Privacy policy
The short version. This website sets no cookies, has no forms, and doesn't track you. We count page views using a tool that holds nothing about you personally, which is why there's no cookie banner to click.
If you email me or book a call, I hold what you send me and use it to reply. If you subscribe to the newsletter or take the quiz, those run on separate services and their own privacy terms apply.
The rest of this page sets that out properly, because you're entitled to the detail.
Who is responsible for your information
This website is run by The Customer Success Consulting LTD, registered in England and Wales, company number 17067881. Registered office: 11 South Close, London N6 5UQ, United Kingdom. VAT number GB 517 962 562. In this policy that's "we", "us" and "our".
We're the data controller for the personal information described here, and we're registered with the Information Commissioner's Office. You can reach us at thomas@thecsconsulting.net.
What this website collects
Nothing.
There's no contact form, no account to create, no login, no comments and no newsletter signup on the page itself. We run no advertising and no marketing trackers. The site sets no cookies of any kind, so there's nothing to consent to and no cookie banner to click.
The fonts and images are built into the page rather than fetched from anywhere else, so the page itself pulls nothing from Google or anyone else.
Counting visits
We use Cloudflare Web Analytics to see how many people visit and which pages they read. It's the only measurement on the site and it's deliberately blunt.
Cloudflare states that this tool "does not use any client-side state, such as cookies or localStorage, to collect usage metrics" and that it does not fingerprint individuals via IP address, user agent or anything else. It tells us page views, which pages are popular, roughly where in the world visitors came from, and how fast pages loaded. It cannot tell us who you are, and it doesn't follow you to any other website.
Because nothing is stored on your device and no individual is identified, this needs no consent and gets no banner. If you'd rather not be counted at all, any tracker-blocking extension will stop the beacon loading.
Server logs
The site is hosted by Cloudflare. Like any web host, Cloudflare records standard technical information when a page is served: IP address, the time of the request, which page was requested, and the browser and device type. This happens automatically and is used to deliver the site and protect it from attack.
We don't use these logs to identify or profile anyone, and we don't combine them with anything else. Cloudflare's handling of both the logs and the analytics described above is covered by their privacy policy.
What happens when you get in touch
If you email us
We hold your email address, your name and whatever you choose to write, and we use it to reply and to carry on the conversation. Nothing more.
Our email runs on Google Workspace, so Google holds that correspondence on our behalf as our processor. Their handling is covered by the Google Cloud data processing terms. We also use Google Drive to store working documents, which can include client material.
If you book a call
The "Book 30 minutes" button takes you to Calendly. If you book, Calendly collects your name, email address and any details you add, and passes them to us so the meeting can happen. Calendly is a separate company acting as our processor, and their privacy notice covers what they do with it.
Meetings, recordings and transcripts
We sometimes record or transcribe client meetings so we have an accurate record of what was discussed.
We ask before we do it, every time. If you'd rather we didn't, say so and we won't. Declining changes nothing about the work.
The tool varies with the meeting. It may be an AI notetaker joining the call, the recording built into the meeting platform, or a transcription tool. At the time of writing that includes Zoom, Google Meet and Gemini, Calendly, Echo and Wispr Flow. We'll tell you which one is in use when we ask, and you can ask at any time.
Recordings and transcripts are held either in the tool that made them or in our Google Drive. Each of those companies acts as our processor and has its own privacy terms, and each applies its own retention on top of ours.
Recordings, transcripts and the notes we take from them are kept for 6 years, the same as the rest of the client record, and then deleted.
You can ask us to delete yours at any point before that, and we will, unless we're required to keep something to meet a legal obligation. You don't need a reason and there's no charge. Email us and it's done.
Other services linked from this site
Some links take you off this website. Nothing is shared with these services unless you choose to click through and use them.
| Service | What it does and what it gets |
|---|---|
| Substack | Hosts the newsletter and the writing archive. If you subscribe, Substack holds your email address and we can see the subscriber list. Governed by Substack's privacy policy. |
| ScoreApp | Runs the CS maturity quiz. If you take it, ScoreApp collects the details you enter and your answers in order to generate and send your report, and shares them with us. Governed by ScoreApp's privacy policy. |
| Google Workspace and Google Drive | Runs our email and stores working documents, including client correspondence and meeting records. |
| Meeting and transcription tools | Zoom, Google Meet and Gemini, Calendly, Echo and Wispr Flow, depending on the meeting. Used only with your agreement, as described above. |
| The CS Academy shop, run on Payhip | Sells the online courses, at shop.thecsacademy.net. If you buy a course or create an account there, Payhip collects your name, email address, billing country and order history, and processes your payment. We are the controller of that information and Payhip is our processor, so this policy covers it, and Payhip's own privacy policy covers what they do as a platform. Card details go to the payment provider and we never see them. That site sets its own cookies, which is why it shows a cookie notice and this one does not. |
| YouTube and LinkedIn | Plain links, not embedded players or widgets. Nothing is sent to either until you click, and from that point their own terms apply. |
Why we use your information, and our lawful basis
| What for | Lawful basis |
|---|---|
| Replying to enquiries and holding a conversation about possible work | Legitimate interests: we can't respond to someone who contacted us without using what they sent. |
| Arranging and holding meetings | Legitimate interests, or performance of a contract once we're working together. |
| Selling and delivering an online course, and giving you access to it | Performance of a contract: you bought the course and we have to deliver it. |
| Keeping records of course purchases for tax and accounting | Legal obligation: HMRC requires business records to be kept. |
| Delivering consulting work and administering the engagement | Performance of a contract. |
| Sending the newsletter | Consent, which you give by subscribing and can withdraw at any time. |
| Sending your quiz results | Consent, given when you take the quiz. |
| Recording or transcribing meetings | Consent, asked for before each recording and withdrawable at any time. |
| Counting page views | Legitimate interests in knowing whether the site is read. No personal data is involved, and nothing is stored on your device. |
| Keeping the site available and secure | Legitimate interests in protecting the website. |
| Keeping accounting and tax records | Legal obligation. |
Who we share it with
We don't sell your information, and we don't share it for anyone else's marketing.
It's handled by the service providers named above, each doing a specific job for us. Beyond those, it may be seen by our accountant and by professional advisers where they need it, and it may be disclosed where the law requires it or to establish or defend a legal claim.
Where your information goes
Cloudflare, Calendly, Substack, Google, Zoom, Echo and Wispr Flow are United States companies. ScoreApp and Payhip are based in the United Kingdom. Where information reaches a US provider, that transfer relies on the safeguards those providers put in place, such as the UK International Data Transfer Addendum or the UK extension to the EU-US Data Privacy Framework. Details are in each provider's privacy notice, linked above.
How long we keep it
| What | How long |
|---|---|
| Enquiry emails that don't lead to work | Up to 24 months from the last contact, then deleted. |
| Correspondence and records for client engagements | 6 years after the engagement ends, which matches UK accounting and limitation periods. |
| Meeting recordings, transcripts and notes | 6 years, with the client record. Deleted sooner on request, at any time. |
| Newsletter subscription | Until you unsubscribe. Unsubscribing removes you. |
| Course purchase records, including your name, email address and order history | 6 years from the end of the tax year in which the purchase was made, because HMRC requires it. Your course account itself lasts until you ask us to close it. |
| Quiz responses | Up to 24 months, then deleted. |
| Cloudflare server logs | Retained by Cloudflare on their own schedule, which is short. We keep no copy. |
| Web analytics | Aggregate counts only, held by Cloudflare. Nothing in it relates to an identifiable person. |
Your rights
Under UK data protection law you have the right to:
- Be told what we hold about you and get a copy of it
- Have anything inaccurate corrected
- Have your information erased
- Restrict how we use it
- Object to us using it, including for direct marketing, which we'll always honour
- Receive it in a portable format, or have it sent to someone else
- Withdraw consent at any time, where consent is what we're relying on. Withdrawing doesn't affect anything done before you withdrew.
To use any of these, email thomas@thecsconsulting.net. There's no charge, and we'll respond within one month. Given the size of this business, usually much sooner.
Complaints
If you think we've handled your information badly, please tell us first so we can put it right.
You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at any time. You don't have to come to us first.
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline 0303 123 1113. ico.org.uk/make-a-complaint
Children
This website is aimed at people running businesses. It isn't directed at children and we don't knowingly collect information about anyone under 13. If you believe a child has sent us personal information, email us and we'll delete it.
Changes to this policy
If we change how we handle personal information, we'll update this page and change the date at the top. Nothing changes retrospectively.
Questions about this policy
Email thomas@thecsconsulting.net.
The Customer Success Consulting LTD, registered in England and Wales, company number 17067881. Registered office: 11 South Close, London N6 5UQ, United Kingdom. VAT GB 517 962 562.