Privacy Policy

Last updated: April 2026 — poshaipa.com

1. Introduction

This Privacy Policy explains how PoshAIPA ("we", "us", "our"), operated by Clive Marshall (sole trader), collects, uses, stores and protects your personal data when you visit poshaipa.com ("the Site").

We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations 2003 (PECR).

2. Data Controller

The data controller responsible for your personal data is:

Name: Clive Marshall
Business type: Sole Trader
Email: cm@clivemarshall.com
Website: poshaipa.com

3. What Data We Collect

3.1 Personal Data You Provide

We may collect personal data that you voluntarily provide, including:

Name and email address (e.g., when registering an account, subscribing to a newsletter, or contacting us);
Phone number (if provided through a contact form or order);
Billing and payment information (processed securely via third-party payment providers);
Any other information you choose to submit through forms or correspondence.

3.2 Data Collected Automatically

When you visit the Site, we may automatically collect:

Usage data: Pages visited, time spent on pages, referral source, click patterns;
Device data: Browser type and version, operating system, screen resolution;
Network data: IP address (anonymised where possible), approximate geographic location;
Cookie data: As described in our Cookie Policy.

3.3 Data from Third Parties

We may receive data from third-party services we integrate with, such as payment processors (e.g., PayPal) confirming transaction status, or analytics providers supplying aggregated usage statistics.

4. Legal Basis for Processing

Under UK GDPR Article 6, we process your personal data on the following legal bases:

Purpose	Legal Basis (Article 6)
Providing our services and fulfilling orders	6(1)(b) — Performance of a contract
Responding to your enquiries	6(1)(b) — Performance of a contract / pre-contractual steps
Sending marketing communications (with consent)	6(1)(a) — Consent
Analytics and site improvement	6(1)(f) — Legitimate interests
Fraud prevention and security	6(1)(f) — Legitimate interests
Complying with legal obligations	6(1)(c) — Legal obligation

Where we rely on legitimate interests, we have conducted a balancing test to ensure your rights and freedoms are not overridden.

5. How We Use Your Data

We use the data we collect to:

Provide, operate and maintain the Site and our services;
Process transactions and send related information (confirmations, receipts);
Respond to your comments, questions and requests;
Send you marketing and promotional communications (only with your consent; you may opt out at any time);
Monitor and analyse usage trends to improve the Site;
Detect, prevent and address technical issues and security threats;
Comply with legal obligations and enforce our Terms of Service.

6. Data Sharing

We do not sell your personal data. We may share your data with the following categories of recipients:

Payment processors: PayPal, Stripe or other providers to process transactions securely. They act as independent data controllers under their own privacy policies;
Analytics providers: Google Analytics (with IP anonymisation enabled) to understand how visitors use the Site;
Hosting providers: Our server infrastructure providers who store data on our behalf under data processing agreements;
Affiliate networks: Where applicable, affiliate tracking may involve cookies set by networks such as AWIN. These cookies track referral clicks, not personal identity;
Legal and regulatory bodies: Where required by law, regulation, legal process or governmental request;
Professional advisers: Accountants, lawyers or auditors where necessary for our business operations.

All third-party service providers are required to process your data securely and in accordance with applicable data protection law.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

Data Type	Retention Period
Account data	Duration of account plus 2 years after deletion
Transaction / purchase records	6 years (HMRC requirements)
Contact form submissions	2 years from last communication
Marketing consent records	Until consent is withdrawn, plus 1 year for audit
Analytics data	26 months (Google Analytics default)
Server logs	90 days

After the retention period expires, data is securely deleted or anonymised.

8. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

Right of access (Article 15) — Request a copy of the personal data we hold about you;
Right to rectification (Article 16) — Request correction of inaccurate or incomplete data;
Right to erasure (Article 17) — Request deletion of your personal data ("right to be forgotten");
Right to restrict processing (Article 18) — Request that we limit how we use your data;
Right to data portability (Article 20) — Request your data in a structured, commonly used, machine-readable format;
Right to object (Article 21) — Object to processing based on legitimate interests or direct marketing;
Right to withdraw consent — Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing;
Rights related to automated decision-making (Article 22) — We do not currently make automated decisions that produce legal effects concerning you.

To exercise any of these rights, please contact us at cm@clivemarshall.com. We will respond within one month of receiving your request, as required by law.

9. International Data Transfers

Your data is primarily processed and stored on servers located in the European Economic Area (EEA) or the United Kingdom. Where data is transferred outside the UK/EEA (for example, to service providers in the United States), we ensure appropriate safeguards are in place, such as:

Standard Contractual Clauses (SCCs) approved by the UK Information Commissioner;
The recipient being in a country with an adequacy decision from the UK government;
Other legally recognised transfer mechanisms.

10. Cookies

We use cookies and similar technologies on the Site. For full details on the cookies we use, their purpose and how to manage them, please see our Cookie Policy.

11. Children's Privacy

The Site is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. If we become aware that we have collected such data, we will take steps to delete it promptly. If you believe a child has provided us with personal data, please contact us at cm@clivemarshall.com.

12. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. These measures include:

SSL/TLS encryption for data in transit;
Secure server infrastructure with firewall protection;
Access controls limiting data access to authorised personnel;
Regular security reviews and updates.

However, no method of transmission over the internet is 100% secure. While we strive to protect your data, we cannot guarantee absolute security.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Any changes will be posted on this page with an updated "Last updated" date. We encourage you to review this page periodically. Continued use of the Site after changes constitutes acceptance of the revised policy.

14. Complaints

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the UK supervisory authority:

Information Commissioner's Office (ICO)
Website: ico.org.uk
Helpline: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

We would appreciate the opportunity to resolve your concern before you approach the ICO, so please contact us first at cm@clivemarshall.com.

15. Contact Us

For any questions or requests regarding this Privacy Policy or your personal data:

Email: cm@clivemarshall.com
Website: poshaipa.com
Operator: Clive Marshall (Sole Trader)