Privacy

This notice explains what happens to personal data collected through this website (gregorygorman.co.uk). It does not cover the separate handling of data you provide as part of a paid engagement (a programme evaluation or an assessment validation), which is described in its own section below.

Who is responsible for your data

Dr Gregory Gorman is the controller for personal data collected through this website: the person who decides why and how it is processed. You can contact him at greg@gregorygorman.co.uk with any question about this notice or about data held about you.

What is collected, and why

The contact form. The form on the Contact page collects your name, organisation, email address, a short description of what you are trying to measure or evaluate, and which of three options is closer to your situation. It is used only to read and respond to your enquiry. Providing this information is voluntary, but it is not possible to respond to an enquiry submitted without at least a name and an email address.

Email. If you email greg@gregorygorman.co.uk directly, your email address and the content of your message are processed in order to respond to you.

Analytics. This site uses Cloudflare Web Analytics, which is designed to operate without cookies or any persistent identifier and does not track individuals across websites. It provides aggregate information about how the site is used (for example, how many people visited a page) and does not identify you personally.

There is no newsletter, no marketing list, and no marketing consent is requested anywhere on this site.

Our lawful basis for processing

For an ordinary enquiry made through the contact form or by email, we rely on legitimate interests (UK GDPR Article 6(1)(f)): it is in your interest and ours to be able to answer a question about the services on this site, and this is done in a way that does not override your own rights and freedoms. Where you specifically ask for a quote, proposal or other step towards engaging Dr Gregory Gorman, that part of the exchange is instead processed to take steps at your request before entering into a contract (Article 6(1)(b)).

Who your information is shared with

Your information is not sold, and is not shared for anyone else's marketing. It is shared only with the service providers who host this site and handle these specific functions on Dr Gregory Gorman's instructions, acting as data processors rather than deciding their own purposes for it:

• Netlify (hosting, and Netlify Forms for the contact form): receives and stores contact-form submissions and forwards them by email so they can be answered; also serves the pages, images and PDFs that make up this site.
• Cloudflare (Web Analytics): processes cookieless, aggregate usage data as described above.

Both providers may process data outside the UK. Netlify's Data Processing Addendum provides for the UK Extension to the EU–US Data Privacy Framework and, where that does not apply, Standard Contractual Clauses together with the UK International Data Transfer Addendum. Cloudflare's Data Processing Addendum provides for the UK Extension to the EU–US Data Privacy Framework and, where required, Standard Contractual Clauses together with the UK Addendum.

How long your information is kept

Contact-form submissions and related email correspondence that do not lead to an engagement are kept for up to 12 months and then deleted, unless there is a continuing legitimate reason to retain them. If they lead to an engagement, the data you provide for that work is instead governed by the terms of the engagement (see "Assessment and evaluation engagements" below). Cloudflare Web Analytics data is aggregate and not tied to an identifiable individual, so this retention period does not apply to it.

Your rights

Under UK data protection law, you have the right to: ask for a copy of the personal data held about you; ask for it to be corrected if it is inaccurate; ask for it to be deleted or for its processing to be restricted in certain circumstances; object to processing based on legitimate interests; ask for your data to be provided to you or another organisation in a portable format, where this applies; and, where processing is based on consent, withdraw that consent at any time. This site does not use any automated decision-making or profiling that produces legal or similarly significant effects. To exercise any of these rights, contact greg@gregorygorman.co.uk.

How to complain

If you are unhappy with how your data has been handled, we would welcome the opportunity to address your concern directly at greg@gregorygorman.co.uk. You also have the right to complain to the UK's data protection regulator, the Information Commissioner's Office (ICO), at ico.org.uk (opens in a new tab) or by calling 0303 123 1113.

Assessment and evaluation engagements

If you engage Dr Gregory Gorman for a programme evaluation or assessment validation, any data you provide for that work (for example item-level survey responses) is handled under the terms agreed for that engagement: received anonymised wherever possible, held securely, used only for the agreed work, and deleted on completion. This is separate from, and not affected by, this website's own data handling described above.

Changes to this notice

This notice may be updated from time to time, for example if the services or providers used to run this site change. The version here is always the current one.

Contact

Questions about this notice can be sent to greg@gregorygorman.co.uk.