Privacy policy

Last updated 27 September 2026

Who is responsible

This website and the services described on it are provided by Harry James Leyland, operating as an independent contractor (autónomo) established in Spain.

Harry James Leyland is the data controller for personal data collected through this website and in the course of providing services to clients.

Personal data is handled in line with the UK General Data Protection Regulation and the Data Protection Act 2018, and with Regulation (EU) 2016/679 where it applies.

What is collected

On making contact. Name, email address, and whatever is volunteered about the business.

On becoming a client. Billing contact details, company details and payment records needed to invoice and to meet accounting obligations. Card details are handled by the payment provider and are not stored here.

Website use. This site does not use analytics or advertising cookies. Standard server logs, including IP address, are kept briefly for security purposes.

Why

To respond to enquiries, to provide and invoice for services, and to meet legal and accounting obligations. The lawful bases are performance of a contract, legitimate interest in responding to a business enquiry, and legal obligation for records that must be retained.

Personal data is not sold, and is not passed to third parties for their own marketing.

Who it is shared with

Service providers used to run the business, each bound to process data only on instruction: email and hosting providers, a payment provider for card transactions, and an accountant for records that must be filed.

Where a provider is outside the UK or the European Economic Area, transfers rely on the safeguards permitted under data protection law.

Data processed on behalf of clients

Where campaigns are run for a client, leads generated belong to that client. They are the controller of that data, processed on their behalf under a written agreement. Requests about that data should be directed to the client concerned.

How long it is kept

Enquiries that do not become clients: two years, then deleted.

Client records: for the duration of the engagement and six years afterwards, to meet tax and accounting obligations.

Your rights

Individuals may request a copy of what is held, ask for it to be corrected or deleted, restrict or object to its use, or request it in a portable format. Where processing relies on consent, it may be withdrawn at any time.

Requests go to harry@harryleyland.com and are answered within one month.

Complaints may also be made to the relevant national data protection authority: the Information Commissioner's Office in the UK, or the Agencia Española de Protección de Datos in Spain.

Changes

Any change to this policy is reflected in the date at the top of this page.