Privacy & Cookies

Who I am

This website is operated by Beckie Brown. If you have any questions about how your data is handled, or to make a data subject request, please contact me at gdpr@beckiebrown.com.

What I collect and why

If you accept cookies, this site uses Google Analytics 4 to collect anonymised data about how visitors use the site. This includes:

• Pages visited and time spent on each page
• Approximate geographic location (country/city level)
• Device type and browser
• Referring website or search engine

This data helps me understand which content is useful so I can improve the site. No personally identifiable information — such as your name or email address — is collected through analytics.

Contact form

If you use the contact form, I collect your name, email address, and the content of your message. I use this information to respond to your enquiry and, where relevant, to discuss potential consulting work.

This data is processed via Mailgun, which delivers the message to my inbox. Mailgun acts as a data processor on my behalf under a Data Processing Agreement. Messages are processed on Mailgun’s EU infrastructure and are not transferred outside the European Economic Area.

I keep contact form messages in my inbox for as long as they are useful for the conversation, typically up to 24 months from the last reply. After that they are deleted unless we are working together, in which case relevant correspondence is retained for the duration of the engagement and up to 6 years afterwards for tax and contractual records.

Newsletter subscription

The contact form includes an optional checkbox to subscribe to the Notes & Sparks newsletter. The checkbox is unticked by default — submitting the contact form does not subscribe you unless you actively opt in.

If you opt in, your email address and a record of your consent (timestamp, the exact wording you agreed to, the page URL, and the consent version) are stored in a private Google Sheet. I use this record to add you to the Notes & Sparks subscriber list on Substack manually, and to demonstrate your consent if challenged.

You can unsubscribe at any time using the unsubscribe link in any newsletter email, or by replying to ask me to remove you. Unsubscribing removes you from Substack but does not automatically delete the consent record — I keep that for up to 3 years as evidence that consent was properly obtained, after which it is deleted.

Legal basis

Different parts of this site rely on different lawful bases under UK GDPR Article 6:

• Analytics tracking is only activated with your explicit consent (Article 6(1)(a) and PECR). If you decline or have not yet made a choice, no tracking cookies are set and no analytics data is sent.
• Contact form messages are processed on the basis of legitimate interest (Article 6(1)(f)) — responding to enquiries from people who have actively contacted me — or, where the conversation leads to consulting work, on the basis of contract (Article 6(1)(b)).
• Newsletter subscriptions are processed on the basis of explicit consent (Article 6(1)(a)), captured via the opt-in checkbox on the contact form.

Data processor: Google Analytics

Analytics data is processed by Google LLC using the Google Analytics 4 service. Google acts as a data processor on my behalf under a Data Processing Agreement.

Google Analytics anonymises IP addresses before any data is stored. Event data is retained for 2 months.

Data processor: Mailgun

Contact form messages are delivered via Mailgun (operated by Sinch). Mailgun acts as a data processor on my behalf under a Data Processing Agreement. Messages are processed on Mailgun’s EU infrastructure and are not transferred outside the European Economic Area.

Data processor: Google (Sheets)

Newsletter consent records are stored in Google Sheets via my Google Workspace account. Google LLC acts as a data processor on my behalf under a Data Processing Agreement.

Data at rest is stored in the European Union under Google Workspace data region settings. Some processing operations (such as search indexing and backups) may still be carried out in the United States under appropriate UK GDPR Chapter V safeguards, including Google’s Standard Contractual Clauses.

Data processor: Substack

If you opt in to the Notes & Sparks newsletter, your email address is added to a subscriber list hosted by Substack Inc. Substack is the data controller for the newsletter platform itself (their privacy policy applies to how they handle your subscription); I am the data controller for the decision to add you to the list and the content of the emails I send. Substack is based in the United States; data may be transferred to and processed in the US under Standard Contractual Clauses and other appropriate UK GDPR Chapter V safeguards.

International data transfer

Google LLC is based in the United States. Analytics data may be transferred to and processed in the US. This transfer is carried out under Google's Standard Contractual Clauses and UK–US Data Bridge certification, which provide appropriate safeguards under UK GDPR Chapter V.

Cookies set

Cookies are only set after you accept. No cookies are set if you decline.

Your rights

Under UK GDPR you have the right to:

• Withdraw consent at any time — use the “Cookie preferences” link in the footer
• Access the personal data held about you
• Erasure — request deletion of your data
• Object to processing based on legitimate interest (e.g. contact form correspondence) at any time
• Lodge a complaint with the ICO at ico.org.uk/make-a-complaint

To exercise any of these rights, email gdpr@beckiebrown.com.