This privacy notice explains how I collect, use, store and share personal information, and the rights available to you.

Last updated: September 2026

1. Who I am

Julia Clark, trading as Julia Clark Virtual Assistant, is the controller responsible for the personal information described in this privacy notice. I am registered with the Information Commissioner’s Office (ICO) under registration number ZB199004.

This notice explains what personal information I collect, where it comes from, how and why I use it, who I may share it with, how long I keep it and the rights available to you.

2. When this notice applies

This notice applies when I use personal information for my own business purposes, including dealing with enquiries, managing client and supplier relationships, administering projects, issuing invoices, keeping accounting records and operating my website.

As a virtual assistant, I also handle personal information on behalf of clients. In those circumstances, the client is normally the controller and I act as their processor. I use that information only on the client’s instructions and in accordance with our agreement. The client’s own privacy notice explains how and why that information is used and how individuals can exercise their rights.

3. Personal information I collect

Depending on how you interact with me, I may collect:

• identity and contact information, such as your name, business name, job title, postal address, email address and telephone number;
• enquiry and correspondence information, including messages sent through my website, email or social-media accounts;
• client, supplier and project information, including contracts, meeting details, instructions, working documents, deliverables and records of services provided;
• financial and transaction information needed for invoicing, accounting and banking, such as billing addresses, VAT details, invoice records, payment references and relevant bank-account information;
• professional information obtained through referrals, networking, LinkedIn, other social-media platforms or publicly available business sources;
• personal information contained in content or files that clients ask me to work with; and
• technical and website-usage information, such as IP address, device and browser details, approximate location, pages visited, referring pages, dates, times and cookie or similar identifiers.

I do not intentionally collect special category information, criminal-conviction information or information about children for my own business purposes. Please do not send this type of information unless it is necessary and we have agreed in advance how it will be handled.

4. Where the information comes from

I may obtain personal information:

• directly from you, including through my website contact form, email, telephone, video calls, calendar invitations and social-media messages;
• from a client when they give me access to information needed to provide agreed services;
• from another person who refers or introduces you to me; and
• from publicly available professional sources, such as business websites, LinkedIn or other social-media profiles.

5. How and why I use personal information

The lawful basis depends on the purpose and the circumstances. Where a client is a company rather than an individual, I may rely on legitimate interests to manage the relationship with its representatives even though the service contract is with the company.

Enquiries and prospective clients

I use personal information to respond to enquiries, prepare proposals and discuss possible work. I do this to take steps requested before entering into a contract and/or because I have a legitimate interest in responding to business enquiries.

Providing my services

I use personal information to provide agreed services, communicate about projects, arrange meetings, share files and manage client relationships.

Where you are the person entering into the contract, my lawful basis is the performance of that contract. Where the contract is with a company or other organisation, I rely on my legitimate interests in delivering services and administering the business relationship.

Business contacts

I maintain business contact records to manage current and possible future professional relationships. I rely on my legitimate interests in managing professional relationships and developing my business.

I do not currently send marketing newsletters or campaigns.

Invoicing, accounting and payments

I use financial and transaction information to issue invoices, receive and reconcile payments, maintain accounting records and meet tax or regulatory requirements.

Depending on the circumstances, I rely on the performance of a contract, compliance with a legal obligation and my legitimate interests in managing my finances and recovering money owed to me.

Security, record-keeping and legal claims

I use personal information where necessary to protect my accounts and devices, prevent misuse, maintain appropriate records, resolve disputes and establish, exercise or defend legal claims.

I rely on my legitimate interests in protecting my business and legal rights, as well as compliance with a legal obligation where applicable.

Website analytics

I use website analytics to understand how visitors use my website and to help improve its content, structure and performance.

Where the statistical-purpose exception under the cookie rules applies, I rely on my legitimate interests in understanding and improving my website. Where consent is legally required for a particular analytics technology, I rely on consent.

Further information about the technologies currently used and the choices available to visitors is provided in section 13.

6. Use of AI tools

I sometimes use ChatGPT, provided by OpenAI, and Claude, provided by Anthropic, to support tasks such as drafting, reviewing or refining content. Names or other identifying details may occasionally appear in draft content submitted to these services.

I limit the information shared to what is reasonably necessary, avoid intentionally submitting special category or criminal-conviction information, and remove unnecessary identifying details where possible. When the information belongs to a client, I only use an AI service where this is consistent with the client’s instructions and our agreement.

The lawful basis is the same as for the underlying task, normally contract or legitimate interests. OpenAI and Anthropic may process information outside the UK. Further information is available in their privacy notices and account privacy settings.

I do not use AI tools to make decisions about people that are based solely on automated processing and have legal or similarly significant effects.

7. Who I share personal information with

I am the only person with routine access to my business records. I may share limited personal information with service providers where this is necessary to run my business or provide services. These include:

IONOS

IONOS hosts my website, operates the website contact form and provides website-platform analytics.

Microsoft

I use Microsoft services for business email, calendars, cloud storage, file sharing and task management.

Google

I use Google Meet for video calls, Google Drive for cloud storage and file sharing, and Google Analytics to understand how visitors use my website.

OpenAI and Anthropic

I use ChatGPT, provided by OpenAI, and Claude, provided by Anthropic, to assist with drafting, reviewing and refining content, as described in section 6.

LinkedIn and Meta

I use LinkedIn and Meta platforms to receive and respond to social-media messages and to use their native publishing and scheduling functions.

Banking providers

I use a UK business banking provider to receive payments and maintain transaction records.

Professional advisers, insurers and other service providers

I may share personal information where necessary to obtain professional support, protect my business or deal with legal, insurance or contractual matters.

Public authorities and legal bodies

I may share personal information with HMRC, the ICO, courts, law-enforcement bodies and other authorities where necessary to meet a legal obligation, respond to a lawful request or establish, exercise or defend my legal rights.

I do not sell personal information. Service providers only receive the information reasonably necessary for the relevant purpose. Depending on the service and activity, they may act as my processor or as a separate controller and handle the information under applicable contracts, privacy terms and legal safeguards.

8. International transfers

Some of the service providers listed above operate internationally and may process personal information outside the UK, including in the United States. Where UK data-protection law treats this as a restricted transfer, I rely on an applicable UK adequacy regulation or appropriate safeguards used by the provider, such as the UK International Data Transfer Agreement or the UK Addendum to approved standard contractual clauses. You can contact me if you would like more information about the safeguards relevant to your information.

9. How I protect personal information

I use proportionate technical and organisational measures designed to protect personal information from loss, misuse, alteration or unauthorised access. These include password or PIN-protected devices, unique passwords, multi-factor authentication, antivirus protection and automatic software updates. Access is limited to me and to service providers or client systems where needed for the relevant task.

No method of electronic storage or transmission is completely secure. If a personal-data breach occurs, I will assess it and notify affected controllers, individuals and/or the ICO where required by law.

10. How long I keep personal information

I keep personal information only for as long as it is reasonably needed for the purpose for which it was collected, or to meet legal, accounting or contractual requirements. I review my records at least once a year and use the following criteria.

Enquiries and professional contacts

I review enquiries and professional contact records at least annually. I remove information when there is no longer a realistic business reason to keep it, taking account of the nature and recency of our contact, any interest expressed and the reasonable likelihood of a future professional relationship.

Client correspondence, contracts and project records

I keep these records while services are being provided and afterwards for as long as reasonably needed to answer follow-up questions, maintain the relationship, meet contractual obligations, resolve disputes or establish, exercise or defend legal claims. I review these records at least annually.

Invoices, accounts and tax records

I keep invoices, accounts and tax records for at least five years after the 31 January tax-return submission deadline for the relevant tax year. I may retain them for longer where required by HMRC or another legal requirement.

Information processed on behalf of clients

I keep information processed on a client’s behalf according to the client’s documented instructions and our agreement. At the end of the work, I return or delete it as agreed, unless the law requires it to be retained.

AI chats and uploaded content

Information submitted to AI services is subject to the retention controls and policies of the relevant provider. I apply the retention criteria for the underlying business record and delete chats or uploaded files from my account when they are no longer reasonably needed.

Website analytics and cookies

I keep analytics information only for as long as it is useful for understanding website performance and review it at least annually. The duration of individual cookies and similar technologies is described in section 13.

When information is no longer required, I delete it securely or anonymise it so that it no longer identifies an individual.

11. Your data-protection rights

Depending on the circumstances and the lawful basis used, you may have the right to:

• ask for access to the personal information I hold about you;
• ask me to correct inaccurate or incomplete information;
• ask me to delete your information;
• ask me to restrict how I use your information;
• receive information you provided in a portable format, or ask for it to be transferred to another organisation, where the right applies;
• withdraw consent at any time where I rely on consent; and
• complain to the ICO.

Your right to object: You may object to processing based on legitimate interests. You also have an absolute right to object to the use of your personal information for direct marketing, although I do not currently send marketing newsletters or campaigns.

These rights are not absolute and may not apply in every situation. I may need to ask for information to confirm your identity before responding. I will normally respond within one month.

12. Complaints

Please contact me first if you have a concern about how I have handled your personal information. You can also use my Data Protection Complaints Procedure, available on my website. I will acknowledge a data-protection complaint within 30 days, investigate it appropriately and communicate the outcome without undue delay.

If you remain dissatisfied, you can complain to the Information Commissioner’s Office:

Website: ico.org.uk/make-a-complaint

Telephone: 0303 123 1113

Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

13. Cookies and website analytics

My website uses cookies and similar technologies. Some are necessary for the website to operate securely and provide functions such as the contact form. The website also uses Google Analytics and an IONOS Snowplow-based analytics tracker.

Google Analytics and the IONOS analytics tracker may collect information such as IP address, device and browser information, approximate location, referring page, pages viewed, dates, times and online identifiers.

I use the resulting statistics to understand how visitors use my website and to help me improve its content, structure and performance. I do not use the analytics reports to identify individual visitors or make decisions about them. I do not use these technologies for advertising, remarketing or profiling.

The analytics technologies are currently activated automatically when someone visits the website. The website does not currently provide a separate control for accepting or rejecting analytics. I am reviewing the available options with IONOS and will update this notice and the website controls where necessary.

You can limit or block cookies using your browser settings. Google also provides a browser add-on that can prevent Google Analytics from collecting information about visits to websites. Please be aware that browser controls may not prevent every form of website analytics and blocking essential technologies may affect how some website features operate.

If you have questions or wish to object to the use of analytics technologies, please contact me using the details in this privacy notice.

14. Contact details

For questions about this notice, to exercise a data-protection right or to make a complaint, please contact:

Julia Clark

Julia Clark Virtual Assistant

4 Cumbrae Mews, Wickford, SS12 9GF

Email: julia@juliaclark-va.com

Telephone: 07359 295141

Website: www.juliaclark-va.com

15. Changes to this notice

I may update this notice when my services, systems or legal obligations change. The latest version will be published on this page with an updated date.