Privacy Notice
Last updated 21 October 2026
This is the privacy notice for the Calm Back with Gem website at calmbackwithgem.co.uk. It explains what personal data we collect, why we collect it, how we use it, who we share it with, and the rights you have over it. We have written it in plain language because legal small print does not help anyone.
If anything is unclear, email us at hello@calmbackwithgem.co.uk and we will explain.
Who we are
Data controller: Gemma Hurlstone, trading as Calm Back with Gem (sole trader).
Postal address: Unit 158814, PO Box 7169, Poole, BH15 9EL, United Kingdom
Email: hello@calmbackwithgem.co.uk
ICO registration number: ZB858213 (registered with the UK Information Commissioner's Office).
What personal data we collect
We collect data when you choose to give it to us, and a small amount automatically when you visit the site.
When you give it to us:
- Workbook sign-up (the free Business Foundations Workbook): your first name and email address. This happens on a separately hosted Flodesk signup page.
- Project enquiries and applications: your name, email, business details and the answers you send. Our website sends these to us through Resend. We use them to assess your enquiry and reply, not to subscribe you to marketing.
- Contact by email: anything you send us in the message itself, plus your name and email.
- Booking a session: name, email, and any context you add when scheduling. This is collected through Cal.com.
- Prep forms (before a discovery call, a one to one session or a workshop): your name, email, business details and your answers about your business, goals and the tools you use. Our website sends these to Gemma through Resend. The workshop form also asks, optionally, whether anything would make the day easier for you, such as access needs. Only share what you are comfortable with. We use that answer only to plan the day.
- Feedback forms (after a call or session): your name if you choose to give it, your feedback, and whether you are happy for us to quote you. Our website sends these to Gemma through Resend.
- Digital Health Check: your name, email, purchase reference, service start choice and the answers you give in the interview. We store the interview and report draft in Supabase. We send interview messages to the Anthropic API to run the conversation and prepare a report draft. Gemma reviews the draft before delivery. Please do not include passwords, payment card details, health information or confidential information about other people.
- Email newsletter (when you subscribe): name and email address.
- Dorset AI Network: when you book through Flodesk, we collect your name, email and booking details to manage your ticket. If you sign up for future dates, we use your name and email to send the updates you request. You can unsubscribe at any time.
Automatically when you visit
Server logs: our hosting provider keeps basic technical logs (IP address, browser type, pages visited, timestamps) to run and secure the site.
Optional analytics: if, and only if, you accept it on the cookie banner, we load Google Analytics and Microsoft Clarity. Google Analytics counts visits and shows us which pages lead to a booking. Microsoft Clarity shows us how pages are used, through heatmaps and recordings of clicks, scrolling and mouse movement, with anything typed into a form masked. Both set cookies and share data with Google and Microsoft. Analytics and advertising tools are disabled on our enquiry, application, prep and feedback form pages.
Advertising measurement: if, and only if, you accept it on the cookie banner, we load the Meta Pixel. It helps us see whether our Facebook and Instagram ads work. It sets cookies and shares data with Meta Platforms. If you decline, or do nothing, it never loads. Use Cookie preferences in the footer to change your choice or withdraw consent.
Microsoft Clarity is provided by Microsoft as an independent controller. Its terms describe uses including product improvement and advertising profiles. We configure Clarity with advertising storage denied and analytics storage granted only after you choose analytics. Microsoft explains its processing and your choices at https://privacy.microsoft.com/en-gb/privacystatement. We do not send form answers to Clarity.
For the Meta Pixel, we and Meta Platforms, Inc. jointly determine the collection and transmission of UK visitor event data for advertising purposes. Meta is responsible for processing after receipt under its own policies. We provide this notice and obtain advertising consent. Meta handles rights requests for the data it stores. You can exercise your data rights against either party. Meta’s privacy information is at https://www.facebook.com/privacy/policy/. The responsibilities are described in the UK Controller Addendum at https://www.facebook.com/legal/terms/uk_controller_addendum. Meta’s UK Data Transfer Addendum is at https://www.facebook.com/legal/terms/UK_Data_Transfer_Addendum. We use the pixel only after advertising consent and do not send enquiry or prep answers to it.
The cookie choices described here apply to our main website. Linked booking, payment, quiz and signup services use their own technology and should be read alongside their privacy and cookie information.
Beyond that, this is a static site. It does not set any other tracking or marketing cookies of its own.
Why we collect it (lawful bases under UK GDPR)
| What we use the data for | Lawful basis |
|---|---|
| Sending you the free workbook after you request it | Consent (Article 6(1)(a)) |
| Adding you to the email list if you opt in | Consent (Article 6(1)(a)) |
| Replying to your enquiry | Legitimate interest (Article 6(1)(f)): responding to people who contact us |
| Delivering a paid service you have bought | Contract (Article 6(1)(b)) |
| Preparing for a discovery call, session or workshop from your prep form answers | Contract, or steps you asked us to take before one (Article 6(1)(b)) |
| Planning the workshop day around anything you tell us would make it easier, such as access needs | Your explicit consent (Article 9(2)(a)), which you can withdraw by emailing us |
| Asking how a call or session went, so we can improve what we offer | Legitimate interest (Article 6(1)(f)): improving our services |
| Quoting your feedback on our website or socials, only if you said yes | Your consent (Article 6(1)(a)), which you can withdraw by emailing us |
| Keeping invoices and tax records | Legal obligation (Article 6(1)(c)): HMRC requires records to be kept |
| Optional analytics and advertising, according to your cookie choices | Consent (Article 6(1)(a)), which you can withdraw through Cookie preferences |
| Site security and fraud prevention | Legitimate interest (Article 6(1)(f)): keeping the site safe |
How long we keep it
We keep personal data for as long as it is needed for the purpose it was collected for. The period depends on whether you have made an enquiry, requested emails, booked a service or become a client.
For enquiries, we consider whether the conversation is still active and whether we need the record to answer a complaint or establish a legal claim. For client and payment records, we also consider tax, accounting and contractual obligations.
If you unsubscribe, we stop the marketing you opted out of. We may keep a minimal suppression record so we can respect that choice. Unsubscribing does not automatically erase records we need for another lawful purpose.
You can ask us about the retention of your records or request deletion by emailing hello@calmbackwithgem.co.uk. We assess the request against any legal reason for keeping them.
Who we share it with
We use the following services to run the site and business. Their roles vary. Payment providers and some analytics providers may also handle data as controllers under their own privacy notices.
| Service | What they do | Where they are |
|---|---|---|
| Vercel | Hosts the website | USA |
| Flodesk, Inc. | Sends marketing emails, hosts sign-up forms and Dorset AI Network ticket checkout | USA |
| Meta Platforms | Meta Pixel advertising measurement, only if you accept it on the cookie banner | USA / Ireland |
| Google Analytics site usage measurement, only if you accept it on the cookie banner | Ireland / USA | |
| Microsoft | Microsoft Clarity heatmaps and session recordings, only if you accept it on the cookie banner. Microsoft handles this data as a controller in its own right, under its own privacy statement | USA |
| Cal.com | Booking calendar for calls and strategic sessions | USA |
| Resend (Plus Five Five, Inc.) | Emails enquiry, application, prep and feedback form answers to us, and sends purchase confirmations and service delivery emails | USA |
| Supabase | Stores Digital Health Check interviews, purchase references and report drafts | Germany for the Health Check database. Support and other processing may involve international transfers |
| Anthropic | Provides the API used for the Digital Health Check interview and report draft | USA, with international processing under its commercial service terms |
| Stripe | Processes online payments for paid services | USA / Ireland |
Payments
When you buy a paid service, payment is taken securely through Stripe, our payment processor. Your card details go directly to Stripe and are processed under Stripe's own privacy policy. We never see or store your full card number. We keep a record of the transaction (amount, date, and what you bought) for our accounts and tax obligations.
International transfers
Some of these services handle personal data outside the UK, including in the USA. International transfers require an applicable adequacy decision or another appropriate safeguard, such as contractual safeguards with the required UK provisions. Contact hello@calmbackwithgem.co.uk for information about the arrangements that apply to your data.
Your rights
Under UK GDPR you have the following rights, free of charge in most cases:
- Right of access: ask for a copy of the personal data we hold about you.
- Right to rectification: ask us to correct anything that is wrong.
- Right to erasure: ask us to delete your data ("the right to be forgotten") in most cases.
- Right to restrict processing: ask us to pause using your data while you query something.
- Right to data portability: ask for your data in a machine-readable format.
- Right to object: tell us to stop using your data for direct marketing or where we rely on legitimate interest.
- Right to withdraw consent: at any time, where we relied on consent. This does not affect anything we did before you withdrew.
- Rights regarding automated decision-making: we do not make any automated decisions about you that have legal or significant effects.
Complaints
To exercise any of your rights, email hello@calmbackwithgem.co.uk. We will respond within one calendar month.
If you are not happy with how we have handled your data, you have the right to complain to the UK Information Commissioner's Office at ico.org.uk or by calling 0303 123 1113.
Children
This site is not directed at children under 13 and we do not knowingly collect data from anyone under 13. If you are a parent and think we have collected data from your child, contact us and we will delete it.
Security
We use reasonable technical and organisational measures to protect your data, including HTTPS encryption and strong access controls on our hosting. No system is perfectly secure, so we cannot guarantee absolute security, but we work hard at it.
Where legally required, we will notify the ICO of a personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of it. We will notify affected people without undue delay where the breach is likely to result in a high risk to their rights and freedoms.
Changes to this notice
We will update this notice when our practices change. The "last updated" date at the top tells you when. For significant changes we will email anyone affected.
Contact
For anything privacy-related: hello@calmbackwithgem.co.uk