Privacy Policy

Who is responsible for your information?

Mrs Sandra Nash, trading as Sandy Nash Admin Support, is the controller of the personal information described in this policy. I am registered with the Information Commissioner’s Office (ICO) under registration reference ZA813403.

Sandy Nash Admin Support is based in Hertfordshire, United Kingdom. If you have a question about this policy or would like to exercise a data protection right, email help@sandynash.com or use the website contact form.

Information I may collect

• Enquiry and contact information, such as your name, email address, telephone number, organisation and the contents of your message.
• Client and project information, such as correspondence, proposals, contracts, instructions, meeting notes, documents and other materials needed to provide the agreed service.
• Business and financial information, such as billing details, invoices, payments and accounting records.
• Website and technical information, such as IP address, browser or device information, pages visited, approximate location and security logs.
• Information supplied by other people or public sources, where relevant to an introduction, an organisation or an agreed project.
• Coaching and participant information, including emergency contact details and relevant health, disability or accessibility information provided on a paper form where this is needed to support someone or run a coaching session safely.

I do not routinely ask for health information through the website contact form. Please avoid including medical details in an initial enquiry unless they are genuinely needed.

For people I coach, I may collect emergency contact details and relevant health, disability or accessibility information on a paper participant form. I use this information to understand any reasonable adjustments, help sessions run safely and respond appropriately if an emergency occurs. Health information is special category data. I rely on explicit consent where required to use it for these purposes. In a genuine emergency, vital interests may also apply where a person is physically or legally unable to give consent.

How and why I use personal information

I use personal information only where there is a lawful reason to do so. Depending on the circumstances, this may be:

• To respond to enquiries and take steps before a contract — for example, discussing your requirements and preparing a quote.
• To provide contracted services — including virtual assistance, website work, AI and business support, table tennis coaching or consultancy, and related administration.
• To meet legal obligations — including tax, accounting, insurance and regulatory requirements.
• For legitimate business interests — such as keeping appropriate business records, improving services, maintaining website and information security, preventing misuse and establishing or defending legal claims. I consider the impact on your rights before relying on this basis.
• With consent — where consent is the appropriate basis, including non-essential analytics cookies, optional marketing and explicit consent for relevant health information collected for coaching. You may withdraw consent at any time.

I do not sell personal information. I do not make decisions about people using solely automated processing where those decisions would have legal or similarly significant effects.

Newsletter and email updates

If I introduce a newsletter, subscribing will be optional and separate from sending a general enquiry. The signup form may use Mailchimp to collect and manage your name, email address, subscription preferences and a record of when and how you subscribed.

For individual subscribers, newsletters will normally be sent with consent. In limited circumstances, I may contact existing customers about my own similar services where the UK Privacy and Electronic Communications Regulations allow the customer “soft opt-in”. Existing contact details will not be added to a newsletter merely because I already hold them. Every marketing email will provide a clear way to unsubscribe, and you can also withdraw consent or object at any time by emailing help@sandynash.com.

If Mailchimp is used, subscriber information will be processed by Intuit Mailchimp as a service provider and may be processed outside the United Kingdom under applicable transfer safeguards. The signup form and this policy will be updated with the final arrangements before newsletter subscriptions begin.

The website, forms and cookies

This website is built with WordPress and hosted by IONOS. If you use the contact form, the details you enter are processed through SureForms and sent to help@sandynash.com so that I can respond.

The site uses Complianz to manage cookie choices and security technology, including Wordfence, to help detect malicious traffic and protect the website. Security tools may process IP addresses and technical log information for these purposes.

Google Site Kit connects the site with services including Google Analytics and Google Search Console. Google Analytics can use cookies and similar technologies to provide information about visits and how the site is used. Non-essential analytics should run only after you have made an affirmative choice through the site’s cookie controls. You can change or withdraw that choice at any time using the Cookie settings control, and you can also control cookies through your browser.

Links to LinkedIn, Facebook, Instagram and other external websites take you to services with their own privacy policies. Sandy Nash Admin Support is not responsible for the privacy practices of those external sites.

Who information may be shared with

Information is shared only where needed for a legitimate purpose. Recipients may include:

• website, email, form, security, analytics and backup providers, including IONOS, SureForms, Google, Complianz, Wordfence and UpdraftPlus;
• professional advisers, accountants and insurers where their support is needed;
• emergency services, venue staff or another appropriate person where necessary to protect someone’s safety or respond to an emergency;
• stand-in coaches, where they need limited contact, accessibility or safety information for an agreed coaching session or another legitimate coaching purpose;
• carefully selected contractors or service providers working under appropriate confidentiality and data protection terms; and
• regulators, courts, law-enforcement bodies or other parties where disclosure is required by law or needed to protect legal rights.

Website backups may be stored in Google Drive through UpdraftPlus. Some technology providers may process information outside the United Kingdom. Where restricted international transfers apply, I use providers and arrangements intended to provide the safeguards required by UK data protection law, such as UK adequacy regulations or approved contractual safeguards.