Privacy notice
Draft updated: 19 October 2026 · Effective date: [FILL date after review]
Draft for review — adapted from the ICO small-business privacy notice template. This notice is not ready for publication until the details below are completed and the processing arrangements are checked. [FILL] marks a missing detail; [CHECK] marks something you need to verify.
Details to confirm before publication
- Controller: &whateverworks Ltd, trading as Kata Spychala, London SW13 9LP, studio@kataspychala.com. [FILL] Company registration number, registration jurisdiction and full registered-office address still need confirmation.
- [CHECK] Lawful bases: approve the basis for each purpose. If using legitimate interests, document the interest, necessity and balancing assessment; if using contract, confirm that the enquiry is a step requested by the individual towards a contract with them.
- [FILL] Retention: specify how long unsuccessful enquiries, booking records and any resulting client records are kept, and how deletion and backups are handled.
- [CHECK] Providers and data: confirm the hosting, booking, email, calendar and video-call providers, their legal entities, the data they receive and their roles. Check technical logs and any other sources of personal information.
- [CHECK] Overseas processing: confirm storage and access locations, any restricted transfers outside the UK and the applicable adequacy decision or other safeguards.
- [CHECK] Analytics and booking: Plausible is enabled on kataspychala.com with its default cookieless script. Verify the final configuration (script settings and any custom events) and the booking-page fields and connected services.
- [CHECK] Rights and complaints: confirm the contact and process for handling requests, whether a data protection officer or representative must be listed, and whether automated decisions or profiling take place.
- [FILL] Effective date: add the date you approve this notice and remove review notes only after the underlying details have been confirmed.
This privacy notice tells you what to expect us to do with your personal information. It covers website enquiries and introductory call bookings under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Contact details
Data controller: &whateverworks Ltd, trading as Kata Spychala.
Postal address: London SW13 9LP. Privacy contact email: studio@kataspychala.com.
[CHECK] Confirm the legal entity responsible for deciding how your data is used. Add any required data protection officer or representative contact details.
What information we collect, use, and why
Website enquiries: we collect your name, work email, company (if supplied), the service you select and your message. The form stores these details and a submission timestamp in Lovable Cloud. We use them to respond to your enquiry and discuss the product support you are looking for.
You choose whether to send an enquiry. The form requires a name, valid email address, service selection and message; without them it cannot be submitted. Company is optional. Please do not include sensitive personal information in your message.
Introductory calls: the booking page opens in a new tab when you choose to book. Information you submit to Google is used to arrange your call. [CHECK] Confirm the final booking fields, any notes, connected calendar or video-call services and the technical information received when the booking page loads.
Website statistics: Plausible provides cookieless, aggregated visit statistics for kataspychala.com and is enabled. Plausible does not use cookies or collect personal data. [CHECK] Verify the final script configuration, and confirm whether hosting or security logs also contain IP addresses or other personal information.
Lawful bases and data protection rights
Under UK data protection law, we must have a ‘lawful basis’ for collecting and using your personal information. Which lawful basis we rely on may affect your data protection rights. Some rights have exemptions or apply only in particular circumstances.
Your right of access — you have the right to ask us for copies of your personal information, and information about where we get it from and who we share it with. Exemptions may mean you do not receive everything you ask for.
Your right to rectification — you have the right to ask us to correct or delete personal information you think is inaccurate or incomplete.
Your right to erasure — you have the right to ask us to delete your personal information.
Your right to restriction of processing — you have the right to ask us to limit how we use your personal information.
Your right to object to processing — you can object where this right applies, including processing based on legitimate interests.
Your right to data portability — where applicable, you can ask us to transfer the information you gave us to you or another organisation. This generally applies to automated processing based on consent or contract.
Your right to withdraw consent — when we use consent as our lawful basis, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing before you withdrew consent.
To make a data protection rights request, please use the contact details above. We must respond without undue delay and normally within one month. If the law permits extra time, we will explain the extension and the reason within that first month.
Our lawful bases for the collection and use of your data
[CHECK] Website enquiries and introductory bookings: proposed basis — legitimate interests in responding to requests about our services and arranging business discussions. Confirm that this use is necessary and complete a balancing assessment before adopting this basis.
[CHECK] Where an individual asks us to take steps towards entering a contract with them, contract may be the appropriate basis for those steps. Confirm the circumstances; an enquiry made by an employee on behalf of a company does not automatically meet this condition.
[CHECK] Confirm a separate purpose and lawful basis for any personal information in hosting or security logs and any other processing identified in the provider review. Do not assume that opening the booking page establishes GDPR consent for every subsequent use of booking data.
Where we get personal information from
Directly from you when you submit the contact form or provide information when arranging an introductory call.
[CHECK] Confirm whether connected booking services, technical logs or any other sources provide personal information, and add those sources here.
How long we keep information
Unsuccessful or closed enquiries: [FILL retention period and when the period starts].
Booking and introductory call records: [FILL retention period and when the period starts].
If an enquiry leads to client work: [FILL the applicable client-record retention period or where the separate client privacy information can be found].
[CHECK] Confirm deletion arrangements, backup retention and any legal obligations before completing these periods. No retention period has been assumed in this draft.
Who we share information with
Lovable Cloud stores contact form submissions for this website. Email notifications to the owner are not currently configured.
Google provides the booking calendar once you choose to open it. Plausible provides the cookieless visit statistics.
[CHECK] Confirm each provider's contracting legal entity and whether it acts as a processor or a separate controller. Add website hosting and any email, calendar or video-call providers that receive personal information, including relevant subprocessors and purposes. Update this section if email notifications are enabled.
International transfers
[CHECK] Confirm where each provider stores information and where it can be accessed. No UK-only storage or transfer safeguard has been verified for this draft.
[FILL] If there are restricted transfers outside the UK, list the destinations, applicable UK adequacy regulations or other lawful safeguards, and how you can obtain information about those safeguards. If there are no restricted transfers, confirm that before stating it here.
Automated decision-making
[CHECK] Confirm whether any decisions with legal or similarly significant effects are made solely by automated means, or whether profiling takes place. If so, obtain suitable advice and add the required information; do not rely on this small-business template alone.
How to complain
If you have any concerns about our use of your personal information, you can make a data protection complaint to us using studio@kataspychala.com or the postal address above.
If you remain unhappy with how we have used your data after raising a complaint with us, you can also complain to the Information Commissioner's Office (ICO).
ICO Head Office, 4th Floor, No.3 Circle Square, 5 Hawkshaw Street, Manchester, M1 7BL. Helpline: 0303 123 1113.