In short
I only collect what I need to reply to you and deliver your work. I don't sell your information, and I don't use advertising or tracking cookies.
Who is responsible
Charlotte Smith is the data controller for information collected through this website. You can contact me about your data at hello@bycharlottesmith.com.
What I collect and why
When you send an enquiry
Your name, email, business name and anything you write in the form, so I can reply. Lawful basis: taking steps at your request before a contract, and my legitimate interest in answering enquiries.
When you place an order
Your contact details, country, VAT number if you give one, your brief and any files or links you share, so I can deliver the work, send your receipt and invoice, and keep business records. Lawful basis: performing our contract and meeting legal obligations, such as tax and accounting rules.
Payments
Payments are handled by PayPal. I receive confirmation of payment, the payer's email address and a transaction reference. I never see or store card details. PayPal's own privacy statement applies to the information you give them.
Calls
If you book a call, Google Calendar records the time you choose and the details you enter.
Website visits
The site uses Vercel Web Analytics to count visits and popular pages. It doesn't use cookies or identify you personally. The hosting provider also keeps short-lived technical logs to keep the site secure.
Your cart
Your cart and checkout draft are saved in your own browser so they aren't lost if you leave the page. They stay on your device and you can clear them at any time.
Who I share it with
Only the services needed to run the business: Vercel (website hosting), Google Workspace (email and calendar), PayPal (payments) and the EU VIES service (to check VAT numbers). Some of these providers process data outside the EU, under safeguards such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework. I also share information with my accountant where needed for tax purposes.
How long I keep it
- Enquiries that don't lead to work: up to 12 months.
- Briefs and project files: for the project, and up to 12 months after, unless you ask me to delete them sooner.
- Orders, invoices and payment records: as long as tax and accounting law requires.
Your rights
You can ask to see, correct or delete your information, to limit or object to how I use it, or to receive a copy of it. Just email me and I'll reply within one month. If you're unhappy with how I've handled your data, you can complain to Malta's Information and Data Protection Commissioner (idpc.org.mt) or the data protection authority where you live.
Changes
If I change this policy, I'll update this page and the date at the top.