my writing, and now and then news of my work. Who is on it, and what they get, depends on how they joined, as explained under The Small Print sessions and email above. I record when and how you joined and what you were told. I do not add contact form enquiries or call bookings to it.

Every email has a link to unsubscribe, and you can also reply to say no. Unsubscribing takes you off the list straight away.

The Asterisk, my writing series, is also published on Substack. If you subscribe there, Substack runs that subscription under its own privacy notice, and I see your email address and whether you are subscribed.

Recordings

Sessions are recorded so people who could not attend can watch afterwards. Attendees join muted with cameras off, so you will not appear in the recording unless you choose to speak or turn your camera on, and I say so at the start of every session. If you do speak, your voice and the name you joined with may be captured.

When I read out questions from the Q&A, I leave out the name of the person who asked. Recordings go privately to the people who registered and are never published. They are transcribed, and I use Claude to help write a recap of each session for this site. Recaps do not name attendees or quote anyone's question.

The tools I use to run the business

I use Claude, an AI assistant made by Anthropic, to help me run my business. It helps me read and draft emails, plan my work, prepare sessions and write up recaps. To do that it can see personal information I already hold, such as enquiries, contact records, session registrations, session recordings and transcripts, and emails with clients.

I check everything it produces before it is used, and it does not make decisions about you. I have turned off the setting that lets Anthropic use my conversations to train its models.

I keep my contact records in HubSpot. They hold your name and work details, how we met, which sessions you have registered for and how you took part, what you have agreed to hear from me about and when, any opt-outs, and the emails we have exchanged. My working notes for client projects and sessions are in Notion, and my task list is in Sunsama, where I keep personal details to a minimum.

The lawful basis is the same as for the original information, whether that is contract, legitimate interests or your consent.

Who else handles it

These suppliers see your information because they run the tools I use.

  • Netlify hosts this site and receives contact form submissions. It stores data in the United States under standard contractual clauses with the UK addendum.
  • Google Workspace runs my email, calendar, documents and Google Meet, which hosts my sessions and stores their recordings.
  • HubSpot holds my contact records and the emails we exchange, and sends my mailing list. It stores data in its EU data centre. Where HubSpot staff or suppliers in the United States can access it, HubSpot relies on the UK Extension to the Data Privacy Framework or on standard contractual clauses with the UK addendum.
  • Luma runs registration for my sessions and sends the emails about them. It stores data in the United States under standard contractual clauses with the UK addendum.
  • Stripe processes card payments for The Margin through Luma, under its own privacy notice. I never see your card details.
  • Calendly runs call booking. It stores data in the United States under standard contractual clauses with the UK addendum.
  • Substack publishes The Asterisk to people who subscribe there. It stores data in the United States and handles your information under its own privacy notice.
  • Plausible Analytics counts visits to this site. It is based in the EU, keeps its data there, processes it only on my behalf, and never receives your name or email address.
  • Anthropic makes Claude, as explained under the tools I use to run the business. It stores data in the United States under standard contractual clauses.
  • Notion holds my working notes. It stores data in the United States under standard contractual clauses.
  • Sunsama holds my task list. It stores data in the United States under standard contractual clauses with the UK addendum.

Luma, Calendly and Substack also run their own accounts, and their own privacy notices apply to anything you do with them directly. I do not sell, rent or share your information with anyone else, and I will only disclose it if the law requires me to.

How long I keep things

Enquiries that do not lead to work are deleted after twelve months, from the form service, my mailbox, my contact records and my notes.

Where we go on to work together, the records become client and business records. I keep those for six years after the end of the financial year they relate to, which is what UK tax and accounting rules require.

Session registration details, including any copies in my contact records, notes and task list, are deleted twenty-four months after the last session you registered for. If you are on my mailing list, I keep your name and email address until you unsubscribe.

Contact records for people I have been in touch with about my work are deleted twenty-four months after we were last in touch, unless we are working together. Recordings are deleted twelve months after the session.

If you unsubscribe or ask me not to contact you, I keep only your email address on a do-not-contact list for as long as I run the business, so I never contact you again by mistake.

Your rights

Under UK data protection law you have the right to ask me for a copy of the personal information I hold about you, to have it corrected if it is wrong, to have it deleted, to restrict what I do with it, to object to my processing it on the basis of legitimate interests, to object to direct marketing at any time and for any reason, and to receive it in a portable format. Where I rely on your consent, you can withdraw it at any time.

Email me at hugh@hughokeeffe.com to use any of these, or reply to any email from me to stop hearing about my work. I will reply within one calendar month and there is no charge. I may ask you to confirm who you are before I release anything.

Complaining

If you are unhappy with how I have handled your information, please tell me first so that I have a chance to put it right. You also have the right to complain to the Information Commissioner's Office at any time.

This notice was last updated on 2 November 2026. If it changes in a way that matters, I will update this date.