Privacy Notice

Introduction

I am committed to safeguarding the privacy of my website visitors and clients.

This privacy notice tells you what to expect me to do with your personal information when you make contact with me or engage as a client.

ICO Registration Reference: ZC229075

Controller's Contact Details

I, Patrick Cantellow, act as the data controller for information acquired via my website, or information you have shared directly with me.

If you need to contact me regarding your privacy, please use the contact form here, or via post.

My postal address: 13 Tonite Lane, Faversham, Kent, ME13 7FX.

Lawful bases for processing

Under UK GDPR, I must have a lawful basis for processing your personal information. The bases I rely on are:

• Contract - to provide the services you have engaged me for, including corresponding with you, delivering the work, and invoicing.
• Legitimate interests - to respond to enquiries, manage my client relationships, keep business records, and promote my services in a way you would reasonably expect. Where I rely on legitimate interests, I have considered whether it is fair to you, and you can object at any time (see 'Your right to object to processing').
• Legal obligation - to comply with my legal and regulatory duties, such as keeping accounting and tax records.
• Consent - where I have asked for it, for example to send you marketing. Where I rely on consent, you can withdraw it at any time.

I will only use your personal information for the purpose I collected it for, unless I reasonably consider I need to use it for a related and compatible purpose.

How do I get personal information?

Most of the personal information I process is provided to me directly by you for one of the following reasons:

• You made an enquiry
• You shared your business card with me at an event
• I am representing your organisation

In some circumstances, I may have received your personal information via a third-party because they referred me to you. If this is the case, I have asked the third party to confirm that they have been given permission by you to pass on your personal details.

What information do I hold and process and for how long for?

See the 'How do I get personal information' section to see how I get your personal information.

The personal information I hold and process may include:

• full name
• email address
• telephone number
• postal address
• bank details
• data obtained via the website (see cookie policy)

If I have notified you that your personal information will be shared with third-parties, please see "Third-party" section below.

I only hold your personal information for as long as it is needed for the purpose it was collected for. Other data, such as client information (invoices, work etc.) is held for 6 years since the last engagement, in line with legal and accounting requirements. This data may include your personal information.

Your data protection rights

Under data protection law, you have rights that I need to make you aware of.

Your right to access

You have the right to ask me for the copies of your personal information I hold.

I can tell you:

• What personal information I hold about you
• How I am using it
• Who I am sharing it with
• Where I got your data from

In some cases I may not be able to provide all the information you ask for, for example where it includes another person's personal information or is subject to a legal exemption.

Your right to rectification

You have the right to ask me to rectify your personal information you think is inaccurate. You can also ask me to complete information you think is incomplete.

Your right to erasure

You have the right to ask me to erase your personal information in certain circumstances:

• The personal information I hold about you is no longer needed for the original reason I collected or used it for
• You initially consented to me to using your personal information, but you have now withdrawn your consent
• You have objected to me using your personal information, and your interests outweigh those of mine
• You have objected to the use of your personal information for direct marketing purposes
• You believe I haven't collected or used your data lawfully (see 'Making a complaint' section)
• I have a legal obligation to erase your personal information

Your right to restriction of processing

You have the right to ask me to restrict the processing of your personal information in certain circumstances.

You can ask me to temporarily limit the use of your personal information when:

• You have challenged the accuracy of your personal information;
• You have objected to my use of your personal information and I am considering whether my legitimate grounds override yours;
• You believe I have processed your personal information unlawfully but do not want it deleted (see 'Making a complaint' section); or
• you believe I no longer need your personal information but you want me to keep it in order to create, exercise or defend legal claims.

Your right to object to processing

You have the right to object the processing of your personal information.

Your right to data portability

This only applies to information you have given me (see 'Personal information I may collect' section). You have the right to ask me to transfer your personal information you gave me from myself to another organisation, or give it to you.

Your right to withdraw consent

Where I am relying on your consent to process your personal information, you can withdraw that consent at any time. This will not affect the lawfulness of any processing carried out before you withdraw.

Sharing your information

In some circumstances I may need to share your personal information with third-parties to deliver on my services or under legitimate interest.

I will always notify you before this takes place - unless it is in regards to a legal request where I am compelled to not notify you.

Please see the third-party privacy notices below if I have told you this will take place.

International transfers

As an async-first consultant, I may use or process your personal information while working outside the UK and EU, and some of the third parties I use (see below) may store or process data outside the UK. Wherever your personal information is transferred outside the UK, I take reasonable steps to ensure it remains protected to a standard consistent with UK data protection law. For example by replying on an adequacy decision or appropriate safeguards such as contractual clauses. UK data protection law continues to apply to my processing of your personal information regardless of where I am working from.

Automated decision-making

I do not make decisions about you based solely on automated processing, and I do not carry out profiling that produces legal or similarly significant effects.

Cookies

My website may use cookies and similar technologies to help it function and to understand how visitors use it. Full details of the cookies used, and how to manage them, are set out in my separate Cookie Policy.

Your right to complain

You have the right to complain about how I have handled your personal information. If you have queries or concerns, please contact me using the details in the 'Controller's contact details' section.

If you remain dissatisfied, you can make a complaint about the way I have processed your personal information to the Information Commissioner's Office (ICO) as the UK supervisory authority. You can do that here.

Changes to this privacy policy are found below

27 August 2026 - Privacy notice first published

Important note

Please note, as an async-first consultant, I may be working remotely outside of the UK and EU. As a result, I could become subject to different laws which may result in you having improved or reduced rights than what you have in the UK.

Third-Party Privacy Notice

Introduction

Please read this information carefully if I have told you that your personal information will be shared with a third-party in order to proceed with my services to you.

If I have told you that your personal information will be shared with FreeAgent Central Limited ("FreeAgent").

In order to deliver billing and invoice operations your personal information will be shared with FreeAgent.

This personal information may include:

• full name
• postal address
• telephone
• email address
• bank account details

I remain responsible for the up-keep of this information.

FreeAgent's Privacy Policy can be viewed here.

FreeAgent may use subprocessors to deliver their services to me. These may include subprocessors who store data outside of the EU, where data protections may not be the same. You can view FreeAgent's subprocessors here.

It is my legitimate interest to share your personal information with FreeAgent. If you object, I cannot deliver my services to you.

If you book me for a growth diagnostic consultation using the 'Book a growth diagnostic' button on my website, your information will be shared with Cal.com, Inc.

If you book a growth diagnostic consultation via the 'Book a growth diagnostic' button, your information will be shared with Cal.com, Inc ("Cal.com"), for the purposes of arranging and facilitating our meeting.

This information may include:

• full name
• email address

Cal.com's privacy policy can be viewed here.

Cal.com may use subprocessors to deliver their services to me. These may include subprocessors who store data outside of the EU, where data protections may not be the same. You can view Cal.com's subprocessors here.

It is my legitimate interest to share your personal information with Cal.com. If you object, I cannot deliver my services to you.

If you book me for a growth diagnostic consultation using the 'Book a growth diagnostic' button on my website, your information will be shared with Zoom Communications, Inc.

If you book a growth diagnostic consultation via the 'Book a growth diagnostic' button, your information will be shared with Zoom Communications, Inc. ("Zoom"), for the purposes of arranging and facilitating our meeting.

This information may include:

• full name
• email address

Zoom's privacy policy can be viewed here.

Zoom may use subprocessors to deliver their services to me. These may include subprocessors who store data outside of the EU, where data protections may not be the same. You can view Zoom's subprocessors here.

It is my legitimate interest to share your personal information with Zoom. If you object, I cannot deliver my services to you.

Changes to this third party privacy policy are found below

27 August 2026 - Privacy notice first published