How I handle your data.

Who runs this site.

This site is run by Jam Sanctuary Ltd, trading as James Jamil. Company number 15971594, registered in England and Wales. Registered office: 124 Oliphant Street, London, England, W10 4EB. I'm James Gillespie, and I'm the data controller for anything you share with me here.

What I collect and why.

If you fill out the intake form on /book, I collect your name, your email, whether you self-identified as a senior leader or a growth stage founder, and one line describing the moment you're in. Lawful basis: your consent, and my legitimate interest in replying to a genuine enquiry.

If you subscribe to the newsletter, I collect your email. Lawful basis: your consent. You can unsubscribe from any note I send.

If you email me directly (james@jamesjamil.com), I hold the email thread while we're in conversation and for a reasonable period after. Lawful basis: legitimate interest.

If we work together, I hold what you share in our sessions and my notes on it. Lawful basis: the contract between us.

What I do with it.

I read what you send, I reply, and (if we're a fit) we book a call. If you subscribe to notes, I send a note occasionally. I don't sell your data, I don't share it with third parties for marketing, and I don't feed it into training data for any AI system.

Who else sees your data (processors).

A short list of services that handle data on my behalf:

• Google Workspace — email inbox, sending, calendar, and document storage. Data may be processed in the US under Google's UK/EU standard contractual clauses. See policies.google.com/privacy.
• GoHighLevel (HighLevel Inc.) — booking calendar, intake form submissions, and newsletter delivery. Data is processed on their platform, primarily in the US, under standard contractual clauses. See gohighlevel.com/privacy-policy.
• Lovable — website hosting and first-party, cookieless analytics. See lovable.dev/privacy.

How long I keep it.

Intake form submissions: up to 24 months from the last contact, then deleted. Newsletter subscriptions: until you unsubscribe. Client work: for the duration of our engagement plus 6 years to meet UK tax and professional record requirements. Anything else on request.

Analytics and tracking.

This site uses Lovable's built-in analytics only. It's first-party, cookieless, and aggregates page views without identifying you. No Google Analytics. No LinkedIn Insight Tag. No Meta Pixel. No advertising trackers. See the cookie policy for details.

Your rights under UK GDPR.

You can, at any time:

• Ask for a copy of the personal data I hold on you.
• Ask me to correct anything that's wrong.
• Ask me to delete it (subject to my legal record-keeping obligations).
• Ask me to restrict or object to how I use it.
• Ask for a portable copy in a common format.
• Withdraw consent for anything you consented to.

Email james@jamesjamil.com and I'll respond within 30 days. If you're not satisfied, you can complain to the UK Information Commissioner's Office at ico.org.uk.

International transfers.

Some of the services I use (Google Workspace, GoHighLevel, Lovable) may store or process your data outside the UK, primarily in the US. Where that happens, transfers are protected by the UK's approved safeguards (adequacy decisions or standard contractual clauses).

Security.

I keep the data I hold on secured accounts protected by strong passwords and two-factor authentication where the service supports it. No system is perfectly secure. If a breach happens that affects your data, I'll tell you and the ICO within the UK GDPR timeframes.

Children.

This site isn't aimed at anyone under 18. I don't knowingly collect data from children.

Changes to this policy.

If I change how I handle data, I'll update this page and change the "last updated" date at the top. Material changes will be noted at the top of the page for 30 days.

Contact.

For anything about your data: james@jamesjamil.com.