Privacy policy

This policy explains what data I collect through sarahlmorgan.co and related tools (the Commercial Engine Scorecard and the newsletter), why I collect it, and what rights you have over it. I've tried to write it in plain English rather than legal boilerplate. If anything is unclear, email me and I'll explain it properly.

1. Who I am

Sarah L Morgan, Ings View, York, YO61 1PR, is the data controller for the personal data described in this policy. That means I decide what data is collected and why, and I'm responsible for looking after it properly.

Contact: info@sarahlmorgan.co

2. What data I collect and why

I only collect what I need to run the site, respond to enquiries, and deliver the free tools and community you sign up for.

Where it happens	What's collected	Why
Commercial Engine Scorecard	Email address, your scorecard answers, your resulting score and band	To send you your result and follow up with relevant next steps
Newsletter sign-up	Email address	To send you the newsletter you asked for, via Mailchimp
Downloading a free tool or template	First name (optional), email address, and which resource you downloaded from which page	To give you the download and add you to the mailing list, via Mailchimp, so I can send you practical articles and tools. A record of the request is kept by Netlify so I can see which resources are most useful. You can unsubscribe at any time
Booking a call	Name, email address, and any details you provide when booking	Handled directly by Google Calendar appointment booking. Your booking details are shared with me so I can prepare for and run the call
Browsing the site	Standard analytics data: pages viewed, approximate location, device and browser type	To understand how the site is used and improve it, via Google Tag Manager

I don't ask for anything beyond what's listed above. I don't collect payment details on the site itself.

3. The legal basis I rely on

• Consent: for newsletter and mailing list sign-ups, and non-essential cookies (see the cookie banner on the site). You can withdraw this at any time.
• Legitimate interests: for basic site analytics, and for following up on scorecard results with relevant, useful next steps. I've weighed this against your right to privacy and kept it proportionate.
• Contract or pre-contract steps: if you book a call or engage me for consulting work, I need certain details to deliver that.

4. Who I share data with

I use a small number of trusted tools to run the business. I don't sell your data, and I don't share it with anyone outside the list below.

Provider	What they handle
Mailchimp	Newsletter and mailing lists, and sending those emails
Netlify	Hosts the site and processes form submissions, including scorecard answers and download requests
Google (Tag Manager / Analytics)	Site analytics, only after you accept cookies
Google Calendar	Call booking, governed by Google's own privacy policy
Zoom	Video calls, where used, governed by Zoom's own privacy policy

Each of these providers processes data under their own security and privacy terms. I only use tools with a legitimate business purpose for handling your data.

5. How long I keep it

I keep data for as long as it's useful and relevant, and no longer:

• Newsletter and mailing lists: until you unsubscribe.
• Scorecard results: up to 24 months, so I can track trends and follow up if relevant. You can ask me to delete yours sooner.
• Enquiry and call booking details: typically up to 24 months after our last contact, longer if we go on to work together and I need it for contractual or accounting purposes.

6. Cookies

The site uses a small number of cookies:

Type	Purpose	Needs consent?
Essential	Keeps the site working, remembers your cookie choice	No, these are always on
Analytics (Google Tag Manager)	Understand which pages are useful, spot broken links	Yes, only loads after you accept

You'll see a cookie banner the first time you visit. Choosing "Accept" turns on analytics cookies; choosing "Decline" means only essential cookies run. You can change your mind at any time by clearing your browser's site data and revisiting.

7. Your rights

Under UK GDPR, you can ask me to:

• Access the data I hold about you
• Correct it if it's inaccurate
• Delete it, where there's no good reason for me to keep it
• Restrict how I use it
• Move it to another provider (data portability)
• Object to processing based on legitimate interests
• Withdraw consent at any time, for anything based on consent (like the newsletter)

To use any of these, email info@sarahlmorgan.co. I'll respond within one month.

8. International transfers

Some of the tools I use (including Mailchimp and Google) may store or process data outside the UK, including in the US. Where that happens, they do so under recognised safeguards such as Standard Contractual Clauses or an equivalent UK-approved data transfer mechanism.

9. Changes to this policy

I'll update this page as the business and the tools I use evolve. The date at the top shows when it was last updated. For anything material, I'll flag it clearly on the site.

10. Contact and complaints

Questions about your data or this policy: info@sarahlmorgan.co.

If you're unhappy with how I've handled your data, you have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk/make-a-complaint. I'd appreciate the chance to put things right first, so please reach out to me directly beforehand.