The short version. I only collect what I need to reply to you, run your audit or membership, and keep the records the law asks for. I never sell your data or add you to a mailing list.
If I emailed you first: I found your work details in public business sources, and I'll stop the moment you say "no thanks".
Who I am
Turnglass is a trading name of Colin Henderson, a sole trader. I decide how your personal data is used, which makes me the “controller” under UK data protection law.
Contact: hello (at) tryturnglass.com
Address: 20-22 Wenlock Road, London N1 7GU
If I contacted you first
I write to owners of online shops and small businesses about the audit. This section covers that outreach.
- What I hold: your name, your role, your work email address or a link to your public business profile, your company name, and public facts that make my message relevant to you, such as a job advert you posted, the size of your company or what you sell.
- Where I got it: public business sources. That means your company’s website, Companies House, job adverts (for example on Indeed) and web search results, such as a public LinkedIn profile. Sometimes someone who knows you suggests I get in touch. If so, I’ll say who in my first message.
- Who I contact: only limited companies and LLPs, at work addresses. If I can’t find a work email, I may send one LinkedIn connection request instead.
- Why: my legitimate interest in telling businesses about a service that’s relevant to them. I’ve weighed that against your interests: the message is about your business, it’s short, and you can stop it with one reply.
- How often: one message, and at most two follow-ups if you don’t reply.
Your right to object. You can tell me to stop at any time and I will. Reply “no thanks” to any message, or email me. I’ll keep your email address on a short do-not-contact list so I never contact you again by mistake. That’s the only thing I keep.
If you contact me or buy
- When you request an audit: your name, email, business or website, and anything you write about your week. The form also records the time and your IP address, to help stop spam.
- If you go ahead: your questionnaire answers, your daily log for the week, and any screenshots you choose to send, such as a calendar or a phone screen-time summary. I only need to see where your time goes, not the contents of your work, so please crop or blur anything you’d rather not share. I never ask for logins during the audit.
- If you become a member: the details I need to run your membership. Your business data that we handle while doing jobs for you, such as orders, customer emails or supplier messages, is covered by our data processing agreement. For that data, you’re the controller and I act only on your instructions.
- Records: the emails we exchange, and payment records if you buy.
Why I use it
- To reply, check the audit is a fit for you, and deliver the audit or membership. The legal basis is that you asked me to: taking steps before a contract, then performing it.
- To keep business and tax records, because the law requires it.
- To stop spam and keep the form working, which is my legitimate interest in running a secure website.
- To contact businesses about the audit, as explained above.
I won’t add you to a mailing list, and I never sell your data.
Who sees it
Me, plus the services that make this work: Namecheap, which hosts this website and the form; Google Workspace, my email provider; the form, file and document tools I use to run the audit; and AI tools that help me sort and summarise logs and draft messages. I only use AI tools on terms that don’t let the provider train its models on what I send. If you become a member, the people on my team who work on your jobs see only what they need for those jobs, under confidentiality terms. If I ever bring in someone to help with your audit, I’ll tell you first.
Some of these providers may store data outside the UK, including in the USA. When they do, I rely on the safeguards UK law requires, such as the UK-US data bridge or standard data protection clauses.
How long I keep it
- Outreach details: deleted within 12 months of my last message if we don’t end up working together. If you ask me to stop, I keep only your email address on my do-not-contact list.
- Requests that don’t go ahead: deleted within 12 months.
- Your week log and screenshots: deleted within 90 days of sending your plan, unless you ask me to keep them.
- Data I handle for you as a member: returned or deleted when you leave, as our data processing agreement sets out.
- Your plan, our emails and payment records: kept for as long as tax and business record rules require.
Cookies
This website doesn’t use cookies, analytics or tracking.
Your rights
You can ask to see the data I hold about you, correct it, delete it, or object to or limit how I use it, and you can ask for a copy to take elsewhere. You can object to marketing at any time. Just email me. If you’re unhappy with how I’ve handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint.
If I change this notice, I’ll update the date at the top.