Privacy notice
This notice explains how Ham Agency Ltd uses personal data collected through stephhamill.com, including Free tools, our free tools at stephhamill.com/shelf. We've written it to be read. If anything is unclear, ask us.
We also run ham.agency. The notice on that site covers the forms and tools there. It's the same company, with the same contact details, and your rights are the same on both.
Who we are
Ham Agency Ltd ("HAM", "we", "us") is the controller of the personal data described here. stephhamill.com is the site for the work of Steph Hamill, HAM's founder and director, and HAM runs it.
- Registered in England and Wales, company number 11265213.
- Registered office: 510 The Chocolate Factory, 5 Clarendon Road, London N22 6XJ.
- Contact for anything in this notice: theteam@ham.agency, or post to the registered office marked for the attention of the director.
We're a small business and aren't required to appoint a data protection officer. Steph Hamill is responsible for how we handle personal data.
What we collect
We collect only what we need for the thing you asked for. Apart from Free tools, stephhamill.com has no forms.
| Where | What we collect |
|---|---|
| Emailing us | If you email steph@ham.agency or theteam@ham.agency, including through the "Ask about a talk" button: your name, email address, your message and anything else you choose to tell us |
| Free tools | Your email address, the tool you picked and your monthly release choice. See Free tools below |
| Counting visits | Pages viewed, where visitors came from, browser, operating system, device type and country, counted in aggregate without cookies. See Cookies and counting visits below |
| Hosting | Our hosting provider keeps technical logs, including IP addresses, for a short period to keep the site secure and working |
Please don't send us health information or other sensitive personal data. Nothing on the site asks for it.
Emailing us doesn't put you on a mailing list.
Links to other sites
stephhamill.com links to other sites, including Gumroad, Substack, LinkedIn, Instagram, Medium, a speaker agency and stephanie-hamill.com. Once you follow a link, that site's own privacy notice applies, not this one. Steph Sense, Steph's newsletter on Substack, is separate from Free tools's monthly release.
Why we use it, and our lawful basis
UK data protection law requires a lawful basis for each use. These are ours for stephhamill.com. Free tools has its own table in its section.
| What we do | Lawful basis |
|---|---|
| Reply to your email, talk about a booking or a piece of work, and prepare a proposal | Taking steps at your request before a contract, and legitimate interests: answering people who contact us |
| Count visits to see which pages are useful | Legitimate interests |
| Keep the site and the tools secure, and stop abuse | Legitimate interests |
| Keep business, tax and accounting records | Legal obligation |
| Establish or defend legal claims | Legitimate interests |
Our legitimate interests are running HAM, answering people who contact us, keeping our free tools free and working, and knowing which parts of the site are useful. We've weighed these against your interests and rights. You can object at any time (see Your rights).
Free tools (free tools)
Free tools is HAM's free library of tools at stephhamill.com/shelf. Ham Agency Ltd is the controller. Everything else in this notice, including who we are, your rights and how to complain, applies here too.
To get a tool, you give us an email address. That's all we ask for. We don't ask for your name, and we don't need it. There is no code and no account.
What we collect
| When | What |
|---|---|
| You ask for a tool | Your email address, the tool you picked, whether you ticked the monthly release box, and when |
| Any visit to the free tools | Your IP address, kept for a short time in our host's security logs |
Why we use it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Give you the tool you picked | Legitimate interests: giving you what you asked for |
| Turn away throwaway addresses | Legitimate interests: keeping free tools free of abuse |
| Keep a record of who has which tool | Legitimate interests: knowing which tools are useful, and what to publish next |
| Send you the new release each month | Consent: the box you ticked. Every tool works without ticking it |
| Keep a record of your consent and of your unsubscribe | Legitimate interests: showing we had your consent, and making sure we don't contact you after you leave |
You can object to our use of legitimate interests at any time. Email theteam@ham.agency.
Checking your email address
We turn away addresses from known throwaway email services, using a published list we keep on our own systems. We don't send a code or any other test message.
The monthly release
We only send it if you ticked the box. It's one email a month about the new release. We send it from HubSpot, the contact system where your email is kept.
Every email has an unsubscribe link. Leaving is free and takes effect straight away. We keep a note that you unsubscribed, so we don't contact you again. Your tools keep working.
The diagnostic
The diagnostic isn't open yet. Before it opens, we'll add a section to this notice on what happens to what you type into it, including the AI model that writes the read.
Cookies on Free tools
Visitors to the free tools get no cookies from us. The link that opens your tool lasts 30 minutes and is not stored on your device.
There are no analytics or advertising cookies. Visits are counted without cookies, as explained under Cookies and counting visits below.
Who processes it for us
| Provider | What they do | Where the data is stored |
|---|---|---|
| Vercel Inc. | Hosts the free tools and passes your email to HubSpot. It does not keep it | London for the form. Pages are delivered through Vercel's global network |
| HubSpot | Our contact system. It keeps your email, the tool you picked and your monthly release choice, and sends the monthly release | The EU (Germany) |
| Google (Google Workspace) | Our email, so messages you send us reach us | UK, EU and USA |
Each provider works under written data processing terms. Staff at some of these providers, or at their US parent companies, may reach data held in the UK or the EU to support and secure their service. That counts as a transfer outside the UK, and it's covered as set out under Transfers outside the UK below.
How long we keep it
| Data | How long |
|---|---|
| Your email and the tools you asked for, if you're not on the monthly release | 24 months from the last time you asked for a tool, then deleted |
| Your email and the tools you asked for, if you're on the monthly release | Until you unsubscribe, then as above |
| Your consent record and your unsubscribe | As long as we keep your email, and afterwards for as long as we need it to avoid contacting you again |
Children
Free tools is for people running businesses and projects. It isn't aimed at anyone under 18.
Cookies and counting visits
Visitors to stephhamill.com get no cookies from us. The only cookie is:
- a short-lived security cookie, if our host ever has to check that visitors are people, during an attack for example.
It is strictly necessary to keep the site secure, so we don't ask for consent to it. There are no analytics or advertising cookies.
Counting visits
We count visits with Vercel Web Analytics. It doesn't use cookies and doesn't store anything in your browser. Each visit is counted using a scrambled value made from the request, which Vercel discards within 24 hours, so it can't follow you from site to site or from one day to the next. We see totals only: pages viewed, where visitors came from, browser, operating system, device type and country, plus four counts from Free tools (codes sent, sign-ins, downloads and monthly release sign-ups). None of them carries your email, your number or your name. We use them only to improve the site.
The law lets us count visits this way without asking first, as long as we tell you and give you a simple, free way to object. You can object in either of these ways:
- Turn on Global Privacy Control in your browser. We treat it as an objection and don't count your visits.
- Use the switch below. It stops your visits being counted on this device, and stores one small setting in your browser, only to remember that choice.
Your visits are counted in the totals, without cookies.
Who we share it with
We never sell personal data. We share it only with providers who process it on our behalf under written data processing terms, and only for the purposes in this notice. The providers behind Free tools are listed in its section. For the rest of stephhamill.com:
| Provider | What they do for us | Where the data may be processed |
|---|---|---|
| Vercel Inc. | Hosts the site and counts visits | Vercel's global network, including the USA |
| Google (Google Workspace) | Our email, calendar and documents | UK, EU and USA |
We may also share personal data with our professional advisers (such as accountants and lawyers) under a duty of confidence, and with authorities where the law requires it. If HAM is ever sold or restructured, personal data may pass to the new owner, who must use it in line with this notice.
Transfers outside the UK
Free tools's data is stored in London. Some of our providers are US companies, or are owned by one, and their staff may reach data from outside the UK to support and secure their service. The law treats that as a transfer, even when the data stays stored in London.
Where a provider is certified under the UK Extension to the EU-US Data Privacy Framework, we rely on the UK's adequacy regulations for the USA. Each provider's terms also include the ICO's International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses. Amazon's contracting company is in Luxembourg, which UK law treats as adequate. Ask us if you'd like the safeguard for a particular provider.
How long we keep it
| Data | How long |
|---|---|
| Emails and enquiries that don't become work | 24 months from your last contact with us, then deleted |
| Client records | For the engagement and 6 years after it ends, for tax and legal reasons |
| Hosting logs | A short period set by our host, for security, then deleted |
| Counting visits | Totals only, which don't identify you. The scrambled daily value is discarded within 24 hours |
| Free tools | See the table in Free tools above |
Your rights
You have the right to:
- ask for a copy of the personal data we hold about you
- ask us to correct it if it's wrong or incomplete
- ask us to delete it
- ask us to restrict how we use it
- object to how we use it, and in particular object to direct marketing at any time, which we'll always respect
- ask for data you gave us in a portable format
- withdraw your consent at any time, where we rely on consent.
To use any of these rights, email theteam@ham.agency. There's normally no charge. We'll reply within one month. For complex requests we may extend that by up to two further months, and we'll tell you why. We may need to confirm your identity first.
Complaints
If you're unhappy with how we've handled your personal data, please tell us first at theteam@ham.agency. We'll acknowledge your complaint within 30 days and reply in full as quickly as we can.
You also have the right to complain to the Information Commissioner's Office, the UK regulator:
- Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
- Telephone 0303 123 1113
- Online at ico.org.uk/make-a-complaint
Keeping it secure
Access to personal data is limited to the people at HAM who need it for the purposes above. Our accounts are protected by passwords and two-factor sign-in, and Free tools's admin pages need a passkey. Codes and our do-not-contact list are held only in scrambled form, and data travels encrypted between your browser, our site and our providers. Our providers are bound by written security and confidentiality terms.
Children
This site is for people running businesses and projects, and for people booking talks. It isn't aimed at anyone under 18, and we don't knowingly collect their personal data.
Changes to this notice
We'll update this notice when how we use personal data changes. The date at the top shows when it last changed. If a change affects the monthly release, we'll tell subscribers before it takes effect.