Privacy policy

1. Who we are

Josh Smith ("we", "us") operates this website and booking service, and is the data controller for the personal data described below. Contact for anything data-related: booking@joshsmith.live.

2. What we collect and why

Booking enquiries: your name, email, phone number, event date, venue and any details you provide. We use these to respond to your enquiry, prepare a contract and administer the booking (legal basis: taking steps to enter a contract at your request).

Contract signing: your typed legal name, the time of signing, your IP address and browser user-agent — kept as evidence that the contract was signed and by whom (legal basis: our legitimate interest in holding enforceable agreements, which we consider proportionate because the data is minimal, collected only at the moment you choose to sign, and used for nothing else).

Payments: handled entirely by Stripe on Stripe-hosted invoice pages. Card details never touch our servers.

Mailing list: your email address, with consent timestamps. Double opt-in — we only email you after you confirm, and every email contains a one-click unsubscribe link (legal basis: consent, UK PECR).

3. Who processes your data

We use a small number of processors to run the service: Stripe (payments and invoicing), Resend (transactional and mailing-list email), Neon (database hosting) and Cloudflare (site hosting, security and file storage). Each processes data only on our instructions, under a written data processing agreement.

Some of those processors are based in, or store data in, the United States. Where personal data leaves the UK it is transferred under the safeguards UK law recognises — the UK Extension to the EU–US Data Privacy Framework where the processor is certified under it, or the International Data Transfer Addendum to the European Commission's standard contractual clauses where it is not.

4. How long we keep it

Bookings, contracts and payment records: six years after the event. That is how long a claim can be brought on a contract under the Limitation Act 1980, and it covers HMRC's record-keeping requirement for self-employed accounts.

Enquiries that never became bookings: twelve months from the enquiry, then deleted.

Mailing list: until you unsubscribe. After that we keep your email address alone on a suppression list, indefinitely, so that we do not email you again — deleting that record would defeat its only purpose.

5. Cookies

This site sets no advertising or analytics cookies, and there is no tracking to consent to. The only cookies are the strictly necessary ones: a session cookie when Josh signs in to the admin area, and security cookies set by Cloudflare Turnstile, which is what keeps bots out of the booking and subscribe forms. YouTube videos load nothing until you press play, and then from youtube-nocookie.com.

6. Your rights

Under UK GDPR you can ask for a copy of your personal data, ask us to correct or delete it, object to processing, or ask us to restrict it. Email us and we will respond within one month.

If you think we have handled your data badly, please tell us first so we can put it right — and you also have the right to complain to the Information Commissioner's Office at ico.org.uk, or on 0303 123 1113.