Privacy Policy

1. Who I am

Last updated: September 30, 2026

This policy explains how personal data is handled when you visit nickysullivan.com or contact me.

The data controller is Nicola Sullivan, trading as Nicky Sullivan, sole practitioner, Siret: 95267776300015, Navarrenx 64190, France.

For any privacy question or request, email nicky@nickyjsullivan.com. I am a sole practitioner and am not required to appoint a Data Protection Officer, so I handle requests personally.

2. What data I collect, why, and on what legal basis

I collect only what you give me or what is needed to run the site. I do not sell personal data or use it for automated decision-making or profiling.

Answering your enquiry: name, email, organisation, your message, anything else you choose to include

Steps taken at your request before a possible contract (6(1)(b)), or my legitimate interest in responding to professional enquiries (6(1)(f))

Delivering and invoicing services: contact details, correspondence, billing details of your organisation

Performance of a contract (6(1)(b)); legal obligations for accounting records (6(1)(c))

Your consent (6(1)(a)), which you can withdraw at any time

Site analytics: pages visited, referring site, device and browser type, approximate location (country/region), IP address [truncated, if your analytics tool offers this]

Your consent, given through the cookie banner (6(1)(a))

Security and site operation: IP address, server logs

My legitimate interest in keeping the site secure and working (6(1)(f))

Please do not send sensitive information (for example health data, or details of beneficiaries) through the contact form. If a project requires it, we will agree a secure way to share it.

3. Cookies

The site uses two kinds of cookies:

  • Strictly necessary cookies, set by Squarespace to make the site work (security, load balancing, remembering your cookie choice). These do not need consent.

  • Analytics cookies, set by [analytics tool] to show me how the site is used. These are placed only if you click "Accept" on the cookie banner.

You can change your choice at any time via [the cookie settings link in the site footer]. Refusing analytics cookies does not affect your use of the site. Your choice is remembered for [6] months, after which you will be asked again; analytics cookies last no longer than 13 months.

4. Who I share data with, and transfers outside the EU

I share personal data only with Michael Sullivan, and service providers who process it on my behalf, under contracts that bind them to the GDPR (Art. 28):

Squarespace: website hosting, contact form, cookie banner, analytics

Proton: receiving and storing enquiries and correspondence

EU and USA

I may also disclose data where the law requires it, for example to tax authorities.

Transfers outside the EU. Some providers are based in, or store data in, the United States. Where they are certified under the EU–US Data Privacy Framework, transfers rely on the European Commission's adequacy decision; otherwise they rely on the Commission's Standard Contractual Clauses. You can ask me for a copy of the relevant safeguards.

Because many of my clients are US organisations, correspondence about a project will naturally be sent to recipients in the USA at your request.

5. How long I keep data

Enquiries that do not lead to work: 3 years from our last contact

Client correspondence and project records: the length of the engagement plus 5 years

Invoices and accounting records: 10 years, as required by French commercial law

Newsletter subscription: until you unsubscribe; addresses that have not opened an email in 3 years are removed

Analytics data: 13 months

Server and security logs: up to 12 months

After these periods, data is deleted or anonymised.

6. Your rights

Wherever you live, you have the following rights over your personal data:

  • Access: get a copy of the data I hold about you

  • Rectification: have inaccurate data corrected

  • Erasure: have data deleted, unless I must keep it by law

  • Restriction: ask me to pause processing while a question is resolved

  • Portability: receive data you gave me in a common machine-readable format

  • Objection: object to processing based on my legitimate interests

  • Withdraw consent: at any time, for the newsletter or analytics, without affecting earlier processing

  • Post-mortem instructions: under French law, give instructions on what happens to your data after your death

To use any of these rights, email nicky@nickyjsullivan.com. I will reply within one month. I may ask for proof of identity if I cannot otherwise confirm the request is yours.

Complaints. If you are unhappy with how I handle your data, please tell me first so I can put it right. You also have the right to complain to the French data protection authority, the CNIL (www.cnil.fr), or to the authority in your own EU country.

7. Security, children, and changes

Security. I use providers with appropriate security measures, protect my accounts with strong passwords and two-factor authentication, and limit data to what each task needs. No online system is completely secure, and I will notify you and the CNIL of a breach where the law requires it.

Children. This site is aimed at organisations and professionals, not children, and I do not knowingly collect data from anyone under 15.

Changes. I may update this policy when my services or tools change. The date at the top shows the latest version; significant changes will be flagged on the site or, for subscribers, by email.