Privacy policy
Last updated: 15 July 2026
This policy explains what data I collect through sarahlmorgan.co and related tools (the Commercial Engine Scorecard, The Engine Room Hub, and the newsletter), why I collect it, and what rights you have over it. I've tried to write it in plain English rather than legal boilerplate. If anything is unclear, email me and I'll explain it properly.
On this page
1. Who I am
Sarah L Morgan, Ings View, York, YO61 1PR, is the data controller for the personal data described in this policy. That means I decide what data is collected and why, and I'm responsible for looking after it properly.
Contact: info@sarahlmorgan.co
2. What data I collect and why
I only collect what I need to run the site, respond to enquiries, and deliver the free tools and community you sign up for.
| Where it happens | What's collected | Why |
|---|---|---|
| Commercial Engine Scorecard | Email address, your scorecard answers, your resulting score and band | To send you your result and follow up with relevant next steps |
| Newsletter sign-up | Email address | To send you the newsletter you asked for, via Mailchimp |
| Engine Room Hub sign-up | Email address, and which option you selected (waitlist and/or free community) | To manage your place on the waitlist and/or add you to the free community list |
| Booking a call | Name, email address, and any details you provide when booking | Handled directly by Zoom Scheduler. Your booking details are shared with me so I can prepare for and run the call |
| Browsing the site | Standard analytics data: pages viewed, approximate location, device and browser type | To understand how the site is used and improve it, via Google Tag Manager |
I don't ask for anything beyond what's listed above. I don't collect payment details on the site itself.
3. The legal basis I rely on
- Consent: for newsletter sign-ups, Engine Room Hub sign-ups, and non-essential cookies (see the cookie banner on the site). You can withdraw this at any time.
- Legitimate interests: for basic site analytics, and for following up on scorecard results with relevant, useful next steps. I've weighed this against your right to privacy and kept it proportionate.
- Contract or pre-contract steps: if you book a call or engage me for consulting work, I need certain details to deliver that.
4. Who I share data with
I use a small number of trusted tools to run the business. I don't sell your data, and I don't share it with anyone outside the list below.
| Provider | What they handle |
|---|---|
| Mailchimp | Newsletter and Engine Room Hub email list, and sending those emails |
| Netlify | Hosts the site and processes scorecard form submissions |
| Google (Tag Manager / Analytics) | Site analytics, only after you accept cookies |
| Zoom | Call booking and video calls, governed by Zoom's own privacy policy |
Each of these providers processes data under their own security and privacy terms. I only use tools with a legitimate business purpose for handling your data.
5. How long I keep it
I keep data for as long as it's useful and relevant, and no longer:
- Newsletter and Engine Room Hub: until you unsubscribe.
- Scorecard results: up to 24 months, so I can track trends and follow up if relevant. You can ask me to delete yours sooner.
- Enquiry and call booking details: typically up to 24 months after our last contact, longer if we go on to work together and I need it for contractual or accounting purposes.
6. Cookies
The site uses a small number of cookies:
| Type | Purpose | Needs consent? |
|---|---|---|
| Essential | Keeps the site working, remembers your cookie choice | No, these are always on |
| Analytics (Google Tag Manager) | Understand which pages are useful, spot broken links | Yes, only loads after you accept |
You'll see a cookie banner the first time you visit. Choosing "Accept" turns on analytics cookies; choosing "Decline" means only essential cookies run. You can change your mind at any time by clearing your browser's site data and revisiting.
7. Your rights
Under UK GDPR, you can ask me to:
- Access the data I hold about you
- Correct it if it's inaccurate
- Delete it, where there's no good reason for me to keep it
- Restrict how I use it
- Move it to another provider (data portability)
- Object to processing based on legitimate interests
- Withdraw consent at any time, for anything based on consent (like the newsletter)
To use any of these, email info@sarahlmorgan.co. I'll respond within one month.
8. International transfers
Some of the tools I use (including Mailchimp and Google) may store or process data outside the UK, including in the US. Where that happens, they do so under recognised safeguards such as Standard Contractual Clauses or an equivalent UK-approved data transfer mechanism.
9. Changes to this policy
I'll update this page as the business and the tools I use evolve. The date at the top shows when it was last updated. For anything material, I'll flag it clearly on the site.
10. Contact and complaints
Questions about your data or this policy: info@sarahlmorgan.co.
If you're unhappy with how I've handled your data, you have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk/make-a-complaint. I'd appreciate the chance to put things right first, so please reach out to me directly beforehand.