This Privacy Policy explains how Mary Lumley, trading as MaryLumley.com (“I”, “me”, “my”), collects, uses, and protects your personal information when you visit my website or use my services.

I am committed to protecting your privacy and ensuring that your personal data is handled in accordance with the General Data Protection Regulation (GDPR), the French Data Protection Act (Loi Informatique et Libertés n° 78-17), and other applicable data protection laws.

Collecting Information

Information You Provide

When you interact with this website or my services, you may choose to provide personal information including: your name and email address (when you contact me or enquire about services), contact details and business information (when enquiring about or purchasing services), payment information (processed securely through Stripe), and any other information you choose to share through contact forms or direct communication.

Information Collected Automatically

This website uses Independent Analytics, a privacy-first analytics tool that runs entirely on my own server. It does not use cookies, does not store your IP address, and does not create a profile of you. It records anonymous, aggregated information such as pages visited, referring website, browser type, and approximate country. This data never leaves my server and is never shared with any third party. Because no personal data is collected and no cookies are set, no consent banner is required.

Lawful Basis for Processing

Under GDPR, I process your personal data based on the following lawful grounds:

Consent: When you subscribe to my newsletter, opt into free resources.

Contract: When processing is necessary to deliver services you have purchased or to take steps at your request before entering into a contract.

Legitimate Interests: For website security, and improving my services, where these interests do not override your fundamental rights.

Legal Obligation: When I am required to retain certain records for accounting, tax, or legal purposes.

How I Use Your Information

I use your personal information to: deliver products, services, and resources you have requested; process payments and register you as a customer; respond to your enquiries and provide customer support; send service-related and transactional emails such as booking confirmations, invoices, and project communications; and comply with legal and regulatory obligations.

Cookies

This website does not use analytics, advertising, or marketing cookies, and does not track you across other websites. The only cookies that may be set are strictly necessary technical cookies required for the website to function, such as security cookies set by my content delivery network. These do not identify you and require no consent under GDPR and CNIL guidance.

Email and Client Data

My email and client management system (FluentCRM) is self-hosted on my own server, not run by a third-party marketing platform. Your data stays under my direct control. I do not run a marketing newsletter or mailing list. Any email I send is service-related or transactional.

My website server and email delivery are managed by my hosting provider under a data processing agreement. Outgoing email is sent through Postmark, which acts as a sub-processor within that arrangement.

Third-Party Service Providers

I work with a small number of trusted service providers to deliver my services. They only receive the information necessary to perform their functions and are bound by data processing agreements or equivalent contractual terms. I do not sell, rent, or share your personal information with third parties for their own marketing purposes.

The following providers may process personal data:

• Acuity Scheduling (USA) — Online appointment booking
• Asana (USA) — Project management
• Blog Marketing Academy (USA) — Website hosting and email infrastructure
• Canva (Australia) — Graphic design
• Cloudflare (USA) — Content delivery and website security
• Dropbox (USA) — Document storage
• Fathom (USA) — Meeting notes and transcription
• Postmark (USA) — Email delivery (via my hosting provider)
• Stripe (USA) — Payment processing
• Tailwind (USA) — Content scheduling
• Zoom (USA) — Video calls with clients and business contacts

Where providers are located outside the European Economic Area, transfers are covered by appropriate safeguards such as the EU–US Data Privacy Framework or Standard Contractual Clauses.

Data Retention

I retain your personal data only for as long as necessary to fulfil the purposes for which it was collected. Enquiry and prospect contact data is retained for up to 5 years from our last contact, unless you ask me to delete it sooner. Client and project data is retained for 6 years after the end of our business relationship for accounting and legal purposes. Payment records are retained for 10 years as required by French tax law. Website statistics are anonymous and contain no personal data.

Your Rights

Under GDPR and French data protection law, you have the following rights regarding your personal data:

Right of Access: You can request a copy of the personal data I hold about you.

Right to Rectification: You can ask me to correct any inaccurate or incomplete data.

Right to Erasure: You can request deletion of your personal data (the “right to be forgotten”).

Right to Restrict Processing: You can ask me to limit how I use your data.

Right to Data Portability: You can request your data in a structured, commonly used format.

Right to Object: You can object to processing based on legitimate interests or for direct marketing.

Right to Withdraw Consent: Where processing is based on consent, you can withdraw it at any time.

To exercise any of these rights, please contact me. I will respond to your request within one month. You also have the right to lodge a complaint with a supervisory authority. In France, this is the Commission Nationale de l’Informatique et des Libertés (CNIL).

Use of Artificial Intelligence

I use AI-powered tools to help deliver my services more efficiently and effectively. Here’s what you should know:

How I Use AI

I use Claude (Anthropic), ChatGPT (OpenAI), and Perplexity to assist with tasks including content research, content creation, data analysis, and general administrative work related to my Pinterest marketing services.

Your Data and AI

I do not upload confidential client data, account credentials, or personally identifiable information into any AI tool. All three tools are used on paid plans, which include appropriate data protection terms. Your data is not used to train AI models.

AI-Assisted Content

Any content that has been assisted by AI is reviewed, edited, and approved by me before delivery. What you receive always reflects my own expertise and strategic thinking.

Transparency

If you have questions about how AI is used in your specific project, I’m happy to discuss this with you directly. Contact me.

Links to Other Websites

This website may contain links to external websites that are not under my control. These websites have their own privacy policies, and I have no responsibility for their content or practices. I provide these links for your convenience and information only.

Security

I take appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. However, no method of transmission over the internet is completely secure, and I cannot guarantee absolute security.

Changes to This Privacy Policy

I may update this Privacy Policy from time to time to reflect changes in practices or legal requirements. Any changes will be posted on this page with an updated “Last Updated” date. For significant changes, I may notify you by email or through a notice on this website.

Protection des Données (French)

Conformément au Règlement Général sur la Protection des Données (RGPD) et à la loi n° 78-17 du 6 janvier 1978 relative à l’informatique, aux fichiers et aux libertés, vous disposez d’un droit d’accès, de rectification, d’effacement, de limitation, de portabilité et d’opposition concernant vos données personnelles.

Pour exercer ces droits ou pour toute question relative à la protection de vos données, vous pouvez me contacter à l’adresse [email protected]. Vous avez également le droit d’introduire une réclamation auprès de la Commission Nationale de l’Informatique et des Libertés (CNIL).