Scope
[Counsel to complete: who this policy covers (website visitors, prospects, clients) and which entity is the data controller, including registered address.]
What we collect
This section must describe, accurately and specifically:
- Analytics data — pending the analytics decision (PRD D6). If a cookieless tool is used, state that no cookies are set and no consent banner is required. If GA4 is used, cookies and a consent banner become mandatory and must be described here.
- Scheduler data — the name, email, and any details a visitor submits when booking a workflow review through the third-party scheduler.
- Newsletter email — only if the optional newsletter capture ships (PRD D7).
[Counsel to complete: confirm the final list and remove anything not actually collected.]
Lawful basis
[Counsel to complete: the lawful basis for each processing purpose — legitimate interest, consent, or contract — per applicable law (UK/EU GDPR, and any US state privacy laws that apply).]
Retention
[Counsel to complete: how long each category of data is kept, and the deletion process at the end of that period.]
Third-party processors
The following third parties process data on our behalf. [Counsel to confirm the final list and add each processor’s role and location before publication.]
- Scheduler — the booking provider (PRD D1)
- Analytics provider (PRD D6)
- Website host and CDN
- Email provider
Your rights
[Counsel to complete: access, rectification, erasure, restriction, portability, objection, and how to exercise them — including response timeframes.]
Contact
[Counsel to confirm the privacy contact address (PRD D8) and, where required, a data protection representative.]