1. Who I Am

Ryan Craig provides independent advisory services, including the Brand Experience Review, for founders and small teams.

I am based in the United Kingdom and act as the Data Controller for all personal data collected through my website, forms, and services.

This policy explains how personal data is collected, used, stored, and protected in line with UK GDPR.

2. What Information Is Collected

a. Contact Information

• Name
• Email address
• Business name
• Role or context you provide

b. Billing Information

Payments are processed securely by Stripe. I do not store card details.

Stripe may process:

• Payment method
• Billing address
• Transaction IDs

c. Business & Review Data (Provided by You)

As part of the Brand Experience Review, you may voluntarily share business materials, including:

• Customer emails, chats, or support tickets
• Feedback or complaints
• Onboarding flows
• Customer journey details
• Internal processes, SOPs, scripts
• Sample customer data relevant to the review

All such information is treated as strictly confidential and used only for the agreed review.

d. Forms & Communications

Data collected through:

• Website forms
• Onboarding questionnaires
• Email communication
• Scheduling tools (e.g. Cal.com)

e. Technical & Website Data

• IP address
• Browser/device information
• Basic analytics
• Cookies (see Section 8)

No Sensitive Data

I do not intentionally collect or store:

• Health data
• Political opinions
• Religious beliefs
• Biometric data
• Data relating to minors

3. How Your Data Is Used

Your data is used to:

Deliver the Brand Experience Review

• Analyse shared materials
• Identify patterns, friction, and opportunities
• Produce written insights and recommendations
• Prepare and conduct review calls

Manage Communication & Administration

• Confirm bookings
• Send service-related emails
• Respond to enquiries
• Process payments

Operate the Business

• Maintain records
• Improve services and workflows
• Maintain security and compliance

I do not:

• Sell your data
• Share your data for advertising
• Use your data outside the agreed scope

4. Lawful Basis for Processing

Data is processed under the following UK GDPR bases:

• Contractual necessity — to deliver the agreed service
• Legitimate interest — to operate and improve the business
• Consent — for optional marketing communications
• Legal obligation — accounting and tax compliance

5. Data Storage & Retention

Data is stored securely using access-controlled, encrypted systems, including:

• Google Workspace (email & files)
• Google Drive
• Stripe (billing)
• Scheduling and form tools (e.g. Cal.com, form providers)

Retention Periods

• Active clients: retained for the duration of the engagement
• Completed reviews: retained for a reasonable period for follow-up and record keeping
• Financial records: retained up to 7 years (UK legal requirement)

You may request deletion of your data at any time, unless retention is legally required.

6. Sharing Data with Third Parties

Data is shared only with essential service providers required to operate the business, such as:

• Stripe (payments)
• Scheduling tools
• Form providers
• Website hosting
• Analytics tools (if enabled)

All providers follow industry-standard security practices and GDPR-compliant safeguards.

Your data is never shared with advertisers or third-party marketers.

7. Your Data Rights (UK GDPR)

You have the right to:

• Access your personal data
• Correct inaccurate data
• Request deletion
• Restrict processing
• Object to processing
• Request data portability
• Withdraw consent for marketing

Requests can be made via hello@ryancraig.co.
Responses are provided within 30 days.

8. Cookies & Tracking

The website may use cookies for:

• Essential functionality
• Performance and analytics
• User experience

You can manage cookies via your browser or any cookie banner provided on the site.

9. Data Security

Reasonable technical and organisational measures are in place, including:

• Secure storage
• Access controls
• Strong passwords
• Two-factor authentication where available

No online system is entirely risk-free, but appropriate safeguards are maintained.

10. International Transfers

If data is processed outside the UK or EEA, appropriate safeguards are used, including:

• Standard Contractual Clauses
• Adequacy decisions
• Secure processing standards

11. Updates to This Policy

This policy may be updated periodically.
The most current version will always be available on the website with the updated date.

12. Contact

For questions, concerns, or data requests:

📧 hello@ryancraig.co
📍 United Kingdom

If you believe your data rights have been breached, you may contact the UK Information Commissioner’s Office (ICO).