This notice explains what personal information I collect when you use this website or get in touch with me, why I collect it, who I share it with and what your rights are. I have tried to write it in plain English. If anything is unclear, please ask.
Who I am
The Red Giant is a trading name of Rufus Curnow, a sole trader based in Stockport, UK (full address available on request). I am the data controller for the personal information described here, which means I decide how and why it is used. There is no separate data protection officer, so any questions come to me at rufus@theredgiant.co.uk.
What I collect, and why
When you use the contact form
The form asks for your name, your email address and your message. I use these to reply to you and to deal with whatever you have asked about. The legal basis is my legitimate interest in responding to people who contact me, and where your enquiry is about working together, taking the steps you have asked for before any contract.
When you book a call
Calls are booked through a Google Calendar appointment page. Google collects the details you enter there, normally your name and email address, and shares them with me so that I can hold the call. Google's own privacy notice also applies to that page. I use your details to run the call and follow up on it, on the same legal basis as the contact form.
When you email me
If you email me directly, I keep your message and my reply so that I can deal with your enquiry and refer back to it later. Again, the legal basis is legitimate interest.
If we go on to work together
If you become a client, I keep a record of our correspondence, the work we agreed and the invoices between us. I need this to deliver the work and to meet my legal obligations, including keeping business records for tax purposes. I also keep a simple record of the people and organisations I have dealt with so that I can stay in touch about relevant work. You can ask me to stop at any time.
Training sessions and events
When you take part in a session I run online, the meeting platform (usually Microsoft Teams, Google Meet or Zoom) processes your name, your email address and anything you say or type during the session. Sessions are not recorded unless that has been agreed in advance and everyone taking part has been told. Where a client has commissioned the training, the client decides how its people's information is used and its own privacy notice applies, and any participant list the client gives me is deleted once the work is delivered.
Before and after many sessions I ask participants to complete a short survey about their confidence and use of AI. I use the answers to shape the session and to show what changed, and I report them to the client only in aggregate, never as individual responses. Once the engagement has been reported, I remove anything that could identify a person and keep the anonymised results indefinitely, so that I can see how things change over time.
For events I run myself, such as free talks and the speaker series, the booking platform collects your name and email address so that you can be sent the joining details, and I use them for nothing else.
When you visit the site
The site is hosted by Netlify. Like every web host, Netlify records technical information about each visit in its server logs, including your IP address, the pages requested, the time of the request and the browser used. This is needed to deliver the pages to you and to keep the site secure.
To see which pages are being read, I use Umami, a privacy-focused analytics service. It counts page views and records the general location (country and city), browser, operating system and device type of visitors, without setting cookies and without building a profile of you. The reports I see do not show IP addresses or anything else that would let me identify you personally. To tell a returning visitor from a new one, it uses an anonymous code made from technical details of your visit, and that code changes every month.
The newsletter
My newsletter is published on Substack. This site links to it but does not collect subscriptions itself. If you subscribe, Substack collects your email address under its own privacy notice, and I am responsible for how the subscriber list is used. You can unsubscribe at any time using the link in every email.
Cookies
This site does not set cookies that track you or that need your consent. The analytics described above work without cookies. The web host may set a strictly necessary cookie to deliver the site securely, and the Google Calendar booking page and Substack set their own cookies when you use them, which are covered by their notices rather than this one.
Who I share your information with
I do not sell personal information, and I do not share it with anyone for marketing. The companies that process information on my behalf are the ones that run the services this site depends on.
- Netlify hosts the site and receives contact form submissions, which it stores and forwards to me by email. Netlify uses Akismet, a spam filtering service run by Automattic, to screen form submissions.
- Google provides my business email and calendar, including the call booking page, so any email or booking you send me passes through Google's systems.
- Umami provides the cookieless visitor statistics described above.
- Substack hosts and sends the newsletter.
Each of these companies acts on my instructions and under a written agreement about how personal information is handled. I may also disclose information where the law requires it.
Transfers outside the UK
Netlify, Google, Substack, Automattic and Umami are based in the United States, so information they process for me may be stored or handled there. Where a provider is certified under the UK Extension to the EU-US Data Privacy Framework, that certification is the basis for the transfer. Otherwise I rely on the provider's standard contractual protections that the UK recognises, which the provider includes in its data processing terms.
How long I keep information
- Enquiries and contact form submissions are kept in my email and on Netlify so that I can pick the conversation back up if you return. Once a year I review them and delete those that have led nowhere and that I have no reason to keep.
- Client records, including correspondence, agreements and invoices, are kept for six years after the end of the tax year in which the work finished, which is what HMRC requires for business records.
- Business contact records are reviewed at least once a year, and I remove people I no longer have a reason to contact.
- Server logs are kept by Netlify for a short period under its own retention rules.
Your rights
Under UK data protection law you have the right to ask me for a copy of the personal information I hold about you, to have it corrected if it is wrong, to have it deleted, to restrict how I use it, to object to my using it, and to receive it in a portable form where that applies. Where I rely on your consent, you can withdraw it at any time.
To exercise any of these rights, email me at rufus@theredgiant.co.uk. I will respond within one month. There is no charge, although I may ask you to confirm your identity first.
Complaints
If you are unhappy with how I have handled your information, please raise it with me first and I will do my best to put it right. You also have the right to complain to the Information Commissioner's Office, the UK regulator for data protection, at ico.org.uk or on 0303 123 1113.
Keeping your information secure
The services I use to hold information encrypt it in transit and at rest, and access to them is limited to me. My email and calendar accounts are protected with two-step verification. I delete information when I no longer need it, as set out above, and I would tell you and the Information Commissioner's Office if anything happened to your information that put you at risk.
A few other things
I do not make any automated decisions about you, and I do not use profiling. This site is aimed at organisations and the people who work in them, not at children, and I do not knowingly collect information from anyone under 18. The site links to other websites, including LinkedIn and Substack, and their privacy practices are their own.
Changes to this notice
I will update this notice if the way I handle information changes, and the date at the top will tell you when that last happened.
Contact
Questions about this notice or about your information: rufus@theredgiant.co.uk.