UK GDPR

Privacy notice

This notice is written in plain language for the first version of the site. It is not a substitute for advice from a solicitor.

Who I am

The controller is Dave, trading as Lifestyle Wakeup, in the United Kingdom. For privacy requests, email [email protected]. That address is a placeholder. Replace it before anyone opts in.

What I collect

• If you ask for the checklist: your first name, your email address, and the fact that you ticked the consent box. The form will not send if the box is left unticked. EmailOctopus stores the subscription, including the time you joined, which is the record of that consent.
• If you email me: whatever you choose to write, and your email address, so I can reply.
• If you accept optional cookies: Google Analytics 4 and the Meta (Facebook) pixel may collect technical data such as an IP address, rough location, pages viewed, device and browser details, and cookie identifiers. They do not load if you reject. See the cookie notice.
• Hosting logs: the company that hosts the site may keep standard server logs, including IP address, as part of running and securing the site.

I do not ask for payment details on this site. I do not knowingly collect information from children, and the site is not aimed at anyone under 18. Please don't send me someone else's personal details.

Why I use it, and the lawful basis

• Consent (UK GDPR article 6(1)(a)): sending you the checklist and occasional notes, and loading analytics or the Meta pixel. You can withdraw either consent at any time.
• Legitimate interests (article 6(1)(f)): keeping basic security logs, and replying if you write to me. I keep that limited to running the site safely.

Who processes it

• EmailOctopus is my email provider and acts as a processor for the list: storing contacts and sending the messages you asked for.
• Google (Google Analytics 4) and Meta (the Facebook pixel) only receive data if you accept optional cookies. They are then separate controllers or joint controllers for their own purposes, under their own policies.
• The host (planned as Cloudflare Pages or Netlify) processes connection data in order to serve the pages.

I don't sell personal information, and I don't pass the list to anyone as a product.

Where it goes

I am in the United Kingdom. EmailOctopus, Google, Meta and the host may process data outside the UK. Where they do, they need a lawful transfer tool, such as UK adequacy regulations or an appropriate safeguard (the International Data Transfer Agreement or standard contractual clauses). Their documentation describes which one they use.

How long I keep it

• Email details: until you unsubscribe, or until you ask me to delete them. I may keep a short note of the suppression (your email on a "do not contact" list) so I don't add you again by mistake.
• The consent record: for as long as the subscription lasts, and for a short period afterwards so I can show that the opt-in was real if I ever have to.
• Analytics and pixel data: according to Google's and Meta's retention settings. I will keep those as short as the tools allow once the accounts exist.
• Server logs: for as long as the host keeps them, typically a short operational window.

Your rights

Under UK GDPR you can ask to access, correct, erase, or restrict your personal information, and you can object to some uses of it. You can ask for a copy in a portable format where the basis is consent. You can withdraw consent at any time, including by using the unsubscribe link in an email or the cookie settings on this site. Withdrawing consent doesn't affect anything that was already lawful.

I will respond within one month. If I can't do what you ask, I'll explain why. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint/. I would like the chance to put it right first.

— Dave