Privacy and Data Protection Notice

Last updated: 30 September 2026

Redesigning Business is a trading name of Lyndsey Wray, sole trader (“I”, “me” or “Redesigning Business”).

I am the data controller for the personal information described in this notice and am registered with the Information Commissioner’s Office (ICO), registration reference ZA348392.

This notice explains what personal information I collect, why I use it, where it may come from, who it may be shared with, how long I keep it and your data protection rights.

1. How to contact me

If you have a question about how I use your personal information, want to exercise a data protection right or make a data protection complaint, please contact:

Lyndsey Wray
Redesigning Business
Email: lyndsey@redesigning-business.com
Telephone: 07813 606033

2. What personal information I collect

The information I collect depends on how you interact with me and may include:

• your name, job title, organisation and professional contact details;
• telephone numbers and email addresses;
• information contained in enquiries, emails, messages, WhatsApp messages and other correspondence;
• information contained in proposals, contracts, invoices and other business records;
• information you provide during consultancy work, including interview or meeting notes and information about people within or connected with your organisation;
• documents and other information supplied by clients for consultancy purposes;
• professional information available through LinkedIn, company websites, public registers and other publicly available sources;
• networking information, such as information exchanged at professional events or through digital business cards;
• information relating to suppliers and other professional contacts; and
• technical information generated when you use my website, such as IP address, browser and device information, pages visited, referring URLs and website usage information.

I do not routinely collect special-category personal information, such as information about health, ethnicity, religion, political opinions or trade-union membership, or information about criminal convictions.

However, material supplied to me by a client may occasionally contain this type of information. Where that happens, I will only process it where there is an appropriate lawful basis and, where required, an additional legal condition for processing it.

3. Where I get personal information from

Most personal information comes directly from you or from an organisation for which you work.

I may also receive or obtain information from:

• clients and prospective clients;
• colleagues or other people within a client’s organisation;
• people who introduce or refer us to one another;
• LinkedIn and other professional networks;
• conference and event organisers or attendees;
• company websites and other publicly available business sources;
• suppliers and professional advisers; and
• historic correspondence or business records where there is a legitimate reason for retaining and using them.

Where a client provides information about its employees, customers, suppliers or other individuals as part of consultancy work, the client may be the data controller for that information and I may process it on the client’s behalf. Where necessary, our respective responsibilities will be addressed in the relevant contractual arrangements.

4. Why I use personal information

I only use personal information where I have a lawful basis for doing so.

My legitimate interests include operating and developing my consultancy, responding to people who contact me, delivering and improving my services, maintaining appropriate professional records and relationships, protecting my business and establishing, exercising or defending legal rights.

Where I rely on legitimate interests, I consider whether my interests are proportionate and whether your rights and interests override them.

Where I rely on consent, you can withdraw that consent at any time.

5. Client information and consultancy work

Consultancy assignments may require me to review information about an organisation, its people, customers, suppliers, operations or other stakeholders.

I aim to use only the personal information reasonably necessary for the work.

Client information is primarily stored using secure cloud-based business systems, including Microsoft OneDrive/Microsoft 365 and, where appropriate for collaboration or access, Google services.

Information may also be contained in business email, telephone or messaging systems where these are used for client communications.

I do not use personal information to make solely automated decisions about individuals that have legal or similarly significant effects.

6. Use of AI-assisted tools

I use artificial intelligence and other digital tools as part of my business and consultancy work. These may support activities such as research, analysis, organising information, drafting and reviewing material.

AI tools support rather than replace my professional judgement. I remain responsible for the consultancy work and conclusions I provide.

I minimise the personal and confidential information provided to AI systems and do not routinely provide client information to general-purpose consumer AI services.

In some circumstances, client documents or information may be processed using business AI services with appropriate privacy, security and contractual controls. I currently use ChatGPT Business for this purpose where appropriate. OpenAI states that information submitted within ChatGPT Business is not used to train its models by default and that business data is encrypted in transit and at rest. (OpenAI Help Center)

Where personal information is processed using an AI-assisted service, its use must have an appropriate data protection basis and be relevant to the work being undertaken.

I do not use AI to make solely automated decisions about individuals that have legal or similarly significant effects.

7. Who I share personal information with

Where necessary, personal information may be shared with organisations that support my business, including:

• website hosting and technology providers;
• email, cloud-storage and productivity providers;
• accounting or bookkeeping software providers;
• banks and financial service providers;
• professional advisers, where required;
• IT and security providers;
• communications and collaboration platforms;
• AI and digital service providers where relevant to the particular work; and
• contractors or specialist suppliers where they are involved in delivering work and have an appropriate need for the information.

I may also disclose information where required by law or where necessary to establish, exercise or defend legal rights.

I do not sell personal information.

8. International transfers

Some technology and cloud-service providers may process or make personal information accessible outside the UK.

Where a restricted international transfer takes place, I use providers and arrangements that provide an appropriate mechanism under UK data protection law, such as UK adequacy regulations or appropriate contractual safeguards.

You can contact me if you would like more information about safeguards relating to your personal information.

9. How long I keep information

I keep personal information only for as long as it is reasonably needed for the purpose for which it was collected, or where I need to retain it to meet legal, tax, accounting, contractual or professional requirements or to establish, exercise or defend legal rights.

Retention periods therefore depend on the type of information involved.

For example:

• financial and tax records are retained for the period required by applicable tax and accounting rules;
• active client information is retained while work is being undertaken and for an appropriate period afterwards;
• unsuccessful enquiries and prospect information are reviewed periodically and are not retained indefinitely without a continuing reason;
• marketing information is retained until you unsubscribe, object or it is no longer appropriate to retain it;
• information held within third-party platforms may also be subject to the relevant platform’s retention arrangements; and
• historic records relating to previous business activities are retained only where there is an appropriate continuing legal, financial or legitimate business reason.

I periodically review retained information and securely delete or anonymise personal information that is no longer required.

10. Marketing and professional communications

I may contact business and professional contacts about Redesigning Business where I have a lawful basis to do so.

Where consent is legally required for a particular form of electronic marketing, I will obtain it.

You can ask me to stop sending direct marketing communications at any time.

You have the right to object at any time to the use of your personal information for direct marketing.

Subscriptions to the Redesigning Business Brief are currently managed through Substack. Subscribers can unsubscribe using the facility provided with those communications.

11. Website, statistics and security

The Redesigning Business website uses technologies that support its operation, security, spam prevention and the collection of basic information about how the website is used.

I use Jetpack, provided by Automattic, for website statistics and security. Jetpack Stats processes technical information including IP address, user agent, pages visited, referring URLs, timestamps, browser language and country code. The statistics available to me are aggregated and do not identify individual website visitors. Automattic states that logs containing visitor IP addresses and WordPress.com usernames, where available, are retained for 28 days for the purpose of providing Jetpack Stats. (Jetpack)

Jetpack Protect also processes information relating to login attempts in order to identify and block malicious activity. (Jetpack)

I use Akismet, also provided by Automattic, for spam prevention.

The website does not currently use Google Analytics.

Some website technologies may use cookies or access information stored on your device. Where consent is required by law, those technologies will not be used for that purpose without consent. Where an exemption applies, I will provide the information and choices required by law.

12. Keeping information secure

I take proportionate technical and organisational measures to protect personal information against loss, misuse, unauthorised access, alteration or disclosure.

These include measures such as password protection, multi-factor authentication where available, device security, access controls, secure cloud storage and keeping software and systems up to date.

No method of storing or transmitting information can be guaranteed to be completely secure.

13. Your data protection rights

Depending on the circumstances and the lawful basis on which your information is processed, you may have rights including:

• access – to ask for copies of your personal information;
• rectification – to ask for inaccurate information to be corrected;
• erasure – to ask for your personal information to be deleted in certain circumstances;
• restriction – to ask me to restrict how your information is used in certain circumstances;
• objection – to object to certain uses of your personal information;
• data portability – to ask for information you provided to be transferred to you or another organisation in certain circumstances; and
• withdrawal of consent – where consent is the lawful basis, to withdraw it at any time.

You do not normally have to pay a fee to exercise these rights.

I will respond to valid data protection rights requests without undue delay and normally within one month.

To exercise a right, contact me using the details at the beginning of this notice.

14. How to make a data protection complaint

If you have concerns about how I have used your personal information, please contact me first:

Lyndsey Wray
Email: lyndsey@redesigning-business.com
Telephone: 07813 606033

I will acknowledge a data protection complaint within 30 days, investigate it appropriately and without undue delay, keep you informed where necessary and tell you the outcome.

If you remain dissatisfied, you can also complain to the Information Commissioner’s Office (ICO).

Make a complaint to the ICO

15. Previous business activities

Before focusing my consultancy under Redesigning Business, I traded under other business names, including UK Bid Writer.

I may retain personal information relating to those historic business activities where there is a continuing legal, financial, contractual or legitimate business reason for doing so.

Historic information is subject to the same data protection principles described in this notice and will be reviewed and deleted or anonymised when there is no longer an appropriate reason to retain it.

16. Changes to this notice

I may update this notice when my business practices, systems or legal obligations change.

The latest version will be available on the Redesigning Business website, with the date of the most recent update shown at the top.