Privacy Policy

1. Who Is Responsible For Your Information?

It’s Me Grace is the trading name of Grace Baker, a sole trader. Its principal place of business is 45 The Churchills, Newton Abbot, TQ12 2JL.

For personal information used for my own business purposes, I am the ‘controller’. This means I decide why and how that information is used.

Privacy contact: Grace Baker, [email protected], 45 The Churchills, Newton Abbot, TQ12 2JL.

2. When I Act For A Client

Virtual Assistant work can involve handling personal information in a client’s systems – for example, customer records, inboxes, diaries, CRM entries, supplier contacts or employee administration. In that situation, the client will normally be the controller and It’s Me Grace will normally act as its processor, using the information only on the client’s documented instructions and under a written data-processing agreement.

Questions or rights requests about information held for a client should usually be directed to that client. I will assist the client as required. This policy applies to processing for my own business purposes; the client’s privacy information governs its processing.

3. The Information I Collect

Identity and contact details, such as your name, title, business name, job role, postal address, email address, telephone number and social-media handle.

Enquiry and relationship details, including messages, call notes, requirements, preferences, proposals, quotes, contracts, feedback and correspondence.

Service and project information, including instructions, deadlines, access arrangements, work products and information you provide so I can perform agreed services.

Financial and transaction information, such as billing address, invoices, payment status, purchase history and accounting records. I do not intend to store complete payment-card details; payment providers process those details under their own notices.

Marketing preferences, including whether you have agreed to receive updates and how you respond to them.

Website and device information, such as IP address, browser and device type, approximate location, pages viewed, referral source, timestamps, cookie identifiers and security logs, where collected by the live website.

Public and professional information, such as details on a company website, Companies House, a professional directory or a business networking profile.

4. How I Obtain Information

I collect information directly from you when you use a form, email, telephone, book a call, enter into a contract, pay an invoice or communicate with me. I may also receive it from your employer or colleagues, a referral contact, a client that asks me to work with you, public business sources, service providers, or automatically through website technologies.

If I obtain your information from another source, I will provide relevant privacy information within the period required by law unless an exception applies.

5. Why I Use Information And My Lawful Bases

UK data protection law requires a lawful basis for each use of personal information. The bases most likely to apply are set out below. More than one purpose may apply to the same information.

6. Legitimate Interests

Where I rely on legitimate interests, those interests include running and developing the business, communicating with business contacts, providing and improving services, keeping appropriate records, recovering money owed, securing systems and preventing misuse. I consider whether the use is necessary and balance these interests against your rights and reasonable expectations. You may ask for more information about that assessment.

7. Marketing Communications

I may send marketing only where permitted by data protection law and the Privacy and Electronic Communications Regulations. Where consent is required, I will ask for a clear, separate choice. Where the law permits legitimate interests, I will consider your reasonable expectations and privacy impact.

You can stop marketing at any time by using an unsubscribe link or contacting [email protected]. Stopping marketing will not stop service messages about an enquiry, contract, invoice or security matter.

8. Cookies And Similar Technologies

The website may use strictly necessary technologies to operate securely. Analytics, preference, advertising or other non-essential technologies will be used only in accordance with applicable consent requirements. The live Cookie Policy and cookie settings should identify each technology, provider, purpose and lifespan. Cookie Policy.

9. Special Category And Criminal-Offence Information

I do not intentionally request sensitive ‘special category’ information (for example, health, ethnicity, religion, political opinions, trade-union membership, sexual life or orientation, genetic or biometric data) or criminal-offence information for ordinary enquiries or website use. Please do not send it unless it is necessary and agreed in advance.

If this information is genuinely required for a service, I will identify both an Article 6 lawful basis and the additional legal condition required for that category, apply appropriate safeguards and document the arrangement. When acting as a client’s processor, I will follow that client’s lawful instructions.

10. If You Do Not Provide Information

You may choose whether to provide information for general website browsing. However, some details are needed to answer an enquiry, prepare a quote, enter into a contract, deliver services, verify instructions or meet legal obligations. If required information is not provided, I may be unable to proceed or may need to suspend or end the relevant service. I will explain this where it applies.

11. Who I Share Information With

I share only what is reasonably necessary with recipients such as:

website hosting, content-management, security, analytics and technical-support providers;

email, communications, video-meeting, calendar, file-storage, CRM and project-management providers;

accounting, invoicing, banking and payment providers;

professional advisers, including accountants, insurers, IT advisers and legal advisers;

subcontractors or associates engaged for agreed work, under appropriate confidentiality and data-protection terms;

government bodies, regulators, courts, law enforcement or other parties where required by law or necessary to protect rights; and

a buyer, investor or adviser in connection with a proposed sale, reorganisation or transfer of the business, subject to appropriate safeguards.

Key providers used at publication may include website hosting and security providers, contact-form and email providers, calendar or booking tools, file-storage and CRM systems, accounting and payment providers, analytics tools and professional advisers. These providers are used only where reasonably necessary to operate the website, respond to enquiries, provide services, manage bookings, keep records, process payments, maintain security, comply with legal obligations and protect the business. I do not sell personal information.

12. International Transfers

Some service providers may store or access information outside the UK. Before making a restricted transfer, I will use a lawful transfer mechanism, such as UK adequacy regulations or an appropriate safeguard (for example, the UK International Data Transfer Agreement or UK Addendum), and complete any assessment required. You may contact me for information about the relevant safeguard and how to obtain a copy, subject to lawful redactions.

Transfer position at publication: some providers may process or store information outside the UK, depending on the systems used for hosting, email, file storage, analytics, booking, payment processing and business administration. Where a restricted international transfer is made, I will use an appropriate safeguard under UK data protection law, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism.

13. How Long I Keep Information

I keep information only for as long as reasonably necessary for the purpose collected, including legal, tax, accounting, insurance and dispute requirements. I consider the amount, nature and sensitivity of the information, risk of harm, purpose and whether the result can be achieved another way.

At the end of the relevant period, information will be securely deleted or anonymised unless continued retention is lawful and necessary.

14. Security

I use proportionate technical and organisational measures designed to protect personal information against accidental or unlawful loss, alteration, disclosure, access or destruction. Measures may include access controls, strong authentication, encryption where appropriate, supported software, secure backups, confidentiality commitments, supplier checks, device security and incident procedures.

No internet or storage system is completely secure. If a personal-data breach occurs, I will investigate, limit harm and notify affected people and the ICO where the law requires.

15. Your Data Protection Rights

Depending on the circumstances and lawful basis, you may have the right to:

be informed about how your information is used;

ask for access to your personal information and a copy of it;

ask for inaccurate information to be corrected and incomplete information completed;

ask for information to be erased in certain circumstances;

ask for use of information to be restricted in certain circumstances;

receive information you provided in a structured, commonly used, machine-readable format and ask for it to be transferred where the portability right applies;

withdraw consent at any time, without affecting earlier lawful use based on consent; and

raise concerns with the Information Commissioner’s Office.

16. Your Right To Object

You have an absolute right to object to the use of your personal information for direct marketing. You may also object to processing based on legitimate interests. In that case, I will stop unless I can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the information is needed for legal claims.

17. How To Exercise Your Rights

Contact [email protected] or use the postal address above. Please describe your request clearly. I may ask for information needed to confirm your identity and locate the relevant records. I will respond without undue delay and normally within one month, although the law allows an extension for certain complex or multiple requests. Rights are not absolute, and I will explain any lawful refusal or limitation. There is normally no fee, but a reasonable fee or refusal may be permitted for manifestly unfounded or excessive requests.

18. Automated Decisions And Profiling

I do not currently make decisions about you based solely on automated processing, including profiling, that produce legal or similarly significant effects. If that changes, I will update this policy and provide the information and safeguards required by law.

19. Children

This website and these business services are intended for adults and business contacts, not children. I do not knowingly collect personal information from children through the website. If you believe a child has provided information, please contact me so I can review and, where appropriate, delete it.

20. External Websites

Links to third-party websites or services are provided for convenience. Those organisations decide how they use information collected through their services, and their own privacy notices apply. I am not responsible for their privacy practices.

21. Complaints

Please contact me first so I have an opportunity to resolve your concern. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK supervisory authority:

Website: https://www.ico.org.uk/make-a-complaint/

Telephone: 0303 123 1113

Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

If you are outside the UK, you may also have a right to contact the data-protection authority where you live or work.

22. Changes To This Policy

I will review this policy when services, systems, providers or legal requirements change. The latest version will appear on this website with its revision date. If a change materially affects how I use information already collected, I will take reasonable steps to bring it to your attention before the new use begins where required.

23. Contact

Questions about this policy or how personal information is handled should be sent to:

It’s Me Grace / Grace Baker
Email: [email protected]

Post: 45 The Churchills, Newton Abbot, TQ12 2JL
Telephone: 07308910696