Privacy Policy

Last updated: 18 August 2026

This policy explains what I do with personal information when you use this website, get in touch, or work with me. I've written it in plain English rather than legal boilerplate, because a policy nobody reads protects nobody.

Who I am

This site belongs to Sarah Sinclair, trading as Sarah Sinclair Marketing. I'm a sole trader based in Edinburgh, and I'm the data controller for the information described here — meaning I'm the person responsible for deciding how it's used and for looking after it.

Contact: hello[@]sarahsinclair.uk

What I collect, and why

When you use the enquiry form

The form on this site asks for your name, your email address and your message. If you add other details — your company, your phone number, what you're trying to solve — those come through too.

I use this to reply to you and, if it goes further, to work out whether what you need is something I can help with. Nothing more. I don't add form enquiries to a mailing list, because I don't run one.

Lawful basis: legitimate interests — you've contacted me about my services and you'd reasonably expect a reply. Where an enquiry turns into a piece of work, I'm processing your information to take steps towards a contract and then to deliver it.

When you email me

Anything you send to hello[@]sarahsinclair.uk sits in my inbox, which runs on Google Workspace. Same basis, same purpose.

When you become a client

Delivering work usually means holding your contact details, your invoicing details, and whatever you share with me about your business — which can include your own customer or performance data. I handle that under our contract, and I treat commercially sensitive material as confidential whether or not there's an NDA in place.

Where you give me access to your own systems — a Shopify store, a Klaviyo account, an ad account — I'm processing personal information on your behalf and under your instructions. In that situation you are the controller and I am your processor.

Lawful basis: performance of a contract, and legal obligation for anything I have to keep for tax.

When you visit the site

The site sets a small number of cookies. Some are needed for it to work at all; the rest tell me how many people visited and which pages they looked at. There are no advertising or social-media tracking pixels on this site.

The Cookies Policy sets out every cookie by name, what it does and how long it lasts, and how to turn the optional ones off.

What I don't do

  • I don't sell your information, and I don't share it with anyone for their own marketing.

  • I don't run a newsletter or a mailing list from this site.

  • I don't use automated decision-making or profiling.

  • I don't run advertising or social-media tracking pixels on this site.

Who else sees it

I use a small number of suppliers to run the practice. They only ever process information on my instructions, and each is bound by their own data protection terms.

Supplier What they handle Squarespace Hosts the website and receives enquiry-form submissions Google Workspace Email at hello[@]sarahsinclair.uk, calendar, file storage Starling Invoices and payment records Notion Client project notes and tracking Granola Client meeting recording and notetaker Wispr dictation tool

Some of these are US companies, or store information outside the UK. Where that happens, the transfer is covered by an adequacy decision, the UK Extension to the EU–US Data Privacy Framework, or the UK International Data Transfer Agreement and Addendum — the safeguards UK law recognises for sending information abroad.

I'll also share information where I'm legally required to: with HMRC, my accountant, or a regulator or court if I'm obliged to.

Where a project genuinely needs another freelancer — a designer, a developer, a paid media specialist — I'll tell you who before anything is shared, and they're held to the same confidentiality terms I am.

How long I keep it

What How long Enquiries that don't become work 12 months Client records, contracts and correspondence 6 years after the end of the engagement Invoices and financial records 6 years after the end of the tax year they relate to, as HMRC requires Website analytics Up to 2 years, per the cookie durations in the Cookies Policy

If you'd rather I deleted something sooner, ask me and I will, unless I'm required to keep it.

Your rights

Under UK data protection law you can ask me to:

  • Tell you what I hold about you, and give you a copy

  • Correct anything that's wrong or incomplete

  • Delete it, where there's no good reason for me to keep it

  • Restrict what I do with it while a query is sorted out

  • Hand it over to you or another provider in a portable format

  • Stop, where I'm relying on legitimate interests — you can object, and I'll stop unless I have a compelling reason not to

Email hello[@]sarahsinclair.uk and I'll respond within one month. It's free, and I won't ask why.

If you're not happy with how I've handled it, you can complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113. I'd rather you came to me first so I can put it right, but you don't have to.

Keeping it safe

Accounts are protected with strong, unique passwords and two-factor authentication. Devices are encrypted. Access to client systems is limited to what a piece of work actually needs, and removed when the work ends. No system is perfectly secure, but if something went wrong that put your information at risk, I'd tell you and the ICO where the law requires it.

Children

This site is aimed at businesses. It isn't directed at children, and I don't knowingly collect information about anyone under 18.

Changes

If this policy changes, the date at the top changes with it. If a change is significant and affects people I'm already working with, I'll tell them directly rather than relying on them to re-read the page.