Privacy Policy

Controller: Nick Wilson trading as Nick Does Business. Address: 20 Wenlock Road, Hoxton, Hackney, London N1 7GU, United Kingdom; email hello@nick-does-business.com. This policy covers personal data processed through nick-does-business.com; it does not govern the separate Got2Glam application. 6.1 Information we collect Depending on how you use the Site, we collect names, contact details, country, business or company details, billing and address information, enquiries, offer amounts and messages, reservation and transaction records, payment references and status (not card numbers), terms acceptances and declarations, handover confirmations, support messages, business-availability alert requests, administrator account details, and technical security information such as hashed IP identifiers and server logs. 6.2 Why we use information and lawful bases - To respond to enquiries, evaluate offers and manage purchases, reservations, handovers and support: steps requested before a contract and performance of a contract, or legitimate interests where appropriate. - To process and reconcile payments, maintain tax and accounting records and comply with legal obligations: contract and legal obligation. - To secure the Site, prevent spam, investigate abuse and maintain audit records: legitimate interests in operating a secure business, balanced against your rights. - To send business-availability alerts you request: your request and consent; you can unsubscribe at any time. - To administer authorised administrator accounts: legitimate interests and operational necessity. 6.3 Who receives data We use service providers that process personal data on our behalf to run the Site: - our website and database hosting provider (Lovable, operated by Lovable Labs AB, Sweden), which also provides administrator sign-in and file storage and uses specialist infrastructure providers; - our content-delivery and security provider (Cloudflare), which processes connection information such as IP addresses to deliver and protect the Site; - our hosting provider's managed email service, which sends transactional emails such as confirmations and reminders; - Stripe, our card payment processor, which receives the details needed to take and refund card payments. The Site's fonts are hosted on the Site itself; we do not use analytics or advertising services. Professional advisers, banks, regulators or authorities may receive information where necessary and lawful. We do not sell personal data. 6.4 Where data is processed We use third-party hosting, infrastructure, content-delivery and email services to run the Site. Our main database is hosted in the European Union (Ireland). Our providers and their sub-processors may process personal data in other countries, including countries outside the UK and the European Economic Area, so your personal data may be processed internationally. Where personal data is transferred outside the UK, we aim to ensure the transfer complies with UK data protection law. You can ask us for more information about international transfers at hello@nick-does-business.com. 6.5 Retention We keep personal data only for as long as we need it for the purposes above. Our retention periods are: - general enquiries and questions: 24 months after the last interaction; - unsuccessful offers: 24 months after final activity; - business-availability alerts: until you unsubscribe, or 24 months after last activity; - abandoned or unsuccessful purchase requests: 12 months after closure; - completed purchases, signed agreements and handover records: 6 years after completion; - payment and accounting records: 6 years after the end of the relevant financial year; - terms acceptance records: 6 years after the related transaction closes, because they evidence what was agreed; - support records: 24 months after support ends; - email delivery records: 90 days; - anti-spam security logs: 30 days. We check our records against these periods with an automated daily review. Automated deletion is not yet switched on, so some records may currently be kept beyond these periods until they are removed or anonymised. We may keep data longer where the law requires it or where it is needed for a dispute, legal claim or investigation. Administrator sign-in logs are held by our hosting provider under its own retention practices. 6.6 Your rights Subject to applicable conditions and exemptions, you may request access, correction, deletion, restriction, portability, or object to certain processing. Where consent is the lawful basis, you may withdraw it without affecting earlier lawful processing. Contact hello@nick-does-business.com. You may complain to the UK Information Commissioner's Office (ICO) at ico.org.uk. 6.7 Security We use access controls, private transaction links, authentication and operational safeguards. We do not collect full card details on our own servers; card payments are handled by Stripe. No internet service is completely risk-free. 6.8 Children and other websites Business purchases are intended for adults aged 18 or over. External websites linked from listings have their own privacy practices. We may update this policy from time to time; the version and effective date are shown at the top. 6.9 Cookies See our Cookie Policy. We use only the cookies and storage needed to deliver and secure the Site, including a security cookie set by our content-delivery provider. We do not use analytics or advertising cookies or tracking pixels. Giveaway entries. If you enter the Business Giveaway, I collect your first name and email address, the date of entry, the version of the giveaway terms in force, and a one-way hashed (non-reversible) value derived from your connection, used only for rate limiting. I use this to administer entries, run each draw, contact and verify a selected winner, keep draw records, and handle withdrawals. The lawful basis is performance of the giveaway terms you accept by entering (and, for draw records and fraud prevention, my legitimate interests in running a fair draw). Entering does not subscribe you to marketing, and I do not send marketing to entrants. A selected winner may be asked for evidence of age, identity and UK residence; that evidence is used only for verification and deleted within 90 days of the prize being awarded or declined. If a winner is awarded the cash alternative, I also collect the account name, sort code and account number of a UK bank account in the winner's name. I use them only to pay the prize, delete the full account number within 90 days of a confirmed payment, and keep only the payee name, amount, date and payment reference in my accounting records for 6 years after the end of the financial year, to meet tax and accounting obligations. If a winner is awarded a business, the emails exchanged during the 12 months of business guidance are kept for the guidance period and 12 months after it ends, so questions about the guidance can be answered, and then deleted, unless they are needed for an open complaint or legal claim. The business transfer itself is governed by the written transfer agreement and its records follow the completed-purchase retention above. The winner's surname, county and prize may be published or made available on request as described in the Giveaway Terms, unless the winner objects; the lawful basis is my legitimate interests in running a transparent prize draw that complies with the UK Code of Non-broadcast Advertising. Active entries are kept while the giveaway runs. If you withdraw or your entry is invalidated, your entry is kept as an inactive record for up to 12 months so draws remain auditable, then deleted or anonymised; draw records that identify a winner are kept for up to 6 years. You can withdraw at any time using the link in your confirmation email or by emailing hello@nick-does-business.com, and you have the rights of access, rectification, erasure (subject to draw-record keeping), restriction, objection and complaint to the ICO described in this policy. 6.10 Build With Nick questionnaire and applications Information collected. The questionnaire asks about your main motivation for building an online business; previous business experience; investment budget band; weekly time available; and preferred starting timeframe. If you select "Something else" as your motivation, you may provide a short optional explanation (up to 500 characters). Please do not include sensitive personal information. We record these answers, the budget-based recommendation, and dates when the questionnaire is started or completed. Visitors recommended the community are not asked for contact details. Only if you choose to submit a private programme application do we collect your full name, email address and optional phone number and record the submission date. Authorised administrators may record application status, private review notes, review dates and an audit history of status changes and notes. Session and security information. A randomly generated questionnaire identifier and your draft answers are held in browser session storage to retain progress during your visit. The database stores a SHA-256 hash of this identifier, not the original identifier. This is pseudonymised information, not anonymous data, and may be linked to your contact details if you apply. We also store a one-way hashed connection identifier and the time of new session creation in our private anti-spam log to limit automated abuse; we do not store the raw IP address in the application record. Infrastructure providers may process connection information as described in sections 6.3 and 6.4. The hidden anti-spam field is used only to reject automated submissions. Purposes and lawful bases. We use questionnaire answers to recommend a suitable next step and, when you request it, to assess your application, contact you about it and discuss possible programme participation. For a requested application and pre-contract discussions we rely on steps taken at your request before entering into a contract (UK GDPR Article 6(1)(b)). For the initial recommendation, secure operation, proportionate abuse prevention, application administration and a limited review audit trail, we rely on legitimate interests (Article 6(1)(f)) in responding to prospective clients and running a secure and accountable business, balanced against your rights. Investment budget alone determines whether the questionnaire recommends the community or allows an application; all submitted applications are personally reviewed, and the recommendation is not an automated acceptance decision. We do not use these answers to subscribe you to marketing. You may object to processing based on legitimate interests using the contact details below. Access and providers. Only authorised administrators may read programme application information and review history. Anonymous visitors cannot browse or retrieve application records. Lovable provides the website hosting, database storage and administrator authentication; Cloudflare provides delivery and security; and Lovable's managed email service sends the internal new-application notification. That notification links to the protected admin application page; it does not include your answers or contact details in its body. Nick uses your contact details to respond to your application. Hosting locations, sub-processors and international processing are described in sections 6.3 and 6.4. Programme questionnaire processing does not require Stripe payment details. Retention and deletion arrangements. Questionnaire access expires 30 days after the session is created. Expiry prevents further completion or submission; it does not currently delete the underlying answers. The existing automated retention review does not include programme applications or review history, and automated deletion is not enabled. No automatic programme deletion period is currently implemented. We retain and review information only for as long as necessary to assess and respond to applications, manage any ongoing discussions and deal with justified complaints or legal obligations. A separate programme retention schedule and deletion or anonymisation procedure must be approved and implemented before a fixed deletion deadline can be promised. Submitted applications include an append-only review history: erasure requests therefore require an authorised assessment and a safe deletion or anonymisation procedure rather than an applicant-facing delete button. Legal obligations or an active dispute may justify retaining limited information for longer; this does not justify indefinite retention of all answers. The security log follows the 30-day anti-spam retention target and the existing not-yet-enabled deletion arrangements in section 6.5. Browser session storage is separate from database retention and is cleared on successful application submission or when the browser ends the tab session, subject to browser behaviour. Your rights and contact. The rights and applicable conditions in section 6.6 apply to programme information, including access, correction, erasure, restriction, portability where applicable, objection to legitimate-interest processing, and complaint to the ICO. Contact hello@nick-does-business.com to exercise these rights, withdraw an application, or ask about retention. We may need proportionate information to verify your identity before responding. Withdrawal does not by itself erase information needed for a lawful, limited purpose.