Privacy Policy

 

Effective date: 18 August 2026

This Privacy Policy explains how I collect, use and protect personal information through hannahroseshaw.com, hannahroseshaw.co.uk and in connection with enquiries and client projects.

Who is responsible for your information?

Hannah Rose Shaw is the data controller responsible for the personal information described in this policy. You can contact me through my contact form or write to:

Hannah Rose Shaw
4th Floor, Silverstream House
45 Fitzroy Street
London
W1T 6EB
United Kingdom

Information I collect

Depending on how you use the website or work with me, I may collect:

  • Your name, email address, business name, role and website.

  • Information you include in an enquiry or contact form, such as your project requirements, budget, proposed timing and how you heard about me.

  • Correspondence, meeting notes, feedback and other communications.

  • Contracts, proposals, invoices and records connected with a client relationship.

  • Project materials you provide, including copy, images, research, archives, collections information, contributor details and other content.

  • Technical information such as your IP address, browser, device, pages visited, error data and security events.

Please do not include confidential or sensitive personal information in an initial enquiry unless it is necessary. If a project requires the processing of sensitive material or information about other people, I will agree appropriate arrangements with you separately.

How I use your information

I use personal information to:

  • Respond to enquiries and decide whether a project is a suitable fit.

  • Prepare proposals, estimates and contracts.

  • Plan, manage and deliver commissioned work.

  • Communicate with clients, collaborators and contributors.

  • Maintain project, contractual, tax and accounting records.

  • Operate, secure, troubleshoot and improve the website.

  • Prevent spam, misuse and malicious activity.

  • Establish, exercise or defend legal rights.

  • Comply with legal and regulatory obligations.

I do not sell personal information or use it for behavioural advertising.

Lawful bases

UK data protection law requires me to have a lawful basis for using personal information. Depending on the circumstances, I rely on:

  • Steps before entering a contract: To respond to a project enquiry, discuss requirements and prepare a proposal at your request.

  • Contract: To manage and deliver work you have commissioned.

  • Legitimate interests: To run and protect my practice, maintain professional relationships, keep proportionate records, operate and improve the website, and protect my legal rights. I consider whether these interests are outweighed by your rights before relying on this basis.

  • Legal obligation: Where information must be retained or disclosed to comply with tax, accounting or other legal requirements.

  • Consent: Where I ask for your consent for a particular use of your information. You may withdraw that consent at any time.

Where I process your information on the basis of legitimate interests, you may object to that processing. I will consider your circumstances and stop processing the information unless I have a compelling lawful reason to continue.

Services and providers

I use a limited number of service providers to operate the website and manage projects. They may process personal information on my behalf or, in some circumstances, as independent data controllers under their own terms.

  • Squarespace: Hosts and operates the website and its contact forms. It may process device, usage and form-submission information.

  • IONOS: Provides domain and email services and processes information contained in email correspondence and related technical data.

  • Sentry: Monitors technical errors and website performance. Depending on the error, this may include IP addresses, device information, page information and diagnostic data. I seek to limit the information collected to what is reasonably necessary for troubleshooting and security.

  • Google reCAPTCHA: Helps protect forms from spam and automated misuse. Google may process technical and interaction information when the service is loaded or used.

  • Tally: May be used to collect project enquiries, questionnaires, feedback or other information you choose to submit.

  • Notion: May be used to organise client projects, share project information and store communications, feedback and deliverables.

I may also disclose information to professional advisers, insurers, IT support providers, public authorities or legal bodies where reasonably necessary or legally required.

Links on this website may take you to external websites. Those organisations are responsible for their own privacy practices, and you should review their policies before providing personal information.

Cookies and similar technologies

The website uses only cookies and similar technologies that are necessary for its operation, security, spam prevention and fault detection. These technologies do not require consent under UK cookie rules, so the website does not display an accept or reject banner.

A current list of the technologies used, their providers, purposes and durations is available in the Cookie Policy. If non-essential technologies are introduced in future, I will update my cookie arrangements and request consent where required.

International processing

Some providers used for hosting, security, communications and project management operate in, or allow access to information from, countries outside the United Kingdom. Where personal information is transferred outside the UK, I take reasonable steps to ensure that the transfer is lawful.

Depending on the destination and provider, this may include relying on UK adequacy regulations or contractual safeguards approved or recognised under UK data protection law.

You may contact me through my contact form if you would like more information about the safeguards relevant to your information.

How long I keep information

I keep personal information only for as long as it is reasonably needed for the purpose for which it was collected, including legal, tax and professional requirements. In general:

  • Initial enquiries that do not become projects are kept for up to two years after the last communication.

  • Contact-form submissions and ordinary correspondence are kept for up to two years unless they form part of a client or legal record.

  • Client agreements, key correspondence and project administration records may be kept for up to seven years after a project ends.

  • Invoices and tax records are kept for the period required by law.

  • Working project files are reviewed after completion and deleted, anonymised or archived when they are no longer reasonably required.

  • Sentry diagnostic information is retained according to my current Sentry account settings and deleted when it is no longer required for troubleshooting and security.

Information may be retained for longer where necessary to resolve a dispute, establish or defend legal claims, comply with a legal hold or meet another legal requirement.

Security

I use reasonable technical and organisational measures appropriate to the nature of the information I hold. These include using reputable providers, limiting access to project information and maintaining account and device security.

No online service can be guaranteed completely secure. Please contact me if you believe information you have provided has been lost, misused or accessed without authorisation.

Your rights

Subject to the circumstances and any legal exceptions, you may have the right to:

  • Ask for a copy of your personal information.

  • Ask for inaccurate or incomplete information to be corrected.

  • Ask for information to be deleted.

  • Ask me to restrict how information is used.

  • Object to processing based on legitimate interests.

  • Receive certain information in a portable format.

  • Withdraw consent at any time where processing relies on consent.

  • Complain about how your information has been handled.

To exercise any of these rights, contact me through my contact form. Please state that your message concerns data protection or privacy. I may need to verify your identity before acting on a request. Requests are normally handled without charge and within the period required by law.

Data protection complaints

You can raise a data protection concern or complaint through my contact form. Please select or state that your enquiry concerns privacy or data protection. I will acknowledge your complaint within 30 days, take appropriate steps to investigate it without undue delay, keep you informed where necessary and tell you the outcome.

You also have the right to complain to the Information Commissioner’s Office, the UK regulator for data protection. Its website is ico.org.uk. I would appreciate the opportunity to consider your concern first, but you are not required to contact me before approaching the Information Commissioner’s Office.

Information about other people

If you provide personal information about another person, such as a collaborator, contributor, employee, artist, photographer or collection contact, you must ensure that you are entitled to provide it and that they have been given appropriate privacy information.

Where a client provides personal information for inclusion in a website, publication, interpretation project or exhibition, the client remains responsible for establishing that the material may lawfully be supplied and used, unless I agree otherwise in writing.

Changes to this policy

I may update this policy when my services, providers or legal obligations change. The current version will always be published on this page with the date of its latest revision.