Privacy Policy

Last updated: May 2026

This page explains what data is collected when you use this website (geraldwhitlock.co.uk), how it is used, and your rights under UK GDPR (the UK General Data Protection Regulation) and the Data Protection Act 2018.

Who runs this website

This website is operated by Smeets Sales & Media, a sole proprietorship registered in the Netherlands. Postal address: Rentmeesterlaan 11, 6002EH, Weert, the Netherlands. Contact email for privacy matters: letters@geraldwhitlock.co.uk.

The website is aimed at a UK audience. Where UK GDPR provides stronger protection than EU GDPR, we apply UK GDPR. Where EU GDPR provides stronger protection, we apply EU GDPR.

What data is collected

If you submit the email opt-in form

When you submit the form to receive the free guide (or any other opt-in form on this site), we collect:

• Your first name
• Your email address
• The date and time of submission
• Approximate IP address (used to detect spam and abuse only — not used for tracking)

The data is stored in Kit (formerly ConvertKit), our email marketing provider. Kit is a US company with UK GDPR-compliant data processing in place. Their privacy policy is at kit.com/privacy.

If you make a purchase

When you buy a guide, checkout is handled by Lemon Squeezy, a US-based payment processor that acts as Merchant of Record for our digital products. Lemon Squeezy collects:

• Your name and email address
• Your billing address (for VAT purposes)
• Your payment method (we never see or store your card details)
• The transaction record

Lemon Squeezy is the data controller for that transaction data and uses it to process the payment, issue your receipt, handle VAT compliance, and provide customer support. Their privacy policy is at lemonsqueezy.com/privacy.

We receive your name and email from Lemon Squeezy after purchase so we can deliver the product and send any follow-up emails described on the sales page.

If you browse the website

We do not currently use third-party analytics or advertising trackers. Our hosting provider (Vercel) maintains anonymous server logs of website traffic (IP address, browser type, page requested, referrer). These logs are kept for up to 30 days for security and operational purposes.

We do not use cookies for tracking, advertising, or user identification.

How the data is used

Your name and email are used to:

• Deliver the product or guide you requested
• Send the email sequence described on the relevant sales or opt-in page
• Respond to questions or refund requests you send us
• Send occasional related emails about new guides or updates (with a clear unsubscribe link in every email)

We do not sell, rent, or share your data with any third party for marketing purposes.

Legal basis for processing

Under UK GDPR and EU GDPR, our legal basis for processing your data is:

• Consent — for the email list. You opt in voluntarily and can unsubscribe at any time with one click.
• Contract — for purchases. Processing your data is necessary to deliver the product you paid for.
• Legitimate interests — for basic server logs and fraud prevention, balanced against your privacy interests.

How long the data is kept

• Email list: until you unsubscribe. After unsubscribe, your email is retained only as a suppression record (so we don't accidentally email you again) and is deleted on request.
• Purchase records: retained for 7 years to comply with HMRC and Belastingdienst record-keeping requirements for businesses selling to UK and EU customers.
• Server logs: up to 30 days.

Your rights under UK GDPR

You have the right to:

• Access the personal data we hold about you
• Rectify inaccurate data
• Erase your data (subject to legal record-keeping requirements for purchases)
• Restrict the processing of your data
• Object to processing for direct marketing (one-click unsubscribe in every email)
• Data portability — receive your data in a machine-readable format
• Withdraw consent at any time
• Lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk

To exercise any of these rights, email letters@geraldwhitlock.co.uk. We respond within 30 days.

International data transfers

Our service providers (Kit, Lemon Squeezy, Vercel) are based in the United States. Data transfers to the US are protected by Standard Contractual Clauses and the UK-US Data Bridge / EU-US Data Privacy Framework.

Children

This website is intended for adults aged 18 and over. We do not knowingly collect data from anyone under 18.

Changes to this policy

If we change this policy, we will update the "Last updated" date at the top. Significant changes will be notified to email subscribers.

Contact

Questions about privacy: letters@geraldwhitlock.co.uk