Privacy Policy

Who I am

I am Lewis Kelly, trading as LK Transformation. I am the data controller for the personal data described in this policy.

Email: lewis@lktransformation.co.uk

What I collect, why, and my lawful basis

The enquiry form. Your name, email address, organisation (if you give one) and your message. I use it to reply to you. My lawful basis is legitimate interests: responding to someone who has chosen to contact me about my services. Please do not put confidential or sensitive information in the form.

Booking a call. The booking button opens Calendly, which collects your name, email address, the time you choose and any answers you give. I receive those details so I can hold the call. My lawful basis is legitimate interests, and taking steps at your request before a possible contract.

Emails and calls with me. The content of our correspondence. My lawful basis is legitimate interests. If we work together it becomes performance of a contract, and legal obligations such as keeping accounting records.

Visiting this site. The site's hosting provider, Cloudflare, processes technical data such as your IP address so that the pages can be delivered and kept secure. I also use privacy-friendly analytics that count visits and pages viewed without cookies (see the cookie policy). My lawful basis is legitimate interests: running and securing the site and understanding whether it works.

I do not knowingly collect special category data, I do not use automated decision-making or profiling, and I do not add anyone to a marketing list without asking first.

Who receives your data

I use a small number of service providers who handle data on my behalf under data processing terms: Formspree (delivers the enquiry form to my inbox), Google Workspace (my email), Calendly (bookings) and Cloudflare (hosting, DNS and analytics). I do not sell your data. I may share it with professional advisers such as my accountant, insurer or solicitor where needed, or where the law requires.

Transfers outside the UK

Some of these providers are based in, or process data in, the United States and other countries. I only use providers that put a safeguard in place that UK data protection law accepts, such as the UK Extension to the EU-US Data Privacy Framework (the UK-US data bridge) or the UK International Data Transfer Addendum to standard contractual clauses. Ask me if you would like details for a particular provider.

How long I keep it

Enquiries and bookings that do not lead to work: deleted 12 months after our last contact.

If we work together: I keep the contract, financial records and related correspondence for 6 years after the engagement ends, to meet tax record rules and to deal with any claims.

Analytics: aggregated counts only, with no personal profile. Hosting logs held by Cloudflare follow Cloudflare's own retention.

Your rights

You can ask me for a copy of your personal data, ask me to correct it or delete it, ask me to restrict how I use it, and object to my use of it, including where I rely on legitimate interests. To use any of these rights, email me at the address above. I will respond within one month.

Complaints

If you are unhappy with how I have handled your data, please tell me first, by email or through the enquiry form. I will acknowledge your complaint within 30 days and respond without undue delay. You can also complain to the Information Commissioner's Office (ICO).

Security

This site is served over HTTPS. Enquiries arrive in a mailbox protected by two-factor authentication. I keep my devices encrypted and up to date, limit who can access personal data, and delete it on the schedule above. If a personal data breach puts your rights at risk, I will tell you and, where required, the ICO.

Cookies

See the Cookie Policy.

Changes

If I change how I use personal data, I will update this policy and its date before the change takes effect.