Privacy notice

1. Who I am

I am a book and paper conservator operating as a small independent practice in the UK.

Name: Holly Smith Conservation
Contact email: hollysmithconservation@gmail.com

I am the data controller for the personal data described in this notice.

2. What personal data I collect

I only collect personal data that is necessary for providing conservation services and running my practice. This may include:

Names of individual clients or contacts within organisations
Email addresses and other contact details
Invoices and payment records
Email correspondence relating to conservation treatment, collections, quotations, and logistics

I do not collect special category personal data (such as health information).

3. How and why I use your data

I use personal data for the following purposes:

To communicate with clients about conservation work
To carry out and manage agreed conservation treatments
To prepare quotations and invoices
To keep financial records as required by law

The lawful bases for processing this data under UK GDPR are:

Contract – to carry out agreed conservation services
Legal obligation – to comply with HMRC and accounting requirements

I do not use personal data for marketing purposes.

4. How long I keep your data

I keep personal data only for as long as necessary:

Invoices and financial records are retained for at least 6 years to comply with HMRC requirements
Email correspondence and project records are kept for as long as they are reasonably useful for professional reference, after which they are deleted

5. How your data is stored

Personal data is stored securely using appropriate measures, including password-protected devices and email accounts. Paper records are stored securely.

I take reasonable steps to ensure that personal data is protected against loss, misuse, or unauthorised access.

6. Sharing your data

I do not sell or share personal data with third parties, except where necessary to fulfil legal or accounting obligations (for example, with an accountant).

7. Your rights

Under UK GDPR, you have the right to:

Access the personal data I hold about you
Request correction of inaccurate data
Request deletion of your data where appropriate
Object to or restrict certain types of processing

To exercise these rights, please contact me using the details above.

8. Complaints

If you have concerns about how your data is handled, you have the right to complain to the Information Commissioner’s Office (ICO).

Website: www.ico.org.uk

9. Updates to this notice

This privacy notice may be updated from time to time. The most recent version will be made available on request or via my website (if applicable).