Website and B2B Outreach Privacy Notice

Who is responsible and how to make contact

David Lema, trading as Grant Resource Studio, is the controller for website operation, outreach and the administration of enquiries and client relationships. ICO registration number ZC284020.

hello@grantresourcestudio.com

You can also reply to a message received from Grant Resource Studio to ask about your information or object to further outreach.

Website visits and external services

This website is hosted on Netlify. Hosting infrastructure processes connection information, such as an IP address, requested address, date, time and browser information, to deliver the site and protect it against misuse. The purpose is secure website operation, relying on legitimate interests under Article 6(1)(f).

Fonts and images are served as local site assets. Analytics collection is disabled. No contact form, file upload, marketing pixel, advertising cookie or automatically loaded calendar or video embed is included. The site does not use browser storage to track visitors.

Links to Cal.com and YouTube open those services only when followed. Their privacy terms apply there. Campaign labels in links help distinguish resource routes. Only a short validated source label is carried between site pages and downloads.

Hosting-log retention: Netlify manages infrastructure and security logs under its service and data-protection terms. Its public privacy statement bases retention on processing purposes, the nature and sensitivity of the data and legal obligations; it does not specify a fixed deletion period for this site’s request logs. This site does not maintain a separate GRS visitor-log database. Any future analytics will be described here before activation. See Netlify’s privacy statement and data processing terms.

Charity and partner prospect outreach

Grant Resource Studio researches relevant organisational contacts and may send proportionate business-to-business correspondence about funding-readiness services and open resources. The purpose is to reach organisations whose work may fit the offer.

The information may include your work name, role, corporate email address, organisation, public LinkedIn URL and a record of contact and replies. Sources can include the Charity Commission for England and Wales, OSCR, the Charity Commission for Northern Ireland, 360Giving GrantNav, Companies House, and published organisation websites and annual reports. Information can therefore be obtained indirectly from public sources, as well as from you.

The lawful basis is legitimate interests under Article 6(1)(f): relevant, limited professional outreach balanced against your privacy and reasonable expectations. PECR’s corporate-subscriber rules apply to incorporated organisations. Sole traders, certain partnerships and other unincorporated bodies have different protections. Public availability alone does not permit unsolicited email to them.

Reply to any outreach message to opt out. Further outreach stops immediately. A minimal suppression record is retained to prevent re-contact, including when new prospect lists are checked. Inactive, uncontacted prospect records are reviewed annually for continued relevance and removed where no longer needed.

Research and correspondence records are held in controlled business trackers, email and working files. They are not sold or used for advertising audiences.

Client contacts, scheduling and accounts

For enquiries and engagements, GRS processes contact names, roles, work contact details, meeting arrangements, notes and correspondence. Legitimate interests supports administering relationships and consultancy work with an organisation. You choose whether to provide information for an enquiry. Without essential contact and scheduling information it may not be possible to arrange it.

Contracting, invoicing and accounting records include signatory and billing details, signatures and payment references. Processing relies on legal obligation under Article 6(1)(c) for tax and accounting, and legitimate interests for contract administration and legal claims.

Systems include Cal.com, business email, controlled local files and Google Drive sync. Client work is kept separate by engagement. Contact administration records remain during the relationship and the 12-month continuity window. The GRS retention policy keeps contract, invoice and tax records for six years. Tax records are kept for at least five years after the 31 January submission deadline for the relevant tax year, and longer where an applicable requirement or unresolved enquiry requires it. This deadline takes precedence if it extends beyond the six-year policy period.

Organisational material supplied for a build

Where a client supplies personal data for a commissioned build, the client remains the controller and GRS acts as its processor under the signed engagement agreement and documented instructions. The client owns its source material and final knowledge-base content, held in the client’s chosen workspace.

Suitable sources describe the organisation, its work, aggregate evidence and people in their published working roles. Names or details identifying beneficiaries or other supported individuals must be removed or anonymised, even if already public. Personal contact details, home addresses, safeguarding and pastoral records, children’s personal data, health or DBS information, bank details and private HR records are excluded.

If excluded material is shared by mistake, GRS stops using it, tells the client without delay and agrees removal or replacement with a cleaned version. Unredacted excluded material is not passed to an AI tool for cleaning. Clients should identify confidential unpublished strategy, negotiations or draft bids before sharing, so handling can be agreed in writing, including summarising the material or keeping it out of AI tools.

Retention after completion

Under the current engagement arrangements, client access to the Content Workshop ends 30 days after project completion. GRS deletes the client’s platform data and files and removes client files it has uploaded to AI tools. Local working copies, backups and Google Drive continuity copies may be retained for up to 12 months after completion, then deleted, including from Google Drive Trash. Earlier return or deletion can be requested; the signed agreement governs the engagement.

AI conversation history follows each provider’s retention settings and is not deleted conversation by conversation. Removing uploaded files is not a promise that every provider-held copy or operational record immediately disappears.

AI use and provider terms

The Content Workshop has no built-in AI model and does not use platform data to train one. GRS separately uses paid individual AI subscriptions for agreed organisational drafting and analysis, with model-training or product-improvement settings switched off, or the provider’s privacy mode enabled. The provider, plan and settings are confirmed for the engagement and current providers are available on request.

These individual subscriptions operate on providers’ standard terms without a data processing agreement. Turning training off does not mean zero retention: providers may retain conversations or files and allow limited access for safety, abuse prevention, monitoring or exceptional review. Retention varies by provider, plan and settings. This is why the material boundary matters; unpublished personal contact details stay outside AI drafting.

Recipients, safeguards and international processing

Information is accessed by David as the sole practitioner and relevant service providers for hosting, scheduling, email, cloud storage and, where agreed for client material, the Content Workshop and AI services. Other people’s access to client material needs prior written agreement.

Some providers process information in the United States and other countries. Applicable provider transfer terms use adequacy arrangements or contractual safeguards, including standard contractual clauses and a UK Addendum where required. Ask for details of the providers and safeguards relevant to your information. A UK-hosted platform database does not mean that all routing, storage, email or AI processing remains in the UK.

Your rights

Depending on the circumstances, you can request access, correction, erasure or restriction of your information and object to processing. You can object to direct marketing at any time. Data portability applies where its legal conditions are met. GRS does not make solely automated decisions with legal or similarly significant effects about you.

Use the contact route above or reply to GRS correspondence. Identity may need to be checked before disclosing information. You can complain to the Information Commissioner’s Office. You do not have to complain to GRS first.