Legal
Privacy policy
What this website and our services do with personal data — written against what the site actually runs, not a template.
Last updated:
1. Who is responsible
The controller for the processing described here is:
P&S LLC — S&P Partners
30 N Gould St Ste R, Sheridan, WY 82801
United States
Email: info@sp-partners.co
We have not appointed a Data Protection Officer. None of the criteria in Article 37 GDPR apply to us: we are not a public authority, we do not carry out large-scale systematic monitoring, and we do not process special categories of data at scale.
2. What this policy covers
This policy covers sp-partners.co and the enquiry, booking and client-communication processes reached from it.
When we deliver a project, we often act as a processor on our client’s behalf — for example when we can see the analytics or customer records of a website we built. In that case the client is the controller and their own privacy policy governs. The terms of that work are set out in the data processing agreement in the client contract.
3. What we collect, why, and on what legal basis
Rather than list categories in the abstract, here is each thing the site actually does:
| What happens | Data | Legal basis | Kept for |
|---|---|---|---|
| You visit a page | IP address, user agent, requested URL, referrer, timestamp — in server logs | Art. 6(1)(f) — our interest in a site that stays up and is not abused | Up to 30 days in hosting logs |
| Traffic measurement (Plausible) | No cookie and no persistent identifier. A daily-rotating, salted hash of IP + user agent is used to count unique visits, then discarded. | Art. 6(1)(f) — our interest in knowing which pages are read | Aggregated only; the hash is not retained past the day |
| Analytics after you accept (Google Analytics 4) | Cookie identifiers, pages viewed, events, approximate location from truncated IP | Art. 6(1)(a) — your consent. Withdrawable at any time. | 14 months, then deleted by Google |
| You send a form (contact, fit assessment, diagnostic) | Name, email, and whatever you write. Depending on the form: website, market, revenue band, priority. Plus the page you arrived on, the referring site and any campaign tags in the link. | Art. 6(1)(b) — steps taken at your request before a contract | 24 months from last contact, unless you become a client |
| You book a call | Name, email, chosen time, anything you add as a note | Art. 6(1)(b) — steps taken at your request before a contract | 24 months from last contact, unless you become a client |
| You become a client | Contact and billing details of the people we work with, plus project correspondence | Art. 6(1)(b) for the contract; Art. 6(1)(c) for statutory record-keeping | Duration of the engagement, then as long as tax and accounting law requires |
| You set cookie preferences | Your choice and the date you made it, stored in your browser | Art. 6(1)(c) — we are required to record consent | 12 months, in your browser only |
The campaign tags, referrer and landing page attached to a form are how we tell which work brings enquiries. They tell us how you found us — they are not used to track you across other websites.
4. Whether you have to provide it
None of this is required by law or by contract. Providing it is entirely voluntary — but a form or a booking cannot be completed without the fields marked required, because we would have no way to reply.
5. Who else sees it
We do not sell personal data and we do not share it for anyone else’s advertising. The processors below act on our instructions under a data processing agreement:
| Processor | What it does for us | Where |
|---|---|---|
| Netlify | Hosts the website and receives form submissions | United States, global CDN |
| Plausible Analytics | Cookieless traffic measurement | European Union (Germany) |
| Google Ireland Ltd / Google LLC | Google Analytics 4 — only after you consent | EU and United States |
| Vercel | Runs the booking application at book.sp-partners.co | United States |
| Supabase | Database holding booking records | United States |
| Resend | Sends the notification email when a call is booked | United States |
| Stripe | Client invoicing and payment (clients only) | United States and Ireland |
We also disclose data where we are legally required to, or where it is necessary to establish, exercise or defend a legal claim — for example to our accountants or legal advisers.
6. Transfers outside the EU/EEA
Two transfers are worth naming plainly. First, we are established in Wyoming, United States, and most of the processors above are US companies. Second, our team works from Thailand, so data is routinely accessed from there.
Where a transfer is to a country without an EU adequacy decision, it is made on the basis of the European Commission’s Standard Contractual Clauses together with the additional safeguards agreed with each processor. You can request a copy of the relevant clauses by email.
7. Your rights
Where the GDPR applies to you, you have the right to:
- ask what we hold about you and get a copy (Art. 15)
- have inaccurate data corrected (Art. 16)
- have data erased (Art. 17)
- have processing restricted (Art. 18)
- receive your data in a portable format (Art. 20)
- object to processing based on legitimate interests (Art. 21)
- withdraw consent at any time, without affecting what was lawful before you withdrew it (Art. 7(3))
To exercise any of these, email info@sp-partners.co. We will respond within one month. We will not charge you, and we will not ask you to justify the request.
You also have the right to complain to a supervisory authority — in the EU, the authority where you live, where you work, or where you believe the problem occurred. We have no EU establishment, so no single lead authority is responsible; your local one is the right place to go.
8. Automated decisions and profiling
We do not make decisions about you by automated means, and we do not carry out profiling that produces legal effects or similarly significant effects for you (Art. 22 GDPR).
The growth diagnostic on this site scores your answers to show you a result immediately. That is a self-assessment tool: it produces a suggestion you read, not a decision we act on.
9. Security
The site is served over HTTPS only, with a strict transport policy, frame and content-type protections, and a referrer policy that limits what is passed to other sites. Access to enquiry and booking data is limited to the two people who run the company.
No system is perfectly secure. If a breach ever put your rights at risk, we would notify the relevant supervisory authority within 72 hours and tell you directly where the law requires it.
10. Children
Our services are directed at organisations, not at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has sent us data, email us and we will delete it.
11. Changes to this policy
We update this policy when what we do changes. The date at the top is the date of the current version — 2026-09-06. Material changes affecting people we already hold data about are notified by email.
Questions about any of this: info@sp-partners.co