Privacy
policy.

Who I am

This website, fathomnorthstudio.com, is run by Theresa Coughlin, trading as Fathom North Studio, a sole trader based in Ireland. Under data protection law I am the controller of the personal information collected through this website and in running the business. In this policy, “I”, “me” and “we” all mean Fathom North Studio.

As a small business I am not required to appoint a Data Protection Officer. Any privacy question comes straight to me.

The short version

What I collect and why

When you send an enquiry or request a free check-up

Your name, email address, business name, phone number, current website, the services you’re interested in, your timeline and your message. I use this to reply and to prepare for our conversation or your check-up report. Submissions are emailed to me and also stored in the website’s database.

Legal basis: taking steps at your request before entering into a contract (GDPR Art. 6(1)(b)) and my legitimate interest in responding to enquiries (Art. 6(1)(f)).

When you book a call

Your name, email address, the time you choose, any notes you add and, if you choose a phone call, your phone number. Bookings are handled by Cal.com, added to my Google Calendar, and video calls use Google Meet (or Zoom if offered).

Legal basis: steps before a contract (Art. 6(1)(b)).

When you become a client

Contact and billing details, project content and files you send me, any logins or access you give me to do the work, and records of invoices and payments.

Legal basis: performing our contract (Art. 6(1)(b)) and complying with legal obligations such as tax and accounting rules (Art. 6(1)(c)).

When you email or message me

Your email address and whatever you choose to include in the message.

Legal basis: my legitimate interest in replying (Art. 6(1)(f)), or steps before a contract.

When you browse this website

Like every website, the server and Cloudflare (which protects and speeds up the site) process technical information such as your IP address, browser and device type, the pages you visit, the site that referred you and the date and time. This keeps the site secure and working. Cloudflare Web Analytics gives me simple, aggregated visitor counts without using cookies.

If you accept analytics cookies, Google Analytics also collects information about how you use the site, such as pages viewed, time spent and approximate location (country or city). Google Analytics 4 does not log or store IP addresses for visitors in the EU.

Legal basis: my legitimate interest in running a secure, reliable website (Art. 6(1)(f)) for technical data and cookieless statistics; your consent (Art. 6(1)(a)) for Google Analytics.

Spam protection on forms

The forms are protected by Cloudflare Turnstile, which checks signals from your browser to tell people from bots. It doesn’t show puzzles and isn’t used for advertising.

Legal basis: my legitimate interest in keeping the forms free from spam and abuse (Art. 6(1)(f)). It’s strictly necessary for the security of the service you’re using, so it doesn’t require cookie consent.

Newsletter (if offered)

If I offer a newsletter and you sign up, I’ll keep your email address, your name if you give it, when and how you signed up, and basic engagement data such as whether an email was opened or a link clicked. Every email has an unsubscribe link.

Legal basis: your consent (Art. 6(1)(a)). For existing clients, I may send occasional relevant updates under the ePrivacy rules for existing customers, and you can opt out at any time.

Live chat and AI chat assistant (if offered)

If the site offers a live chat or an AI chat assistant, I’ll receive the messages you type, any contact details you choose to share, and technical information about your session. An AI assistant’s replies are generated automatically by an AI service provider, which processes your messages to produce them. It’s there to answer questions, not to make decisions about you. Please don’t share sensitive personal information in a chat. Where a provider offers the option, I choose settings that stop your conversations being used to train their AI models.

Legal basis: my legitimate interest in answering questions quickly (Art. 6(1)(f)), or your consent where a chat tool uses non-essential cookies.

Embedded content and social media

Some pages may include content from other services, such as YouTube or TikTok videos, Google reviews or Google Maps. These only load after you accept the relevant cookies. Once loaded, those companies may collect information about you under their own privacy policies. If you contact me through a social media platform, that platform’s privacy policy also applies.

I don’t ask for, and would ask you not to send, special category information such as health details, religious beliefs or political opinions.

Cookies

Cookies are small files saved on your device. Strictly necessary cookies are set without asking, because the site can’t work securely without them; this is allowed under Ireland’s ePrivacy Regulations (S.I. No. 336 of 2011), the UK’s PECR and Germany’s TDDDG (§25). Everything else only loads after you choose “Accept” in the cookie banner. You can change your choice at any time using the Cookie settings link at the bottom of every page.

You can also block or delete cookies in your browser settings. Blocking strictly necessary cookies may stop parts of the site, such as the forms, from working.

Who I share it with

I use a small number of trusted service providers who process data on my behalf under contracts that meet GDPR Article 28. They may only use it to provide their service to me. I never sell or rent personal information.

I may also disclose information if the law requires it, to protect my legal rights, or to a buyer or successor if the business is ever sold, in which case this policy would continue to apply.

International transfers

This website is hosted in the EU, and Switzerland is recognised by the European Commission as giving adequate protection. Some providers, such as Cloudflare, Google, Zoom and Cal.com, are based in or may access data from the United States. Where that happens, transfers are protected by the EU-US Data Privacy Framework (where the provider is certified) and/or the European Commission’s Standard Contractual Clauses, with the UK Addendum or UK Extension for UK data. You can ask me for details of these safeguards.

How long I keep it

Your rights

If you’re in the EU, the UK or another country with similar laws, you have the right to:

To use any of these rights, email [email protected] or write to the address above. It’s free. I’ll reply within one month; if a request is complex I may need up to two more months and will tell you why. I may need to confirm your identity first.

Complaints

If you’re unhappy with how I’ve handled your information, please tell me first and I’ll do my best to put it right. You also have the right to complain to a data protection authority:

Visitors in Germany

Personal data is processed under the GDPR, and access to information on your device (cookies and similar technologies) under §25 of the Telecommunications Digital Services Data Protection Act (TDDDG). Non-essential cookies are only used with your consent under §25(1) TDDDG; strictly necessary ones rely on §25(2) TDDDG.

Right to object (Art. 21 GDPR): where I process your data on the basis of legitimate interests (Art. 6(1)(f)), you can object at any time on grounds relating to your particular situation. Where your data is used for direct marketing, you can object at any time without giving a reason, and I will stop.

Visitors in the United Kingdom

UK visitors are protected by the UK GDPR, the Data Protection Act 2018 and, for cookies, the Privacy and Electronic Communications Regulations (PECR). You have the same rights described above. Because my processing of UK residents’ data is occasional and low-risk, I have not appointed a UK representative (UK GDPR Article 27(2)).

California and other US states

This section applies to residents of California and other US states with consumer privacy laws, to the extent those laws apply to my business.

Information collected in the last 12 months: identifiers (such as name, email address, phone number and IP address); commercial information (services requested or bought); internet activity (how you use this website); and professional information (your business name and role). I collect it from you, from your device, and from the service providers listed above, for the purposes described in this policy. I don’t collect sensitive personal information as defined by the CCPA.

No selling or sharing: I don’t sell personal information or share it for cross-context behavioural advertising, and I haven’t done so in the last 12 months. I don’t knowingly sell or share the information of anyone under 16.

Your rights: to know what I collect and how I use it; to access, correct and delete it; to opt out of any selling or sharing; and not to be treated differently for using these rights. I honour Global Privacy Control (GPC) browser signals as an opt-out request.

To make a request, email [email protected]. I’ll confirm receipt within 10 days and respond within 45 days, and may need to verify your identity. You can use an authorised agent with your written permission. If you live in a state that offers an appeal and I decline your request, reply with “Appeal” in the subject line and I’ll review it.

Children

This website and my services are for businesses and adults. They’re not aimed at children under 16, and I don’t knowingly collect their information. If you believe a child has sent me personal information, contact me and I’ll delete it.

Keeping it secure

I use HTTPS across the site, Cloudflare security, up-to-date software, strong unique passwords with two-factor authentication, restricted access and regular backups. No system is completely secure, but if a breach ever puts your information at risk I’ll notify the Data Protection Commission within 72 hours where required, and tell you directly if there’s a high risk to you.

Websites I host for clients

If I build or host a website for your business, the personal information collected by that website (for example, from its visitors or customers) is controlled by your business, not by me. I act as a processor on your behalf under a separate data processing agreement. Visitors to a client’s website should contact that business about their privacy, and I’ll help my client respond.

Changes to this policy

I’ll update this policy when my services, tools or the law change. The date at the top shows when it last changed. If I make a significant change, I’ll make it clear on the website, and tell clients directly where appropriate.

Contact

Questions about this policy or your information? Email [email protected], call +353 87 405 0804, or write to Theresa Coughlin, Fathom North Studio, West End, Bundoran, Co. Donegal, F94 A338, Ireland.