Privacy Policy

Privacy Policy (Helen Thornton)

Last updated: 14 September 2026

This Privacy Policy explains how I, Helen Thornton, collect and use personal data when you visit helenthornton.com, contact me, subscribe to updates, or book services, courses or webinars.

I am the data controller for the personal data described in this policy. UK data protection law requires me to give you clear privacy information about what I do with your data.

1) Who I am and how to contact me

Controller: Helen Thornton (UK-based, Lincolnshire)

Contact

• Website contact form

• Telephone: +44 (0)7947 623923

• Email: helen@helenthornton.com

2) The personal data I collect

I may collect the following, depending on how you interact with me:

A. Information you provide

• Name, email address and telephone number

• Your location (e.g. yard, town or postcode area) so I can plan visits

• The content of your enquiry (what you write in the contact form or email)

• Booking details (service requested, dates and practical arrangements)

• If you subscribe: your name (if provided) and email address

• If you tick a marketing opt-in: your preference to receive emails from me

• Any photos or videos you choose to send me (for example, to show a movement concern)

B. Website usage information (Google Analytics)

• Technical and usage data such as IP address, device/browser type, pages visited, time on site and how you arrived at the site. I use this to understand how people use my website and to improve it.

C. Payment information

• If you pay online, payment and transaction information is processed through the platform through which you make the purchase or booking. I receive the information needed to administer the transaction and booking, but I do not receive your full payment card details.

3) How I use your data and my lawful bases

UK GDPR requires a lawful basis for each type of processing.

A. To reply to your enquiry and communicate with you

• What I do: respond to messages, answer questions and arrange calls or appointments

• Lawful basis: legitimate interests (running my business and responding to requests), and/or contract if you are booking a service

B. To deliver the service you book

• What I do: schedule visits, provide the service and keep essential administration records

• Lawful basis: contract (to provide what you requested)

C. To send emails you have opted into

• What I do: send occasional updates, relevant news, educational information or booking availability only if you subscribe or actively opt in

• Lawful basis: consent (you can withdraw this at any time)

D. Website analytics (Google Analytics)

• What I do: measure site usage so I can improve content and structure

• Lawful basis: consent for non-essential cookies and analytics technologies

E. Legal and regulatory obligations

• What I do: keep appropriate records for tax/accounting and deal with disputes if needed

• Lawful basis: legal obligation (for certain records) and legitimate interests (for protecting and asserting legal rights)

You do not have to opt into marketing. If you contact me without opting in, I will use your details to respond to your enquiry, but I will not add you to my marketing emails.

4) Subscribing and marketing preferences

If you subscribe on the website or actively opt in to marketing when completing a form or booking process, I may send you occasional emails.

Booking a course, webinar, event or other service does not automatically add you to my marketing email list. Where a separate marketing opt-in is offered, I use that preference to determine whether you have agreed to receive marketing emails from me.

• You can unsubscribe at any time using the link in my emails or by contacting me.

• Withdrawing consent will not affect the lawfulness of emails sent before you unsubscribed.

• You can object to direct marketing at any time, and I will stop sending it.

5) Who I share your data with

I do not sell your personal data.

I share personal data only where necessary to run my website and business, administer bookings and provide services. I use service providers that process information as part of providing their services.

Website platform, email marketing and website transactions

• Squarespace – hosts my website, processes website form submissions and subscription details, manages my email subscriber list and Email Campaigns, and processes transactions made through my Squarespace website.

Course bookings

• TicketSource – manages bookings, payments and delegate administration for some courses and events. If you book through TicketSource, it processes the booking and payment information you provide so I can administer your place and communicate with you about the event.

Webinar and event bookings

• Eventbrite – manages bookings, payments and delegate administration for some webinars and events. If you book through Eventbrite, it processes the information you provide when booking so I can administer your place and communicate with you about the event.

Where Eventbrite provides a separate marketing opt-in, I use that preference when determining whether you have agreed to receive marketing emails from me. Purchasing or registering for an event does not by itself mean that you have subscribed to my marketing emails.

Analytics

• Google Analytics (Google LLC) – helps me understand how my website is used and how I can improve it. Analytics cookies are used only where the applicable consent requirements have been met.

Professional advisers and legal requirements

• I may also share personal data with professional advisers, such as my accountant or legal advisers, where necessary, and with authorities where I am required to do so by law or where necessary to establish, exercise or defend legal claims.

6) International transfers

Some providers I use, for example website hosting, analytics or email tools, may process data outside the UK, including in the USA.

Where international transfers apply, appropriate safeguards permitted under UK data protection law are used. These can include transfers to US organisations covered by the UK Extension to the EU-US Data Privacy Framework, where applicable, or other approved safeguards.

7) How long I keep your data

I keep personal data only as long as needed for the purpose for which it was collected.

Typical retention periods:

• Enquiries (no booking): up to 12 months after the last contact

• Bookings and essential service administration records: typically up to 3 years after the last appointment

• Subscription list: until you unsubscribe, and for a period afterwards where necessary to record your unsubscribe and prevent you being added again by mistake

• Financial records (invoices/receipts): typically up to 6 years to meet tax and accounting obligations

I may keep information longer where necessary for legal claims or compliance.

8) Cookies and Google Analytics

I use cookies and similar technologies.

• Strictly necessary cookies help the website function.

• Optional non-essential cookies, including analytics cookies where applicable, are used subject to the relevant consent requirements.

Google Analytics uses cookies and related technologies to help me understand how the website is used. You can manage your cookie preferences through the cookie controls provided on the website, where available, and through your browser settings.

9) Your rights

You have rights under UK data protection law. Depending on the circumstances, these can include:

• access to your personal data

• rectification of inaccurate information

• erasure

• restriction of processing

• objection to processing

• data portability

• withdrawing consent where I rely on consent

• complaining to the Information Commissioner’s Office (ICO)

To exercise your rights, please contact me using the details in section 1.

10) Complaints

If you have a concern or complaint about how I have handled your personal data, please contact me using the details in section 1 and explain what you are concerned about.

I will consider your complaint and respond as soon as reasonably possible.

If you remain unhappy with how I have handled your personal data or your complaint, you also have the right to complain to the Information Commissioner’s Office (ICO), the UK data protection regulator.

11) Security

I use reasonable technical and organisational measures to protect personal data. However, no online system is completely secure, so please avoid sending sensitive personal information by email unless necessary.

12) Changes to this policy

I may update this policy from time to time. The latest version will be published on my website with an updated “Last updated” date.