Bill Harvey Associates Limited — Privacy Notice

Who we are

We are Bill Harvey Associates Limited ("BHAL"), a company registered in England and Wales under company number 04550257, with our registered address at Melrose House, Pynes Hill, Rydon Lane, Exeter, Devon EX2 5AZ. We are registered with the Information Commissioner's Office under registration number ZA307224.

For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, BHAL is the data controller — the company responsible for, and in control of, the processing of any personal data you submit to us.

If you have any questions about this notice or how we handle your personal data, please contact us at privacy@billharveyassociates.com or +44 330 912 4742.

This notice covers

This notice applies to personal data collected through the following websites operated by BHAL:

If your relationship with us goes beyond website use — for example if you engage us for professional services, or if you are a supplier or sub-contractor — please also read our Clients, Suppliers and Sub-contractors Privacy Notice which covers the processing of personal data in those contexts.

We do not sell, rent, or loan any personally identifiable information to any third party. We do not transfer personal data to third parties except as described in this notice.

What personal data we collect and why

Enquiries

If you contact us via a contact form, email, or telephone, we collect the information you provide — typically your name, email address, telephone number, organisation, and the content of your enquiry. We use this to respond to you.

Lawful basis: Legitimate interests — it is in our legitimate interest and yours to respond to enquiries you choose to send us.

Retention: We retain enquiry correspondence for up to 2 years from the date of your last contact, unless the enquiry leads to a business relationship, in which case your data is handled in accordance with our Clients, Suppliers and Sub-contractors Privacy Notice.

Server and infrastructure logs

When you visit our websites, our hosting platform automatically records a log entry for each request. Each log entry typically contains your IP address, the URL requested, date and time, HTTP status code, browser user-agent string, and referring URL.

Purpose: Security monitoring, detecting abuse, diagnosing errors, and understanding operational performance. Not used for marketing or profiling.

Lawful basis: Legitimate interests — we have a legitimate interest in operating our websites securely and reliably.

Who can access them: Accessible only to BHAL and its hosting platform provider as data processor.

Website analytics

We use Plausible Analytics to understand how our websites are used. Plausible is a privacy-first analytics tool: it does not use cookies, does not track you across sites or devices, does not collect your IP address, and does not generate any personal data. Aggregate page view statistics are collected; no information that could identify you is processed or stored. UK GDPR does not apply to this analytics activity as no personal data is processed.

Mailing list

If you sign up to our mailing list using the opt-in form on our website, we collect your email address (and your name, if you choose to provide it). We use this to send you updates about BHAL's work and services.

Lawful basis: Consent — you can withdraw your consent at any time by clicking the unsubscribe link in any email we send you, or by contacting us at privacy@billharveyassociates.com. On unsubscribe, your email address and the date of unsubscribe are retained as a suppression record (to ensure we do not contact you again); all other information is deleted.

Retention: Until you unsubscribe, after which a suppression record (email address and unsubscribe date) is retained indefinitely.

Processor: Drip (Leadpages Group, Inc.) — see Third parties below.

Cookies

We aim to minimise cookie use. A summary of the cookies set on billharveyassociates.com is below.

Strictly necessary cookies — these are set on every visit and do not require your consent:

Cookie Set by Purpose Expires
crumb Squarespace CSRF security token — prevents cross-site request forgery Session

Performance and marketing cookies — these are only set after you accept the cookie banner:

Cookie Set by Purpose Expires
ss_cvr Squarespace Conversion tracking 2 years
ss_cvt Squarespace Conversion tracking 30 minutes
ss_performanceCookiesAllowed Squarespace Records that you accepted performance cookies 30 days
ss_marketingCookiesAllowed Squarespace Records that you accepted marketing cookies 30 days
_drip_client_7917812 Drip Identifies your browser for mailing list personalisation 2 years
_drip_visitor_7917812 Drip Visitor identification for mailing list Session

You can withdraw your consent at any time by clearing your cookies. Declining the cookie banner means none of the performance or marketing cookies above will be set.

moiretelltales.com is hosted on a different platform. No Squarespace cookies are set on that site. moiretelltales.com stores a browser localStorage entry (mtt_cookie_consent) to remember your cookie preferences. This does not identify you and does not require your consent as it is strictly necessary for the cookie banner to function.

Third parties

We share your personal data only where necessary:

  • Email and productivity tools: We use Google Workspace to manage email and documents. Messages you send to us are processed by Google as a data processor under our instructions. Google's data processing terms apply.
  • Website platform: Our websites are hosted on Squarespace. Squarespace may process limited technical data (server logs, session data) as a data processor under our instructions, and is subject to our data processing agreement with them.
  • Google Tag Manager: We use Google Tag Manager (GTM) to manage the loading of third-party scripts on billharveyassociates.com. GTM itself does not set cookies or collect personal data, but it controls when other scripts (such as Drip) are loaded.
  • Drip: We use Drip to manage our mailing list and to display an opt-in form on our website. Drip is a data processor acting under our instructions. Drip's scripts and cookies are only loaded after you accept the cookie banner. If you sign up to our mailing list, your email address is stored by Drip. You can unsubscribe at any time using the link in any email we send you. On unsubscribe, your email address and the date of unsubscribe are retained indefinitely as a suppression record (to ensure we do not contact you again); all other information is deleted.
  • Payment processing (moiretelltales.com): The Moiré Tell-Tales shop uses PayPal payment buttons. If you choose to pay via PayPal, you will be transacting directly with PayPal UK Ltd, which acts as a data controller in its own right. We do not receive your payment card details. PayPal's privacy policy applies to their processing of your data: https://www.paypal.com/uk/legalhub/privacy-full. PayPal passes us your name and delivery address so that we can fulfil your order.
  • Order management (moiretelltales.com): When you place an order through the Moiré Tell-Tales shop, your name, email address, and delivery address are recorded in Process Street (Process Street, Inc.), our workflow and operations management tool, to enable us to fulfil and track your order. Process Street is a data processor acting under our instructions.
  • Process automation: We use Make.com (Celonis SE) to automate the transfer of order information between services (for example, routing your order details from PayPal to our order management and accounting tools). Make.com processes your order data in transit but does not retain it independently. Make.com is a data processor acting under our instructions.
  • Law enforcement: We may disclose personal data to law enforcement or regulatory authorities where we are legally required to do so.

We do not use your personal data for direct marketing without your explicit consent.

We may link from our sites to third-party websites. We are not responsible for the privacy practices of those sites and recommend you check their notices. We do not pass your personal data to third-party sites when you follow links from ours.

Legal basis of our processing

Purpose Lawful basis
Operate our websites securely and reliably; detect and investigate security incidents (server logs) Legitimate interest
Understand how our websites are used at an aggregate level (Plausible Analytics) Legitimate interest — no personal data processed
Respond to enquiries you send us Legitimate interest
Send mailing list emails to subscribers Consent
Set performance and marketing cookies; load Drip mailing list tool Consent

International transfers

Google Workspace data may be processed in the United States. Google LLC participates in the UK-US Data Bridge (UK Extension to the EU-US Data Privacy Framework, in effect from 17 October 2023), which provides an appropriate safeguard for these transfers.

Your rights

Under UK GDPR you have the right to:

  • Access the personal data we hold about you (subject access request).
  • Correct any inaccurate or incomplete data.
  • Erasure — request deletion where there is no longer a lawful basis for holding it.
  • Object to processing based on legitimate interests.
  • Restriction of processing in certain circumstances.
  • Portability of your data in a machine-readable format where processing is based on consent or contract.

To exercise any of these rights, contact us at privacy@billharveyassociates.com or write to Bill Harvey Associates Limited, Melrose House, Pynes Hill, Rydon Lane, Exeter, Devon EX2 5AZ. We will respond within one calendar month.

Keeping our records accurate

We aim to keep information about you as accurate as possible. If you would like to review or correct details you have supplied, please contact us at privacy@billharveyassociates.com.

Automated decision-making and profiling

We do not use your personal data for the purposes of automated decision-making or profiling as defined under UK GDPR.

Sensitive information

We ask that you do not send us, and do not disclose, any sensitive personal data (for example, information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometrics or genetic characteristics, or criminal background) when contacting us through our websites.

Complaints

You have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

Changes to this notice

We may update this notice from time to time. When we do, the current version will be posted on this page. This notice was last updated on 2026-04-30.

This version published: 2026-04-30 (source commit db91f6b60699cdc071dc6c9612ee981a8e61dbcd)