Privacy Policy

Controller: Nick Wilson trading as Nick Does Business. Address: 20 Wenlock Road, Hoxton, Hackney, London N1 7GU, United Kingdom; email hello@nick-does-business.com. This policy covers personal data processed through nick-does-business.com; it does not govern the separate Got2Glam application. 6.1 Information we collect Depending on how you use the Site, we collect names, contact details, country, business or company details, billing and address information, enquiries, offer amounts and messages, reservation and transaction records, payment references and status (not card numbers), terms acceptances and declarations, handover confirmations, support messages, business-availability alert requests, administrator account details, and technical security information such as hashed IP identifiers and server logs. 6.2 Why we use information and lawful bases - To respond to enquiries, evaluate offers and manage purchases, reservations, handovers and support: steps requested before a contract and performance of a contract, or legitimate interests where appropriate. - To process and reconcile payments, maintain tax and accounting records and comply with legal obligations: contract and legal obligation. - To secure the Site, prevent spam, investigate abuse and maintain audit records: legitimate interests in operating a secure business, balanced against your rights. - To send business-availability alerts you request: your request and consent; you can unsubscribe at any time. - To administer authorised administrator accounts: legitimate interests and operational necessity. 6.3 Who receives data We use service providers that process personal data on our behalf to run the Site: - our website and database hosting provider (Lovable, operated by Lovable Labs AB, Sweden), which also provides administrator sign-in and file storage and uses specialist infrastructure providers; - our content-delivery and security provider (Cloudflare), which processes connection information such as IP addresses to deliver and protect the Site; - our hosting provider's managed email service, which sends transactional emails such as confirmations and reminders; - Stripe, our card payment processor, which receives the details needed to take and refund card payments. The Site's fonts are hosted on the Site itself; we do not use analytics or advertising services. Professional advisers, banks, regulators or authorities may receive information where necessary and lawful. We do not sell personal data. 6.4 Where data is processed We use third-party hosting, infrastructure, content-delivery and email services to run the Site. Our main database is hosted in the European Union (Ireland). Our providers and their sub-processors may process personal data in other countries, including countries outside the UK and the European Economic Area, so your personal data may be processed internationally. Where personal data is transferred outside the UK, we aim to ensure the transfer complies with UK data protection law. You can ask us for more information about international transfers at hello@nick-does-business.com. 6.5 Retention We keep personal data only for as long as we need it for the purposes above. Our retention periods are: - general enquiries and questions: 24 months after the last interaction; - unsuccessful offers: 24 months after final activity; - business-availability alerts: until you unsubscribe, or 24 months after last activity; - abandoned or unsuccessful purchase requests: 12 months after closure; - completed purchases, signed agreements and handover records: 6 years after completion; - payment and accounting records: 6 years after the end of the relevant financial year; - terms acceptance records: 6 years after the related transaction closes, because they evidence what was agreed; - support records: 24 months after support ends; - email delivery records: 90 days; - anti-spam security logs: 30 days. We check our records against these periods with an automated daily review. Automated deletion is not yet switched on, so some records may currently be kept beyond these periods until they are removed or anonymised. We may keep data longer where the law requires it or where it is needed for a dispute, legal claim or investigation. Administrator sign-in logs are held by our hosting provider under its own retention practices. 6.6 Your rights Subject to applicable conditions and exemptions, you may request access, correction, deletion, restriction, portability, or object to certain processing. Where consent is the lawful basis, you may withdraw it without affecting earlier lawful processing. Contact hello@nick-does-business.com. You may complain to the UK Information Commissioner's Office (ICO) at ico.org.uk. 6.7 Security We use access controls, private transaction links, authentication and operational safeguards. We do not collect full card details on our own servers; card payments are handled by Stripe. No internet service is completely risk-free. 6.8 Children and other websites Business purchases are intended for adults aged 18 or over. External websites linked from listings have their own privacy practices. We may update this policy from time to time; the version and effective date are shown at the top. 6.9 Cookies See our Cookie Policy. We use only the cookies and storage needed to deliver and secure the Site, including a security cookie set by our content-delivery provider. We do not use analytics or advertising cookies or tracking pixels. Giveaway entries. If you enter the Business Giveaway, I collect your first name and email address, the date of entry, the version of the giveaway terms in force, and a one-way hashed (non-reversible) value derived from your connection, used only for rate limiting. I use this to administer entries, run each draw, contact and verify a selected winner, keep draw records, and handle withdrawals. The lawful basis is performance of the giveaway terms you accept by entering (and, for draw records and fraud prevention, my legitimate interests in running a fair draw). Entering does not subscribe you to marketing, and I do not send marketing to entrants. A selected winner may be asked for evidence of age, identity and UK residence; that evidence is used only for verification and deleted within 90 days of the prize being awarded or declined. If a winner is awarded the cash alternative, I also collect the account name, sort code and account number of a UK bank account in the winner's name. I use them only to pay the prize, delete the full account number within 90 days of a confirmed payment, and keep only the payee name, amount, date and payment reference in my accounting records for 6 years after the end of the financial year, to meet tax and accounting obligations. If a winner is awarded a business, the emails exchanged during the 12 months of business guidance are kept for the guidance period and 12 months after it ends, so questions about the guidance can be answered, and then deleted, unless they are needed for an open complaint or legal claim. The business transfer itself is governed by the written transfer agreement and its records follow the completed-purchase retention above. The winner's surname, county and prize may be published or made available on request as described in the Giveaway Terms, unless the winner objects; the lawful basis is my legitimate interests in running a transparent prize draw that complies with the UK Code of Non-broadcast Advertising. Active entries are kept while the giveaway runs. If you withdraw or your entry is invalidated, your entry is kept as an inactive record for up to 12 months so draws remain auditable, then deleted or anonymised; draw records that identify a winner are kept for up to 6 years. You can withdraw at any time using the link in your confirmation email or by emailing hello@nick-does-business.com, and you have the rights of access, rectification, erasure (subject to draw-record keeping), restriction, objection and complaint to the ICO described in this policy.