TOLD customer privacy notice

What information I collect, use, and why

I collect and use personal information so that I can provide personal history and life‑story services, run my business, and keep in touch with people who are interested in my work.

Whose information I process

Depending on the project, I may collect information about:

• The client who commissions the project (for example, an adult child).
• The main storyteller whose life story is being recorded (for example, a parent or grandparent).
• Other family members or people mentioned in the story, where their names and details come up naturally in conversation.

Information I use to provide services and goods

To plan, deliver and complete interviews, transcripts, written stories and books, I may collect and use:

• Names and contact details (for example, email addresses and phone numbers).
• Postal addresses for in‑person visits or delivery of printed work.
• Payment details (including bank information or card details processed via payment providers).
• Audio recordings of interviews.
• Interview transcripts and notes.
• Written life‑story materials, drafts and final texts.
• Family documents, photographs and other materials you choose to share for the project.
• Biographical details, memories and personal stories shared during interviews.

Some of this information may be special category data, which is more sensitive and receives extra protection under data protection law. This can include:

• Racial or ethnic origin.
• Political opinions.
• Religious or philosophical beliefs.
• Health information.

I collect and use this kind of information only where it is part of the story you choose to tell and it is genuinely needed for the project. For special category data, I normally rely on explicit consent under Article 9(2)(a) UK GDPR.

Information I use for service updates and marketing

To respond to enquiries and keep in touch with people about my services, I may collect and use:

• Names and contact details.
• Marketing preferences (for example, whether you want to receive updates).
• Purchase or service history (for example, what kind of project you commissioned).
• IP addresses and basic website usage information, such as pages visited and how you found the site.

I may use this information to:

• Reply to messages and enquiries.
• Follow up with people who have asked about my services.
• Send occasional updates about my services, where this is appropriate and legally allowed.
• Improve the website and understand which pages people find useful.

You can ask me to stop sending you marketing messages at any time by using an unsubscribe link (where available) or contacting me directly.

I do not sell your personal information or give it to other organisations for their own marketing.

Information I use to comply with the law and handle queries

To meet legal, tax and accounting requirements, and to deal with queries, complaints or claims, I may collect and use:

• Names and contact information.
• Financial transaction information (for example, invoices and payment records).
• Project records and correspondence.
• Any other personal information reasonably needed to understand and resolve an issue or comply with legal obligations.

Working with freelancers and trusted partners

For some projects I may work with trusted freelancers and service providers, such as transcribers, designers, typesetters, printers or other specialists. They only receive the information they need for their part of the work and are required to keep it confidential. I will only involve such partners where this is necessary for the project and in line with what has been agreed with you.

I will only use identifiable interview content, photographs, excerpts from your story or finished work in public materials (for example, on my website or social media) if you have given clear permission and only in the way we have agreed.

Cookies and website analytics

When you visit my website, basic technical information is collected automatically so the site can function properly and so I can understand how it is used.

I use Google Analytics to get anonymised statistics about website visitors, such as which pages are visited, approximate location (for example, city or region), device and browser type, and how people arrived at the site. Google Analytics uses cookies and similar technologies to do this. I also use tools such as Google Search Console and Bing Webmaster Tools to understand how the site appears in search results and to manage technical issues; these tools mainly receive technical and usage information about visits to the site.

This information helps me improve the website and make it more useful. It is not used to build detailed profiles of individual visitors. You can control or delete cookies through your browser settings, and you can use the tools provided by Google to opt out of Google Analytics if you prefer.

Lawful bases and your data protection rights

Under UK data protection law, I must have a lawful basis for collecting and using your personal information. The lawful basis I rely on can affect which data protection rights apply in a given situation.

You can read more about lawful bases and your rights on the Information Commissioner’s Office (ICO) website, but this section gives a short overview and explains how I apply them in my work.

My lawful bases

Depending on the context, I may rely on one or more of the following lawful bases:

• Consent – you have given clear permission for me to use your personal information for a specific purpose after I have explained what that involves.
• Contract – I need to use your personal information to enter into or carry out a contract with you (for example, to deliver a personal history project you have commissioned).
• Legitimate interests – I use your information because it is necessary for my legitimate business interests or those of someone else, and because it does not override your rights or cause an undue risk of harm.
• Legal obligation – I must use a certain amount of information to comply with the law (for example, tax and accounting rules).

For special category data (for example, information about your health, religion, political opinions or ethnic origin), I normally rely on your explicit consent.

Providing services and goods

When I collect and use personal information to plan and deliver interviews, transcripts, written work and printed books, I usually rely on:

• Contract – I need to use the information to agree and deliver the project.
• Consent – especially where the information is particularly sensitive or where you choose to share special category information.
• Legitimate interests – for example, to organise the project, keep notes, manage files and maintain a record of what was agreed, in a way that benefits both you and my business.

For special category information within your story, I rely on explicit consent unless there is a clear and limited alternative that the law allows.

Service updates and marketing

When I use contact details and preferences to respond to enquiries or send service updates and occasional marketing, I rely on:

• Consent – for example, where you have asked to receive updates or agreed to be contacted about future services.
• Legitimate interests – for example, replying to an enquiry you have sent, or sending a small number of relevant messages that you would reasonably expect, where this is legally permitted.

You can withdraw your consent to marketing or ask me to stop sending marketing messages at any time by using an unsubscribe option (where available) or by contacting me using the details at the top of this notice.

I do not use interview content, private family materials or special category information for marketing unless you have given separate, clear permission.

Legal requirements

When I keep records to comply with the law, such as tax and accounting rules, I rely on:

• Legal obligation – for example, keeping invoices and basic transaction records for the periods required by law.

I may also rely on legitimate interests to keep relevant records so that I can manage my business properly, answer later questions about past work, and protect my position if a legal or financial issue arises.

Queries, complaints and claims

When I use information to respond to questions, handle complaints or deal with potential claims, I rely on:

• Contract – where the matter relates to a project or service I have agreed to provide.
• Legitimate interests – for example, to investigate what happened, respond fairly, resolve disputes and keep evidence where this is necessary.

Your data protection rights

You have a number of rights over your personal information. These include:

• Right of access – to ask for copies of your personal information and for information about how I use it.
• Right to rectification – to ask me to correct or complete information you think is inaccurate or incomplete.
• Right to erasure – to ask me to delete your personal information in certain circumstances.
• Right to restrict processing – to ask me to limit how I use your information in certain situations.
• Right to object – to object to certain types of processing, including some marketing, where I rely on legitimate interests.
• Right to data portability – to ask me to transfer the information you have given me to you or to another organisation in a structured, commonly used and machine‑readable format, where the law applies.
• Right to withdraw consent – where I rely on consent, you can withdraw it at any time.

These rights are not absolute and may be subject to certain conditions and exemptions in the law. If you make a request, I will respond without undue delay and in any event within one month, unless the law allows extra time for complex requests.

I may ask you for proof of identity and enough information to help me find your personal data, so that I can respond securely and efficiently.

To exercise any of these rights, please contact me using the details at the top of this privacy notice.

Where I get personal information from

I mainly collect personal information directly from you – for example when you contact me, book a consultation, take part in an interview, send me documents or photographs, or commission a project.

I may also receive information from:

• Family members and clients who commission a project and provide background details, photographs, documents or questions.
• Interview participants and other people involved in a personal history project, who may share memories, dates, names, family relationships and other biographical details about the person whose story is being recorded.
• Publicly available sources, where this is relevant and appropriate (for example, to check dates, public roles or published materials).
• Suppliers and service providers, such as payment providers or email services, who may confirm payments or provide technical and usage information about the website.

How long I keep information

I keep personal information only for as long as I need it for the purposes described in this notice, or for as long as the law requires. How long that is can depend on the type of information and the context.

In general:

• Enquiries are usually kept for up to 2 years after the last contact.
• Project records and correspondence are usually kept for up to 6 years after the project ends, so I can answer follow‑up questions, understand what was agreed, and deal with any issues that arise.
• Invoices and payment records are kept for 6 years for tax and accounting purposes, or longer if the law requires.
• Interview recordings, transcripts, photographs and family documents are kept during the project and then deleted, returned or retained only as agreed with the client. Any retention decision will normally be recorded in writing, usually by email. If I do not receive instructions about retention, project materials will normally be securely deleted within 12 months of project completion unless I am required to keep them for legal reasons.
• Final written work (for example, a finished life story) may be kept for up to 6 years after the project ends, unless you ask for earlier deletion and this is possible.
• Marketing records (for example, your contact details and marketing preferences) are kept until you withdraw consent, opt out of marketing, or the information is no longer needed.

I may keep some information for longer if I reasonably need it to resolve disputes, deal with legal claims or comply with legal obligations. When information is no longer needed, I will delete it or anonymise it where appropriate.

Who I share information with

I treat your stories and materials as confidential and only share personal information where this is necessary, appropriate and lawful.

Data processors

I use certain service providers to help me run my business and deliver projects. These may include:

• Website hosting and email providers.
• Cloud storage and backup services.
• Analytics providers (for example, Google Analytics).
• Payment service providers.
• Transcription, printing, design, typesetting and other production services.

These providers act as data processors on my behalf. They only receive the personal information they need to provide their services, must keep it secure and confidential, and must not use it for their own independent purposes.

Other organisations I share information with

In some situations I may also share personal information with:

• Professional or legal advisers, where I need advice or representation.
• Organisations I am legally required to share information with, such as tax authorities or law enforcement, where the law requires this.
• Freelancers and project partners, such as designers, typesetters, printers, editors or other specialists where necessary for a particular project. They are required to keep information confidential and only use it to help deliver the agreed work.

I may share some information publicly (for example on my website, in printed materials or on social media) but only where this is appropriate and where you have given clear permission if you or your family can be identified. I will not publish identifiable interview content, photographs or excerpts from your story without your consent and will only do so in the way we have agreed.

I do not sell your personal information or share it with other organisations so that they can market to you.

Sharing information outside the UK

Some of the service providers I use (for example, cloud hosting, email, analytics or payment services) may process personal information in countries outside the United Kingdom. This can also happen where their sub‑processors or data centres are based abroad.

When personal information is transferred outside the UK, I make sure appropriate safeguards are in place, as required by UK data protection law. These may include:

• Using providers in countries or sectors that the UK government has decided offer an adequate level of protection (for example, under Adequacy Regulations or the UK‑US Data Bridge).
• Using providers that rely on standard contractual clauses or the International Data Transfer Agreement (or UK Addendum to the EU clauses), which are approved sets of contract terms for international transfers.

Where my processors use international systems or sub‑processors, I choose providers that state they use appropriate safeguards for international transfers and I take reasonable steps to understand how they protect personal information.

If you would like more detail about the safeguards used for a particular service, you can contact me using the details at the top of this notice.

Children and vulnerable individuals

My services are intended primarily for adults.

Some projects may include information about children or vulnerable individuals as part of a family history.

Where appropriate, I will seek permission from a parent, guardian or other appropriate person before collecting or using personal information about a child.

I take particular care when handling sensitive family information and only collect information that is relevant to the project.

How to complain

If you have any concerns about how I use your personal information, please contact me first. I will do my best to answer your questions and resolve any issues.

• Email: [email protected]
• Telephone: 07851 116343

If you are still unhappy after we have tried to resolve the matter, you also have the right to complain to the Information Commissioner’s Office (ICO), which is the UK’s data protection regulator.

The ICO’s contact details are:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline: 0303 123 1113

Website: https://www.ico.org.uk/make-a-complaint