Business Therapy Blueprint
Privacy notice
Last updated 7 October 2026.
This notice explains how Ham Agency Ltd uses personal data collected through businesstherapyblueprint.com, and what you can do about it. Business Therapy Blueprint is part of HAM Agency. HAM's own site has its own notice at ham.agency/privacy, and the two follow the same rules.
Who we are
Ham Agency Ltd ("HAM", "we", "us") is the controller of the personal data described here.
- Registered in England and Wales, company number 11265213.
- Registered office: 510 The Chocolate Factory, 5 Clarendon Road, London N22 6XJ.
- Contact for anything in this notice: theteam@ham.agency, or post to the registered office marked for the attention of the director.
We are a small business and are not required to appoint a data protection officer. Steph Hamill, our director, is responsible for how we handle personal data.
What we collect
We collect only what we need for the thing you asked for.
| Where | What we collect |
|---|---|
| Enquiry form | Your name, email address and message, and your company if you choose to give it. |
| The form itself | Your IP address, sent to HubSpot with the form so it can filter out spam. |
| Emailing us | Your correspondence with us. |
| Preparing for a session, for clients who have agreed to work with us | Your voice notes and written answers about the business, its figures, its team structure and the systems it uses. We ask for roles, not names, and do not need personal information about anyone else. |
| Hosting | Our hosting provider keeps technical logs, including IP addresses, for a short period to keep the site secure and working. |
Please do not send us health information or other sensitive personal data through the site. Our form does not ask for it.
Why we use it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Reply to your enquiry, hold a call and prepare a written scope | Taking steps at your request before a contract, and legitimate interests |
| Use what you send us to prepare and run the two days your business has agreed to | Legitimate interests: running the work your business engaged us for. Contract, where you engage us yourself, for example as a sole trader |
| Keep business, tax and accounting records | Legal obligation |
| Keep the site secure | Legitimate interests |
| Establish or defend legal claims | Legitimate interests |
We do not add you to a mailing list when you send an enquiry.
Nothing on this site is scored or decided automatically. A person reads what you send.
Cookies and analytics
This site sets no cookies and runs no analytics.
If we ever add a tool that stores information on your device, or that counts visits, we will update this notice first and ask for your consent where the law requires it.
Who we share it with
We never sell personal data. We share it only with the people and providers below, and only for the purposes in this notice.
Jane de Vos leads the operations side of Business Therapy Blueprint. She sees your enquiry, and what you send us to prepare for a session, so that she can do that work.
| Provider | What they do for us | Where the data may be processed |
|---|---|---|
| Vercel Inc. | Hosts the site | USA and Vercel's global network |
| HubSpot, Inc. | Our CRM: stores enquiries sent through the form | EU or USA |
| Google (Google Workspace) | Our email, calendar and documents | UK, EU and USA |
We may also share personal data with our professional advisers (such as accountants and lawyers) under a duty of confidence, and with authorities where the law requires it. If HAM is ever sold or restructured, personal data may pass to the new owner, who must use it in line with this notice.
Transfers outside the UK
Some of our providers process data in the USA or elsewhere outside the UK. Where they do, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework, where the provider is certified under it), or on the ICO's International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses. Ask us if you would like details of the safeguard for a particular provider.
How long we keep it
| Data | How long |
|---|---|
| Enquiries and calls that do not become work | 24 months from your last contact with us, then deleted |
| Client records, including what you send us to prepare for a session | For the engagement and 6 years after it ends, for tax and legal reasons |
Your rights
You have the right to:
- ask for a copy of the personal data we hold about you
- ask us to correct it if it is wrong or incomplete
- ask us to delete it
- ask us to restrict how we use it
- object to how we use it, and in particular object to direct marketing at any time, which we will always respect
- ask for data you gave us in a portable format
- withdraw your consent at any time, where we rely on consent.
To use any of these rights, email theteam@ham.agency. There is normally no charge. We will reply within one month. For complex requests we may extend that by up to two further months and will tell you why. We may need to confirm your identity first.
Complaints
If you are unhappy with how we have handled your personal data, please tell us first at theteam@ham.agency. We will acknowledge your complaint within 30 days and reply in full as quickly as we can.
You also have the right to complain to the Information Commissioner's Office, the UK regulator:
- Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
- Telephone 0303 123 1113
- Online at ico.org.uk/make-a-complaint
Keeping it secure
Access to personal data is limited to the people who need it for the purposes above. Our systems are protected by passwords and two-factor sign-in, and our providers are bound by written security and confidentiality terms.
Children
This site is for businesses and the people who run them. It is not aimed at anyone under 18, and we do not knowingly collect their personal data.
Changes to this notice
We will update this notice when how we use personal data changes. The date at the top shows when it last changed.