Skip to main content

Privacy Notice

  1. 1.Who we are

    1. 1.1NextFriday Ltd is the data controller.
    2. 1.2Contact: andy@nextfriday.co.uk.

  2. 2.What we collect

    1. 2.1Your name and email when you book or subscribe.
    2. 2.2Basic, privacy-respecting analytics about site usage.
    3. 2.3An approximate location (town/city) worked out from your IP address when you visit — your IP address itself is never stored, only this coarser result.
    4. 2.4Your name and email when you download a gated resource, such as a policy paper.

  3. 3.How we use it

    1. 3.1To arrange and follow up the free hour.
    2. 3.2To send the Friday Note, only if you opt in.
    3. 3.3To keep a record of who has downloaded our published papers, in case it's useful to follow up.

  4. 4.Your rights

    1. 4.1You can ask for a copy of your data.
    2. 4.2You can ask us to delete it.

  5. 5.Legal basis for each use

    1. 5.1Arranging your free hour or walk: we process your name, business and what you're stuck on to set up and follow up the session you asked for. Lawful basis: performance of a contract / steps taken at your request before entering one (UK GDPR Art 6(1)(b)).
    2. 5.2Booking confirmations and reminders: sent as part of delivering the session you booked. Same basis as 5.1; these are service messages, not marketing.
    3. 5.3The Friday Note: we only send it if you opt in, and you can opt out at any time. Lawful basis: your consent (UK GDPR Art 6(1)(a)) and Regulation 22 of PECR 2003.
    4. 5.4Gated downloads (e.g. a policy paper): we only record your name and email if you tick the consent box before downloading. Lawful basis: your consent (UK GDPR Art 6(1)(a)).
    5. 5.5Privacy-respecting analytics: to understand, in aggregate, how the site is used. This includes an approximate town/city worked out from your IP address using an offline lookup on our own server — your IP address is never sent anywhere else and is never itself stored. Lawful basis: our legitimate interests in improving the site (UK GDPR Art 6(1)(f)), kept narrow and balanced against your privacy. Where any non-essential cookie or storage is involved we ask first or give you a clear opt-out, as PECR requires.

  6. 6.Sharing, and our consent-first rule

    1. 6.1We never sell your data, and we never share it with a third party for that third party's own purposes.
    2. 6.2We use a small number of trusted suppliers who process data only on our instructions as our processors under a written agreement (UK GDPR Art 28): our calendar/booking provider (Google), our email/newsletter tool, and Cloudflare, who provide cookie-free website analytics.
    3. 6.3We run our own visitor analytics, on our own servers; we never store your IP address there — it is converted immediately into a one-way hash that cannot be used to identify you. We also use Cloudflare's website analytics, which does not use cookies and does not track you across other websites, to understand overall traffic and site performance.
    4. 6.4We will only ever publish or reuse any interaction with you (a quote, a story, a photo) if you have given specific consent for that particular use. Posting in our community, joining a walk, or booking a session is not permission to feature you. Consent is asked for separately, names what may be used and where, and can be withdrawn at any time.

  7. 7.Sending data outside the UK

    1. 7.1Some of our suppliers may process data outside the UK. Where they do, we rely on UK 'adequacy' regulations or an International Data Transfer Agreement / Standard Contractual Clauses so your data keeps an equivalent level of protection (UK GDPR Chapter V, Arts 44–49, as amended by the DUAA 2025).

  8. 8.How long we keep it

    1. 8.1Booking and enquiry details: kept while we're in contact and for [24 months] after our last contact, then deleted.
    2. 8.2Friday Note subscription: kept until you unsubscribe.
    3. 8.3Analytics: aggregated and short-lived; no long-term identifiable records.
    4. 8.4Gated download records (e.g. policy papers): kept until you ask us to delete them.
    5. 8.5(Storage limitation principle: UK GDPR Art 5(1)(e). The bracketed period is yours to confirm.)

  9. 9.Your rights in full. You have the right to: be informed (Art 13); access a copy of your data (Art 15); have it corrected (Art 16); have it erased (Art 17); restrict how we use it (Art 18); portability (Art 20); object to processing, including any marketing (Art 21); and not be subject to solely automated decisions (Art 22). Where we rely on consent, you can withdraw it at any time without affecting what we did beforehand (Art 7(3)). We don't do any automated decision-making or profiling.

  10. 10.Complaints: two routes

    1. 10.1You can complain to us directly and we'll handle it properly: email andy@nextfriday.co.uk. We'll acknowledge within 30 days and respond without undue delay. (This internal route is a requirement under the Data (Use and Access) Act 2025, in force from 19 June 2026.)
    2. 10.2You can also complain to the UK regulator, the Information Commissioner's Office: ico.org.uk, helpline 0303 123 1113 (UK GDPR Art 77; DPA 2018 s.165).

  11. 11.Keeping this notice current

    1. 11.1We'll update this notice when our practices change and show the date of the latest version at the top.
Privacy Notice — nextfriday — nextfriday