Privacy notice

Last updated: 3 October 2026

This notice explains how I handle personal information through this website and my reporting and data analysis service.

Who I am

I'm Stephen Dorman, a sole trader based in Dorset, UK. I'm responsible for the personal information described here. Contact: stephen@zktheory.org.

This website

The site sets no tracking or advertising cookies and uses no analytics. If you email me through the site, I use your message only to reply and to deal with your enquiry. My lawful basis is legitimate interests in responding to people who contact me or, if you're asking about working with me, taking steps at your request before entering into a contract.

Business contacts and outreach

What I hold: your name, job title, work email address, organisation, and notes of any correspondence with you.

Where it comes from: your organisation's website and public registers such as the Charity Commission, Companies House and the Department for Education, or from you directly.

Why: to contact organisations about reporting and data analysis services that may be relevant to their work, and to keep track of those conversations.

Lawful basis: legitimate interests. I contact organisations in a business capacity about services related to their work. I don't send marketing emails to individuals, sole traders or personal email addresses without consent.

How much contact: one email, and at most one reminder. If you don't reply, I won't contact you again. You don't need to do anything to stop further emails.

How long I keep it: if there's no reply, I close the record after the reminder. I keep only your name, organisation, email address, the date and a "do not contact" marker, so that you aren't contacted again. Other prospect information is deleted within 12 months of the last contact.

Clients

For clients, I hold the contact and billing details needed to deliver the work and keep financial records. Records needed for tax are kept for six years. The lawful basis is contract (to deliver the work and invoice for it) and legal obligation (to keep tax records). When I process data on a client's behalf, a written agreement with the client sets out how it's handled, and the client remains responsible for that data.

Who else sees it

I use HubSpot (customer records) and Microsoft 365 (email and file storage) to hold this information on my behalf.

Microsoft 365 stores this data in the UK. HubSpot stores it in the EU (Germany), which is covered by UK adequacy regulations. If either provider accesses data from the US, for example to provide support, the transfer relies on the UK Extension to the EU–US Data Privacy Framework (the "UK–US data bridge") or the UK addendum to the EU standard contractual clauses. You can ask me for a copy of these safeguards.

I don't sell or share personal information for anyone else's marketing.

Your rights

You can ask to see the information I hold about you, have it corrected or deleted, or restrict how it's used. You can object to direct marketing at any time, and I will stop. To do any of these, email stephen@zktheory.org.

If you're unhappy with how I've handled your information, please tell me first. You can also complain to the Information Commissioner's Office: ico.org.uk, 0303 123 1113.