1. Who we are
This policy is provided by Lee Button Associates Limited, a company registered in England and Wales under company number 16332517, with its registered office at Tagus House, 9 Ocean Way, Southampton, Hampshire, England, SO14 3TJ (we, us, our). We are the controller of the personal information described in this policy, which means we decide how and why it is used.
We are registered with the Information Commission (ICO) under registration number ZB886527.
You can contact us about this policy or your personal information by emailing hello@leebutton.co.uk, calling 07747 488 310, or writing to us at our registered office.
2. Who this policy covers
This policy explains how we use personal information about:
- people who visit our website;
- people who contact us or ask about our work;
- clients, prospective clients, suppliers, associates, and other professional contacts;
- people who subscribe to our newsletter; and
- members of our community groups and online community, and people who buy our digital products.
When we handle personal information on a client’s instructions as part of a project, the client is usually the controller and we act as its processor. The client’s own privacy information and our contract with the client will explain those arrangements.
3. What we use and why
The table below explains the personal information we use, why we use it, and our lawful basis for doing so.
| Who | Information and why we use it | Our lawful basis |
|---|---|---|
| Enquiries | Your name, job title, organisation, contact details, and anything you include in your message. We use this to reply, arrange conversations, prepare proposals, and decide whether we can work together. | Our legitimate interests in running and developing our business, or taking steps at your request before entering into a contract with you. |
| Clients, suppliers, associates, and contacts | Names, job titles, business contact details, correspondence, meeting notes, contract details, and invoicing and payment records. We use this to provide and manage our services, work with suppliers and associates, keep business records, and meet our legal, tax, and accounting obligations. | Performing a contract, complying with our legal obligations, or our legitimate interests in running our business and keeping proper records. |
| Newsletter subscribers | Your email address and subscription records. Our newsletter provider, Buttondown, may also record your IP address, how you found the sign-up form, and the time you subscribed. We use this to confirm your subscription and send you the newsletter. | Your consent. We use double opt-in, so you must confirm your email address before you are subscribed. We do not use open tracking or link tracking. |
| Website visitors | Technical information such as your IP address, browser type, the page you request, and the date and time. Our website host processes this to deliver the website and keep it secure. We do not use analytics and do not use this information to profile you. | Our legitimate interests in providing a secure and reliable website. |
| Community members | Your name, contact details (such as your phone number or email address), profile information, and anything you post. We use this to run and moderate our community groups and online community, including applying our Community Guidelines. | Performing our contract with you (for paid memberships) or our legitimate interests in running a safe and useful community. |
| Customers of digital products | Your name, email address, what you bought, and payment records. Our payment provider handles your card details and we do not see your full card number. We use this to supply the product, provide support, and keep financial records. | Performing our contract with you and complying with our legal obligations. |
We usually collect personal information directly from you. We may also receive business contact details from your colleagues, mutual contacts, your organisation’s website, or public professional profiles such as LinkedIn.
You do not have to give us your personal information, but if you do not, we may not be able to respond to you, provide our services, or let you join our community.
4. Sensitive information
Our website, newsletter, and community are not designed to collect health information, patient information, or other sensitive personal information. Please do not send us sensitive information unless we have agreed a suitable way to receive it, and never post information that could identify a patient or service user in our community.
If health or other sensitive information is posted in our Community, we will remove it under our Community Guidelines and will not use it for any other purpose.
If a client project needs us to use identifiable personal information, including health information, we will agree the roles, safeguards, and documentation needed with the client before any processing begins.
5. Who we share it with
We only share personal information where necessary. We may share it with:
- our service providers, including GitHub (website hosting), Buttondown (newsletter), Microsoft (email, file storage, and video calls), Xero (accounting and invoicing), our community platform provider, and our payment provider;
- associates and suppliers who help us deliver agreed work, who must keep it confidential and secure;
- our accountants, insurers, lawyers, and other professional advisers;
- a buyer or potential buyer of our business, if we sell or restructure it; and
- regulators, courts, law enforcement, and other authorities where the law requires or allows it.
If you join a community group on a third-party platform (such as WhatsApp or YouTube), that platform also processes your information under its own privacy policy. We do not sell personal information or share it with advertisers.
6. International transfers
Some of our service providers process personal information outside the UK, including in the United States. Where they do, we make sure there is a lawful safeguard in place, such as UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses. Contact us if you would like more information about the safeguards for a particular transfer.
7. How long we keep it
We only keep personal information for as long as we need it. In general:
- enquiries that do not lead to work are kept for up to 24 months after our last meaningful contact;
- client, supplier, and associate records are kept for 6 years after the relationship or transaction ends;
- newsletter details are kept while you are subscribed, and after you unsubscribe we keep a minimal record so we do not email you again;
- community information is kept while you are a member and for up to 12 months after you leave, unless we need it for longer to deal with a complaint or legal claim; and
- information about complaints or legal claims is kept for as long as needed to resolve them and protect our legal rights.
8. Keeping it secure
We use appropriate technical and organisational measures to protect personal information, and limit access to people and providers who need it. No online service is completely secure. If we become aware of a personal data breach, we will assess it and make any notifications the law requires.
9. Your rights
Depending on the circumstances, you have the right to:
- ask for a copy of your personal information;
- ask us to correct inaccurate or incomplete information;
- ask us to delete your information;
- ask us to restrict how we use your information;
- object to us using your information based on our legitimate interests, and object at any time to direct marketing;
- receive information you gave us in a portable format; and
- withdraw your consent at any time, where we rely on consent.
These rights do not always apply. To use them, email hello@leebutton.co.uk. We may need to confirm your identity. We will not usually charge a fee and will normally respond within one month.
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you.
10. Complaints
If you have a concern about how we use your personal information, please contact us first using the details in this policy. We will acknowledge your complaint within 30 days, look into it, and tell you the outcome without undue delay.
You also have the right to complain to the ICO, the UK regulator for data protection, at ico.org.uk/make-a-complaint or on 0303 123 1113.
11. Changes to this policy
We review this policy regularly and will update it when our services, providers, or uses of personal information change. The date at the top shows when it was last updated.