Privacy Notice
Effective date: 5 June 2026
Controller (data controller):
Rebecca Olds
Contact email: rebecca@timesmith.co.uk
This Privacy Notice explains how Rebecca Olds, trading as Timesmith Dress History (“we”, “us”, “our”) processes personal data when you visit timesmith.co.uk, email us, complete contact/intake forms, or work with us.
We currently operate as a self-employed sole trader in the United Kingdom. Please note: At a future date yet to be specified, the business will transfer to a sole-proprietorship consultancy (eenmanszaak) registered in the Netherlands. This Privacy Notice will be updated when that takes effect.
The legal provisions to which this Policy gives effect are the General Data Protection Regulation (EU) and the post-Brexit retention of the GDPR (EU) within UK law as the GDPR (UK), along with the UK Data Protection Act 2018. The law requires us to tell you about your rights and our obligations to you in regard to the processing and control of your personal data. We do this now, by requesting that you read the guidance documents from the European Data Protection Board or the Information Commissioner’s Office for the UK.
Introduction
This privacy notice aims to inform you about how we collect and process any information that we collect from you, or that you provide to us. It covers information that could identify you (“personal information”) and information that could not. In the context of the law and this notice, “process” means collect, store, transfer, use or otherwise act on information. It tells you about your privacy rights and how the law protects you.
We are committed to protecting your privacy and the confidentiality of your personal information. Our policy is not just an exercise in complying with the law, but a continuation of our respect for you and your personal information.
We undertake to preserve the confidentiality of all information you provide to us, and hope that you reciprocate.
Except as set out below, we do not share, or sell, or disclose to a third party, any information collected through our website.
Data we process
We may collect, use, store and transfer different kinds of personal data about you. This may be data you provide to us directly and/or data generated through your use of our website. We have collated these into groups as follows:
1. Account and profile data
Name, email address, username, password (stored in encrypted/hashed form), and basic profile details.
Login and account activity information (e.g., timestamps).
Profile information such as username and password, purchases or orders made by you, your interests.
Preferences, feedback and survey responses.
2. Intake and service information (Advisory)
When you complete an intake form or otherwise provide information for advisory services, we may collect:
Project information (e.g., location and/or deadline).
Financial planning information you choose to provide (e.g., high-level income/budget details, priorities and concerns).
Information you include in free‑text fields.
Important: Please do not include special category data (e.g., race, ethnicity, religious or philosophical beliefs, sexual orientation or sex life, health, biometrics, political opinions) unless we specifically request it and you are comfortable sharing it. If you provide it voluntarily, we may process it only as needed to respond to you and deliver services.
3. Communications
Content of messages that you send to us through social media, messaging platforms, by email or via forms.
Your communication preferences.
Your responses and actions in relation to your use of our services.
4. Scheduling and payment data
If you book calls via scheduling tools (including but not limited to meeting platforms such as Zoom, Microsoft Teams, Google Meet), we may receive booking details (e.g. name, email, appointment time).
If payment is collected via a payment processor (e.g., Stripe or Paypal), we receive confirmation of payment status and basic transaction references. Payment card details are processed by the payment provider, not stored by us.
5. Technical and usage data
Internet protocol (IP) address, device and browser information, geographical location, time zone setting, operating system and basic log data (e.g., to keep the website secure and functioning).
6. Marketing data
Cookie and consent preferences - please read our Cookie Notice for more details.
Your preferences in receiving marketing from us.
7. Anonymous data
We may aggregate anonymous data such as statistical or demographic data for any purpose. Anonymous data is data that does not identify you as an individual. Aggregated data may be derived from your personal data but is not considered personal information in law because it does not reveal your identity. For example, we may aggregate profile data to assess interest in a product or service. However, if we combine or connect aggregated data with your personal information so that it can identify you in any way, we treat the combined data as personal information and it will be used in accordance with this privacy notice.
IMPORTANT NOTICES:
Please do not divulge special category data e.g. about your race or ethnicity, religious or political views, sexual orientation, gender identity, information about your health or genetic or biometric data) UNLESS we specifically request it AND you are comfortable sharing it. This includes information about criminal convictions and offenses. If you provide any special category data voluntarily, we may process it only as needed to respond to you and deliver goods or services.
If you do not provide personal information that we need (in accordance with legal bases required by law – see next section) or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform that contract. In that case, we may have to stop providing a service to you. if so, we will notify you of this at the time.
Legal bases for processing (GDPR) and why (purposes)
The law requires us to determine under which of six defined bases we process different categories of your personal information, and to notify you of the basis for each category. Of these six potential bases, four apply to our business and/or relationship with you, and these are set out below. If a basis on which we process your personal information is no longer relevant, then we shall immediately stop processing your data. If the basis changes, then if required by law we shall notify you of the change and of any new basis under which we have determined that we can continue to process your information.
1. Contract
When you create an account on our website, buy a product or service from us, or otherwise agree to our terms and conditions, a contract is formed between you and us. In order to carry out our obligations under that contract we must process the information you give us. In some instances, you may have requested that process your information before we enter into a legal contract. Some of this information may be personal information.
We may use the information you provide in order to:
Verify your identity for security purposes.
Sell products to you.
Provide you with our services.
Provide you with suggestions and advice on products, services and how to obtain the most from using our website.
We shall continue to process this information until the contract between us ends or is terminated by either party under the terms of the contract.
2. Consent
Through certain actions when otherwise there is no contractual relationship between us, such as when you browse our website or ask us to provide you more information about our business, including our products and services, you provide your consent to us to process information that may be personal information.
Wherever possible, we aim to obtain your explicit consent to process this information, for example, by asking you to agree to use of cookies. (Please see our Cookie Notice for more information.)
If you have given us explicit permission to do so, we may from time to time pass your name and contact information to selected associates whom we consider may provide services or products you would find useful.
We may continue to process your information on this basis until you withdraw your consent or it can be reasonably assumed that your consent no longer exists.
You may withdraw your consent at any time by instructing us by email. However, if you do so, you may not be able to use our website or our services further.
3. Legitimate interest
We may process information on the basis there is a legitimate interest, either to you or to us, of doing so. Where we process your information on this basis, we do so after having given careful consideration to:
Whether the same objective could be achieved through other means.
Whether processing (or not processing) might cause you harm.
Whether you would expect us to process your data, and whether you would, in the round, consider it reasonable to do so
Legitimate interest may include:
A. Communications
When you contact us, whether by telephone, through our website or by e-mail, we collect the data you have given to us in order to provide the information you need or the response we believe you expect. We record both your request and our reply in order to increase the efficiency of our business. We keep personally identifiable information associated with your message, such as your name and email address so as to be able to track our communications with you to provide a high quality service.
B. Website analysis
Requests by your web browser to our servers for web pages and other content on our website are recorded.
We record information such as your geographical location, your Internet service provider and your IP address. We also record information about the software you are using to browse our website, such as the type of computer or device and the screen resolution.
We use this information in aggregate to assess the popularity of the webpages on our website and how we perform in providing content to you.
If combined with other information we know about you from previous visits, the data possibly could be used to identify you personally, even if you are not signed in to our website.
C. Other, such as:
Operating and securing our website.
Preventing abuse.
Improving our services.
Record-keeping for the proper and necessary administration of our business.
Protecting and asserting the legal rights of any party.
Insuring against or obtaining professional advice that is required to manage business risk.
Protecting your interests where we believe we have a duty to do so.
4. Legal obligation
Sometimes, we must process your information in order to comply with a statutory obligation, such as keeping records required for tax/accounting and compliance.
Information relating to your method of payment
Payment information is never taken by us or transferred to us either through our website or otherwise.
At the point of payment, you are transferred to a secure page on the website of Paypal or Stripe or some other reputable payment service provider. That page may be branded to look like a page on our website, but it is not controlled by us.
Job applications and employment
If you send us information in connection with a job application, we may keep it for up to twelve months in case we decide to contact you at a later date. This includes enquiries or applications you may make to us regarding work experience placements or internships or temporary positions, whether remunerated or for academic credit.
If we employ you, we collect information about you and your work from time to time throughout the period of your employment. This information will be used only for purposes directly relevant to your employment. After your employment has ended, we will keep your file for six years before destroying or deleting it.
Business partner information
This is information given to us by you in your capacity as an affiliate of ours or as a business partner. It allows us to recognise visitors that you have referred to us, and to credit to you any commission due for such referrals. It also includes information that allows us to transfer commission to you.
The information is not used for any other purpose.
We undertake to preserve the confidentiality of the information and of the terms of our relationship.
We expect any affiliate or partner to agree to reciprocate this policy.
Disclosure and sharing of your information
Sharing your personal data
We share personal data only as necessary for the purposes set out above, including with:
Website hosting and infrastructure providers
Email and productivity providers e.g. for operational communications
Payment providers e.g. Paypal or Stripe for payment processing.
Form providers e.g. Google Forms, if you submit information through embedded or linked forms.
Service providers who help us run the website, e.g. plugins and related technical services.
We do not sell any of your personal data.
Receiving data from third parties
Although we do not disclose your personal information to any third party (except as set out in this notice), we sometimes receive data that is indirectly made up from your personal information from third parties whose services we use.
Fraud detection and prevention
To assist in combating fraud, we may share information with financial institutions and credit reporting agencies, so far as it relates to clients or customers who instruct their debit or credit card issuer to cancel payment to us without having first provided an acceptable reason to us and given us the opportunity to refund their money.
Data processed outside the United Kingdom
With respect to data transferred outside the United Kingdom, we comply with a code of conduct approved by the Information Commissioner’s Office in the United Kingdom.
Our website is hosted by SquareSpace, which holds data on a private cloud network stored on a series of Tier III data centres across the U.S.A. SquareSpace uses the European Commission Standard Contractual Clauses (also known as Model Contractual Clauses) and the UK’s International Data Transfer Addendum (UK Addendum) as the legal basis for transferring personal data outside the EU and/or UK (as relevant) to third countries, including the U.S.A.
We may also use other outsourced services in countries outside the UK from time to time in other aspects of our business. Accordingly data obtained within the UK or any other country could be processed outside the UK.
Data retention
We keep personal information only as long as needed for the purposes described above, including:
While your account is active.
For the duration of any contractual or service relationship and a reasonable period afterward for follow-up and recordkeeping.
Longer where required by law (e.g., bookkeeping/tax obligations) or to resolve disputes.
You may request deletion of your account, subject to legal retention obligations.
Control over your own information
Your duty to inform us of changes
It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes.
Your rights
Depending on your location and applicable law, you may have rights including:
Access to your personal data.
Rectification (correction).
Erasure (deletion), in certain cases.
Restriction of processing, in certain cases.
Data portability, where applicable.
Objection to processing based on legitimate interests, in certain cases.
Withdrawal of consent at any time, where processing is based on consent.
To exercise your rights, contact us at: rebecca@timesmith.co.uk.
When we receive any request to access, edit or delete personal identifiable information, we shall first take reasonable steps to verify your identity before granting you access or otherwise taking any action. This is important to safeguard your information.
Other matters
Use of site by children
Under UK law, a binding contract, such as for sale of goods or services, cannot be made where one party is under the age of 18.
We therefore do not sell products or provide services for purchase by children, nor do we market to children.
Encryption of data sent between us
We use Secure Sockets Layer (SSL) certificates to verify our identity to your browser and to encrypt any data you give us.
Whenever information is transferred between us, you can check that it is done so using SSL by looking for a closed padlock symbol or other trust mark in your browser’s URL bar or toolbar.
Security
We use reasonable administrative, technical and organisational measures to protect personal data. However, no method of transmission or storage is completely secure.
Complaints
When we receive a complaint, we record all the information you have given to us. We use that information to resolve your complaint.
If your complaint reasonably requires us to contact some other person, we may decide to give to that other person some of the information contained in your complaint. We do this as infrequently as possible, but it is a matter for our sole discretion as to whether we do give information, and if we do, what that information is.
Under GDPR (EU) and GDPR (UK), you also have the right to lodge a complaint about how we have used your data with the supervisory authority. In the UK, this is the Information Commissioner’s Office.
Compliance with the law
Our privacy policy has been compiled so as to comply with the law of every country or legal jurisdiction in which we aim to do business. If you think it fails to satisfy the law of your jurisdiction, we should like to hear from you.
However, ultimately it is your choice as to whether you wish to provide information to us that is subject to privacy or data protection law.
Changes to this policy
We may update this Privacy Policy from time to time as necessary. The “Effective date” at the top of the page indicates when this policy was last updated.