Your privacy at Harbour Studio

Last updated 4 August 2026

Harbour Studio respects your privacy. This policy explains what personal information we collect, why we use it, who we share it with and the choices you have.

1. Who is responsible for your information?

Johanna Bain-Sales, trading as Harbour Studio, is the data controller responsible for the personal information described in this policy. Harbour Studio is a sole-trader business based in Edinburgh, Scotland.

For questions, rights requests or data protection complaints, email [email protected]. The website is harbourstudio.org.

2. Who this policy applies to

This policy applies when you visit harbourstudio.org, download a free resource, join the email list, contact Harbour Studio, purchase a product or service, or work with Harbour Studio as a client. It also applies to business contacts and people who interact with Harbour Studio in connection with these activities.

The website and services are intended for adults. Harbour Studio does not knowingly collect personal information directly from children.

3. Personal information we collect

Contact and identity details. Your name, email address, business name, role, telephone number and any other contact details you choose to provide.

Enquiries and communications. The content of messages, forms, emails and other correspondence, including information you provide when asking about a service.

Newsletter and free-resource details. Your name, email address, sign-up source, preferences, and records showing when and how you consented or unsubscribed.

Client and service information. Information about your business, goals, processes and systems; intake responses; notes created while delivering the service; agreed actions; documents or materials you provide; and service correspondence.

Purchase and transaction information. What you purchased, the amount, payment status, billing details, invoices and related records. Card details are entered directly into Stripe and Harbour Studio does not receive or store your full card number or security code.

Technical and website information. IP address, browser and device information, timestamps, referring pages, pages visited and cookie or similar technology data collected by the website platform. The exact information depends on the settings and cookies active when you visit.

Harbour Studio does not ask for health information or other special-category personal data as part of its ordinary services, and coaching calls are not recorded. Please do not send special-category information unless Harbour Studio has specifically asked for it and explained why it is necessary.

4. How we collect information

Most information comes directly from you when you complete a form, subscribe, email, purchase or take part in a service. Technical information may be collected automatically through FEA Create, the platform used to host the website, forms, email communications and customer records. Harbour Studio may also receive payment confirmation and limited transaction information from Stripe.

If another person introduces you or gives Harbour Studio your contact details, Harbour Studio will use them only where it is reasonable and lawful to do so and will provide privacy information where required.

5. Why we use your information and our lawful bases

To respond to enquiries and discuss services. This is necessary to take steps at your request before entering into a contract, and may also support Harbour Studio’s legitimate interest in communicating with prospective clients.

To deliver a requested free resource. This is necessary to provide what you asked for. Receiving a resource does not by itself authorise unrelated marketing unless the sign-up wording clearly says that you are also joining the email list and you consent to that.

To send newsletters and marketing emails. Harbour Studio relies on your consent where consent is required. You can withdraw it at any time by using the unsubscribe link in an email or contacting Harbour Studio.

To provide purchased products and services. This is necessary to perform the contract with you and to take requested steps before entering into it.

To process payments, keep accounts and meet tax obligations. This is necessary to perform the contract and comply with legal obligations.

To operate, protect and improve the website and services. Harbour Studio relies on legitimate interests in running a secure, effective business. Where optional cookies or similar technologies require consent, Harbour Studio relies on that consent instead.

To prevent misuse and establish, exercise or defend legal claims. Harbour Studio relies on legitimate interests in protecting the business and its legal rights, and on legal obligations where applicable.

Where Harbour Studio relies on legitimate interests, it considers whether the use is necessary and balances those interests against your rights and reasonable expectations. You may object to processing based on legitimate interests; see section 11.

6. Email marketing

Harbour Studio sends newsletters and promotional emails only where there is a lawful basis and the electronic marketing rules allow it. Sign-up forms will explain what you are agreeing to. Consent will not be hidden in general terms or based on a pre-ticked box.

Every marketing email will provide a simple way to unsubscribe. After you unsubscribe, Harbour Studio may retain the minimum information needed on a suppression list so that your preference is respected. This record will not be used to send you marketing.

7. Cookies and similar technologies

FEA Create may use cookies and similar technologies that are necessary for the website to function securely, remember choices or provide a service you request. Harbour Studio may also use optional analytics or marketing technologies if they are enabled on the website.

Where consent is required, optional technologies will not be used until you make a choice. You can change or withdraw your choice through the cookie settings made available on the website. The cookie notice or settings panel identifies the technologies currently in use, their purposes, providers and durations. Browser settings can also be used to control cookies, although blocking necessary cookies may affect how the site works.

8. Who we share information with

Harbour Studio shares personal information only where needed for the purposes described in this policy. Recipients may include:

FEA Create / Carrie & Co Ltd. The provider of the website, hosting, forms, email tools, automations and customer-management functions used by Harbour Studio.

Stripe. The payment provider used to process online payments, manage payment security and prevent fraud. Stripe processes payment information under its own privacy terms for some activities.

Professional advisers and service providers. For example, an accountant, legal adviser, IT support provider or contractor, where access is necessary and subject to appropriate confidentiality or data-protection arrangements.

Authorities and other parties required by law. Where disclosure is necessary to comply with a legal obligation, protect legal rights, prevent fraud or respond to a lawful request.

Harbour Studio does not sell or rent your personal information.

You can read the providers’ own information here: FEA Create Privacy Policy and Stripe Privacy Centre.

9. International transfers

Some service providers may store or access personal information outside the United Kingdom. Where this happens, Harbour Studio takes steps to ensure that an appropriate safeguard is in place, such as a UK adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another safeguard permitted by data-protection law. You can contact Harbour Studio for more information about the safeguards relevant to your information.

10. How long we keep information

Enquiries that do not become clients. Normally up to 12 months after the last meaningful contact, unless a longer period is needed for a complaint or legal issue.

Newsletter records. For as long as you remain subscribed. Consent records are kept while Harbour Studio relies on the consent. After you unsubscribe, a minimal suppression record may be retained so your choice can be honoured.

Client service records. Normally up to five years after the client relationship ends, unless there is a legal, regulatory or contractual reason to keep particular records for longer or delete them sooner.

Invoices, transaction and tax records. For at least five years after the 31 January submission deadline for the relevant tax year, or longer where HMRC rules or another legal obligation require it.

Technical records. According to the purpose and retention settings of the website and security tools. Harbour Studio will review these settings and keep personal information only for as long as it is reasonably needed.

When information is no longer needed, Harbour Studio will delete or anonymise it, subject to reasonable backup cycles and any requirement to preserve information connected with a dispute, rights request or legal claim.

11. Your data-protection rights

Depending on the circumstances and the lawful basis used, you may have the right to:

Access. Ask for a copy of your personal information and information about how it is used.

Correction. Ask for inaccurate or incomplete information to be corrected.

Erasure. Ask for information to be deleted in circumstances where the law gives you this right.

Restriction. Ask Harbour Studio to limit how information is used in certain circumstances.

Objection. Object to processing based on legitimate interests and object at any time to direct marketing.

Portability. Receive certain information you provided in a structured, commonly used and machine-readable format, or ask for it to be transferred where technically feasible.

Withdraw consent. Withdraw consent at any time where processing relies on consent. This does not affect processing carried out before withdrawal.

Rights are not absolute and may not apply in every situation. To exercise a right, email [email protected]. Harbour Studio may ask for information needed to verify your identity. There is normally no fee, and requests will normally be answered within one month, subject to lawful extensions for complex or multiple requests.

12. Complaints

If you are unhappy with how Harbour Studio has handled your personal information, email [email protected] with the subject line ‘Data protection complaint’ and explain what has happened and what outcome you are seeking.

Harbour Studio will acknowledge a data-protection complaint within 30 days, take appropriate steps to investigate it without undue delay, keep you informed where appropriate and tell you the outcome.

You also have the right to complain to the UK Information Commissioner’s Office (ICO). Visit ico.org.uk/make-a-complaint. The ICO generally recommends giving the organisation an opportunity to resolve the issue first.

13. Security

Harbour Studio uses appropriate technical and organisational measures intended to protect personal information against accidental loss, unauthorised access, alteration or disclosure. Access is limited to people and providers who need it for legitimate business purposes. No online service is completely secure, but Harbour Studio reviews its arrangements and responds to suspected personal-data breaches in line with legal obligations.

14. Changes to this policy

Harbour Studio may update this policy when services, providers or legal requirements change. The current version will be published on harbourstudio.org with the date of the latest update. If a change materially affects how Harbour Studio uses information already collected, Harbour Studio will take reasonable steps to bring it to the attention of affected people and obtain fresh consent where required.