Privacy
Privacy
Notice
This notice explains what happens to your personal information when you contact me through this site, book a call with me, or register for one of my webinars. It is short because I do very little with your data.
Who is responsible
I am. That is Hugh O'Keeffe, an independent disability, access and inclusion consultant working as a sole trader in London. Under UK data protection law I am the data controller for the information described here.
I am registered with the Information Commissioner's Office.
You can reach me at hugh@hughokeeffe.com. If you need a postal address for a formal request, ask and I will give you one.
What the contact form collects
When you use the contact form on the home page, I receive your name, your email address, your message, and your organisation if you choose to give it. The organisation field is optional and the form works perfectly well without it.
The form service also records the date and time of your submission along with technical information your browser sends, including your IP address, which is used to filter out automated spam.
Why I hold it and my lawful basis
I use what you send me to read your enquiry, reply to it, and continue the conversation if there is one to have. That is all.
My lawful basis is legitimate interests under Article 6(1)(f) of the UK GDPR. The interest is a simple one. You have chosen to contact me, and I need your details in order to answer you. If an enquiry becomes paid work, I then rely on Article 6(1)(b), because processing is necessary to perform a contract with you or to take steps before entering into one.
Please do not send special category information through the form, such as details of a health condition or a diagnosis. If something like that is relevant to what you want to discuss, describe it in general terms and we can find a more secure route.
Who else handles it
These suppliers see your information because they run the tools I use.
- Netlify hosts this site and receives the contact form submissions. Netlify stores them on infrastructure in the United States. That transfer is covered by the standard contractual clauses and UK addendum in Netlify's data processing agreement.
- Google Workspace runs my email, so a copy of your message and of my reply sits in my mailbox. It also runs Google Meet, which hosts my webinars and stores their recordings.
- Luma runs registration for my webinars and sends the emails about them. Luma stores data in the United States. That transfer is covered by the standard contractual clauses and UK addendum in Luma's data processing addendum.
I do not sell, rent or share your information with anyone else, and I will only disclose it if the law requires me to.
Booking a call
Booking is handled by Calendly. Nothing from Calendly runs on this site until you press the button that loads it, and that includes its cookies. If you never open the calendar, Calendly never learns that you were here.
If you do book, you give Calendly your name, your email address and whatever you write in its booking form, and Calendly passes that back to me. Calendly stores its data in the United States and relies on the standard contractual clauses and UK addendum. Its own notice is at calendly.com/legal/privacy-notice (opens in new tab).
If you would rather not use it, email me and I will arrange a time directly.
Cookies and analytics
This site sets no cookies and runs no analytics, no tag manager and no advertising code. Nobody is tracking you here, and there is no consent banner because there is nothing to consent to. Fonts are served from this domain rather than from a font network.
Netlify keeps ordinary server logs for security and reliability, as any host does.
Webinars and email
I run free online webinars. If you register for one, you give Luma your name and your email address, and your organisation and role if you choose to share them. Luma passes these to me so I can send you the joining link, a reminder, and the recording if you ask for it.
My lawful basis for this is Article 6(1)(b) of the UK GDPR, because you have asked to attend and I need your details to let you in.
If you tell me about access requirements, whether on the registration form or by email, and what you tell me relates to your health or a disability, that is special category information. I use it only to make the session work for you, I rely on your explicit consent under Article 9(2)(a) to do so, and I delete it once the session has happened.
When you register you can also tick a box to hear about future sessions and occasional writing. That is separate and entirely optional. If you register without ticking it, you will only hear from me about the session you signed up for. If you do tick it, my lawful basis is your consent, and you can withdraw it at any time. Every one of those emails carries an unsubscribe link, and unsubscribing takes effect straight away. I do not add contact form enquiries or call bookings to this list.
Luma also runs its own accounts and apps. If you sign in to Luma or use it for anything beyond registering for my session, Luma handles that information itself under its own notice at luma.com/privacy-policy (opens in new tab).
Recordings
Sessions are recorded so people who could not attend can watch afterwards. Attendees join muted with cameras off, so you will not appear in the recording unless you choose to speak or turn your camera on, and I say so at the start of every session. If you do speak, your voice and the name you joined with may be captured.
When I read out questions from the Q&A, I leave out the name of the person who asked. I do not publish recordings. If you registered for a session, you can ask me for its recording and I will send you a private link.
How long I keep things
Enquiries that do not lead to work are kept for twelve months and then deleted from both the form service and my mailbox. Twelve months gives a conversation that went quiet a fair chance to restart.
Where an enquiry does become paid work, the records become client and business records. I keep those for six years after the end of the financial year they relate to, which is what UK tax and accounting rules require.
Webinar registration details are kept for twenty-four months after the last session you registered for, and then deleted. If you have opted in to hear about future sessions, I keep your name and email address until you unsubscribe. After that I keep only your email address on a do-not-contact list, so that I never add you again by mistake.
Recordings are kept for twelve months after the session and then deleted.
Your rights
Under UK data protection law you have the right to ask me for a copy of the personal information I hold about you, to have it corrected if it is wrong, to have it deleted, to restrict what I do with it, to object to my processing it on the basis of legitimate interests, and to receive it in a portable format. Where I rely on your consent, you can withdraw it at any time.
Email me at hugh@hughokeeffe.com to use any of these. I will reply within one calendar month and there is no charge. I may ask you to confirm who you are before I release anything.
Complaining
If you are unhappy with how I have handled your information, please tell me first so that I have a chance to put it right. You also have the right to complain to the Information Commissioner's Office at any time.
- Online at ico.org.uk/make-a-complaint (opens in new tab)
- By telephone on 0303 123 1113
- By post to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Links to other sites
Where this site links out to writing published elsewhere, or to LinkedIn or Substack, those services are run by other organisations and their own privacy notices apply once you arrive there.