Privacy Policy - Nine Yards PA

Last updated: 3rd September 2026

Quick summary:

We (Nine Yards PA Services) collect only what we need to provide you with great service.

Your data is protected, never sold, and we only keep it for as long as necessary or legally required.

Introduction

Nine Yards PA Services is committed to protecting your personal information and using it responsibly. This policy explains what data we collect, how we use it, and your rights under UK data protection law (UK GDPR and Data Protection Act 2018).

Who are we?

Julie Berry, trading as Nine Yards PA Services, is the data controller and is responsible for your personal data (referred to as “we”, “us” or “our” in this privacy notice). We provide consultancy, administration support, and digital resources under the trading name of Nine Yards PA Services.

Our full contact details are:

Nine Yards PA Services, 19B The Circle, Dilton Marsh, Westbury, Wiltshire BA13 4BZ.
Email address: help@nineyardspa.co.uk

We are registered with the ICO data regulator under reference ZA522835.

You can contact them directly by visiting www.ico.org.uk

It is very important that the information we hold about you is accurate and up to date.

Please let us know if at any time your personal information changes by emailing us at help@nineyardspa.co.uk

Data we collect

We may collect and process the following information when you interact with us:

Personal details: name, email, company, job title, contact details, and social media profile handles (when relevant).
Communications: Emails, enquiries, plus newsletter sign-ups and interactions.
Purchase and project information: Order details, invoices, service history.
Suppliers and partners: Correspondence, contracts, payment details (if applicable).
Payment and billing details (processed securely by our payment providers – we do not store card details).
Digital interactions (emails, website enquiries, downloads, feedback)

How we use your data (and why)

We only use your data where there is a lawful basis under UK GDPR, such as:

To perform a contract - providing consultancy services or resources you’ve requested.
To meet legal obligations - e.g. keeping financial records for HMRC and, where relevant, carrying out identity verification and Anti‑Money Laundering (AML) checks for bookkeeping and related accountancy services.
Legitimate interests - managing and improving our services without overriding your privacy.
Consent - for marketing communications, which you may opt out of anytime.

Use of software and digital tools

We use a range of trusted software and digital service providers to support the delivery and administration of our services. Depending on the service provided, these may include tools for business email and document management, time recording, client and compliance management, electronic signatures, payment processing, bookkeeping, identity verification, and other business administration.
Where these tools process personal data on our behalf, we ensure that appropriate data protection arrangements are in place, including contractual safeguards and appropriate international transfer mechanisms where required.
We minimise the personal data entered into software tools and, where practical, use anonymised, pseudonymised or generalised information instead of identifiable personal data.
AI-assisted tools: We may use AI-assisted software for internal tasks such as research, idea development and drafting. We do not input identifiable client data into AI tools unless this has been specifically agreed with the client and the relevant service agreement provides for such use. Any scenarios used for general development or research are generalised or anonymised.
All AI-assisted outputs are reviewed using professional judgement and human oversight. We do not use automated decision-making that produces legal or similarly significant effects on individuals.
We respect intellectual property rights and apply appropriate data protection and confidentiality safeguards when using software and AI-assisted tools.

Depending on the contracted services agreed, we may use the following software providers:

CAKE.com (Clockify) – time recording and reporting.
Firmcheck – client management, compliance, client due diligence and Anti-Money Laundering (AML) administration.
Google Workspace – business email, document storage, file sharing and password management.
SignFree – electronic signature, document delivery and signed document storage.

These providers may process personal data on our behalf where necessary to provide their services. We assess the data protection and security arrangements of our service providers and maintain appropriate contractual arrangements where required.

Cookies and tracking

Our website uses strictly necessary cookies for functionality, and analytical cookies provided by our hosting platform (Wix) to help us understand how visitors use the site.
Analytical cookies are only set if you give your consent via our cookie banner.
For more information, please see our Cookie Policy.
You can manage or withdraw your consent for analytical cookies at any time via the Cookie Settings link on our site or through your browser settings.

Data storage and security

Data is stored securely using trusted UK and international providers.
Access is restricted to only those who need it.
We regularly review our systems for security and data protection compliance.
We only keep data for as long as necessary (see “How Long We Keep Your Data”).

International transfers

Some of our service providers may process personal data outside the UK. Where this occurs, we ensure that the transfer is permitted under applicable UK data protection law.

Where personal data is transferred to a country that is not recognised as providing an adequate level of protection under UK data protection law, we ensure that an appropriate transfer mechanism and any necessary supplementary measures are in place, such as the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses (SCCs), or another lawful transfer mechanism recognised under the UK GDPR.

Where a service provider uses its own subprocessors, we require appropriate data protection safeguards to be in place in accordance with applicable UK data protection law.

How long we keep your data

We retain data only as long as needed for the purpose collected:

Client and project data – up to 7 years, where necessary to meet applicable accounting, tax, legal or regulatory record-keeping requirements.
Mailing list subscriptions – until you unsubscribe or for 2 years from last interaction if there's been no engagement.
Enquiries – for up to 12 months, unless you become a client.

After this, data is securely deleted.

Who we share data with

We do not sell your personal data or share it with third parties for their own marketing purposes. We may share personal data where necessary with:

Software and cloud service providers that support the delivery and administration of our services, such as Google Workspace, CAKE.com (Clockify), Firmcheck and SignFree.
Payment and invoicing providers where necessary to process payments and maintain financial records.
Identity verification, Anti-Money Laundering and compliance providers where required for relevant services.
Professional advisers, insurers or other service providers where reasonably necessary to operate and protect our business.
Legal or regulatory authorities where disclosure is required by law.

Your rights

Under UK GDPR, you have the right to:

Access the data we hold about you.
Correct inaccurate data.
Request deletion of your data.
Object to processing of your data.
Request restriction of processing.
Request transfer of your data
Withdraw consent (where processing is based on consent).

To exercise any of these rights, contact us at: help@nineyardspa.co.uk

We will respond to all legitimate requests within 30 days.

Complaints

If you have any concerns about our use of your personal data, you can make a complaint to us at help@nineyardspa.co.uk

We take every concern seriously and we’ll do our best to put things right.
We’ll confirm we’ve received your complaint within 30 days.
The acknowledgement will include the name of the person handling your complaint and what you can expect to happen next.
We’ll look into what happened without unnecessary delay. The depth of our investigation will depend on the nature and complexity of your complaint.
We’ll keep you informed of progress along the way and let you know if we need more time.
We aim to provide a full response within three months of receiving your complaint. More complex cases may take longer, but we’ll always keep you updated.
Our response will be written in plain English and will explain: what we found, what action we’ve taken (if any), and your right to take the matter further if you’re not happy with our response.
If you feel we haven’t resolved the complaint to your satisfaction, you have the right to take it to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues - www.ico.org.uk/make-a-complaint
Under the Data (Use and Access) Act 2025, we ask that you give us the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance. This is now a formal part of the complaints process and the ICO will typically expect to see that you raised your complaint with us first.

Updates to this policy

We review and update this policy at least annually, or sooner if our practices or legal requirements change. The most recent version will always be published on our website.