Privacy & Data Protection

Your Privacy Matters
At The Neurospicy Assistant, I understand that trusting someone with your personal information is a big deal.
Whether I'm helping you organise your emails, book appointments, complete forms or take some everyday admin off your plate, I want you to feel confident that your information is being treated with care and respect.
This policy explains what information I collect, why I need it, how I use and protect it, and what rights you have.

1. Who Is Responsible for Your Information?
The Neurospicy Assistant is operated by Jessica Midgley-Brown, trading as The Neurospicy Assistant.
For personal information I collect and use to manage my own business and provide services directly to individuals, I am generally the data controller.
When providing administrative support to another business, I may act as a data processor on that business's behalf. Where required, a separate Data Processing Agreement will explain our respective responsibilities.
Contact email: admin@theneurospicyassistant.com
Website: www.theneurospicyassistant.com


2. What Information Do I Collect?
Depending on the support you request, I may collect:
- Your name and contact details.
- Your preferred communication methods.
- Information submitted through website enquiries and onboarding forms.
- Details of the administrative tasks you need help with.
- Appointment dates, deadlines and scheduling information.
- Documents, emails and correspondence you ask me to work with.
- Records of agreed work, communications and authorisations.
- Information needed for invoicing, payments and accounting.

Some tasks may involve sensitive information, including information about health, disability or personal circumstances.
I will only request information that is reasonably necessary for the agreed service and will avoid collecting unnecessary sensitive details.

3. How Do I Use Your Information?
I use personal information to:
- Respond to enquiries.
- Understand your support needs.
- Arrange and deliver agreed administrative services.
- Communicate with you and relevant organisations where authorised.
- Manage appointments, deadlines and agreed tasks.
- Maintain appropriate service and authorisation records.
- Prepare invoices and maintain financial records.
- Meet applicable legal obligations.
- Protect the security and proper operation of my business.

I will not sell your personal information.
I do not use your personal information for unrelated marketing without an appropriate lawful basis and compliance with applicable marketing rules.

4. My Legal Reasons for Using Your Information
Under UK GDPR, I must have a lawful basis for processing personal information.
Depending on the circumstances, these may include:
- Contract: Where processing is necessary to provide services you've requested or take steps before entering into an agreement.
- Legal obligation: Where I must retain or use information to comply with applicable laws, including accounting and tax requirements.
- Legitimate interests: Where processing is necessary for appropriate business administration, security or managing enquiries, provided those interests are not overridden by your rights and freedoms.
- Consent: Where consent is the appropriate lawful basis, such as for certain optional activities.

Where special-category personal information is involved, I will identify an additional applicable condition under UK GDPR before processing it.
Not every lawful basis applies to every activity. The basis used will depend on the information and the purpose for which it is processed.

5. Where Is Your Information Stored?
I use selected digital services to run The Neurospicy Assistant.

Google Workspace and Google Drive
These are my main systems for managing business emails, client documents, records, correspondence and agreed administrative work.

Wix
Wix is used to operate my website and collect information submitted through website enquiries and onboarding forms.
Information submitted through Wix may also be processed and retained within Wix's systems, subject to its functionality and my account settings.

Accounting and invoicing software
I use, or may introduce, accounting software to manage invoices, payment information and financial records.

Communication services
Relevant communications may be retained within the communication services used to contact you.

I take reasonable technical and organisational steps to protect information, including restricting access to authorised accounts, using appropriate account security and reviewing access when it is no longer needed.

6. Who Might I Share Information With?
I only share personal information where there is a valid reason to do so.
This may include:
- Organisations you have authorised me to contact.
- Service providers supporting my website, email, document storage and accounting.
- Professional advisers where reasonably necessary.
- Public authorities where disclosure is legally required.

Where appropriate, I use service providers subject to relevant data protection arrangements.
Some service providers may process information outside the UK. Where restricted international transfers occur, I will ensure that an applicable transfer mechanism or safeguard is in place.

7. Accessing Your Emails and Accounts
If you ask me to manage emails or access an online account, we will agree the required permissions before work begins.
Where available, I prefer delegated access or another suitable secure access method.
You should never send passwords, PINs or authentication codes through my onboarding forms.
Access will be limited to the agreed work and reviewed or removed when it is no longer required.

8. Artificial Intelligence
The Neurospicy Assistant does not use artificial intelligence to carry out client administrative work.
I do not intentionally enter your client emails, documents or personal information into generative AI tools to complete your tasks.
If this practice changes, I will review the relevant data protection implications and update the information provided to clients.

9. How Long Do I Keep Information?
I only keep personal information for as long as reasonably necessary for the purpose for which it was collected.
The appropriate retention period depends on the type of information, the service provided, applicable legal requirements and whether records are needed to establish or defend legal claims.

Client documents and working records will be reviewed when services end and securely deleted or returned where appropriate.
Financial and accounting records may need to be retained for longer to meet legal obligations.
 

10. Your Data Protection Rights
Depending on the circumstances, you may have the right to:
- Access personal information held about you.
- Request correction of inaccurate information.
- Request deletion of information.
- Request restriction of certain processing.
- Object to certain uses of your information.
- Request data portability where applicable.
- Withdraw consent where processing relies on consent.

These rights are not absolute, and some information may need to be retained for legal reasons.

To make a request, contact:
admin@theneurospicyassistant.com

I will respond in accordance with applicable data protection law.

11. Website Forms and Cookies
My website is built using Wix.
When you complete a website form, the information you submit is processed through Wix and used to respond to your enquiry or manage your onboarding.
The website may also use cookies or similar technologies for essential functionality and, where enabled, analytics or other purposes.

Information about cookies and any available choices will be provided through the website's cookie information and consent controls, as required.

12. Keeping Your Information Safe
I take data security seriously and aim to use appropriate safeguards to protect information from unauthorised access, accidental loss, alteration or disclosure.

These include suitable account security, controlled access to client information and secure handling of records.

No digital system can guarantee absolute security, but I will take reasonable steps to reduce risks and respond appropriately to any suspected data security incident.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator. Website: www.ico.org.uk.