Nina Mistry ('I', 'me', 'my' in this privacy statement) is responsible for collecting, processing, storing and safe-keeping personal and other information as part of providing a service and carrying out regular business activities. I manage personal information in accordance with data protection legislation including the Data Protection Act 2018 and am registered as a Data Controller with the Information Commissioner's Office.
Any questions regarding my processing of personal data should be directed to me at nina@nina-mistry.com.
I take protecting online privacy and data security seriously. Please read the whole of this statement carefully as it sets out my approach to processing personal data including what information I may collect from you, how I may use it, store it and protect it, and your rights as a data subject.
This Privacy Statement outlines my approach to any kind of data processing where I am acting as a data controller or co-controller (including collection, use, transfer, storage and deletion) of personally identifiable information about natural persons. This statement applies to my processing of data collected through any means, actively as well as passively, from persons located anywhere in the world.
I am guided by the following principles when processing data:
In accordance with Data Protection Legislation I only collect and process information which I require to meet the specific purposes stated above. The information I may collect about you could include, but is not limited to:
Occasionally I may ask for special category data if necessary for delivery of a particular service or product. Any such special category data will only be collected with your express consent and will be handled in line with ICO best practice guidelines. As per my Data Processing Principles I will only ask for information that is necessary to deliver my services, and I encourage you not to provide personal data or special category data which I do not ask for.
Most personal information is provided directly and voluntarily by you when you engage with me in order to enquire about, or purchase, my services or products. I will collect information from you when:
I may also collect personal information about you from third party sources, such as when you choose to connect your social media accounts with my site or log in through a social media platform. I will only use this information where these third parties either have your consent or are otherwise legally permitted or required to share your personal information with me.
I collect this information in order to make available to you my services or products and to communicate with you in relation to those services or products. I may use the information collected to:
I will not sell or lend your personal data to third parties, or share your personal data for marketing purposes without your express consent. I will only share your personal data with third party service providers where it is necessary for the delivery of my products or services, and only where I am confident that such third party service providers have appropriate data protection systems and measures in place that are compliant with UK Data Protection Legislation.
I will not give consent to third party service providers or platforms to use your information, including audio and video recordings, for purposes other than those necessary for the delivery of my products and services. I will not give consent for your information to be used by third party service providers for the training and development of AI modelling software, or similar purposes.
I have in place appropriate technical and organisational measures to ensure the security, confidentiality, integrity and availability of personal data I control. Your information is securely stored on my company cloud storage database, which is not publicly accessible — it is accessible to me and any authorised affiliates only, and is password protected.
Your information may also be stored on third party platforms including my email marketing platform (Systeme.io), my payment platform (Stripe), and other authorised third party consultants who support my business. These third-party providers have their own privacy policies which you can view on their websites.
I may store or process your data on cloud-based platforms whose servers are based outside of the UK/EEA, which may constitute a transfer of data under GDPR. I will only use such third party service providers where I am confident that appropriate safeguards are in place to ensure that any personal data transferred outside of the UK/EEA is subject to an equivalent level of security and protection as required under UK Data Protection Legislation, such as the UK Extension to the EU-U.S. Data Privacy Framework. To learn more, visit the U.S. Department of Commerce's website.
I also have appropriate procedures to handle any potential personal data breaches in accordance with Data Protection Legislation. Any such breaches will be reported to the relevant supervisory authority and notified to the affected data subjects where I am legally required to do so.
I will only keep your personal data for as long as is necessary to meet the requirements for which it was collected. Apart from in exceptional circumstances where longer retention is necessary, I will only retain your personal data for 6 years, after which I will delete it unless there is a legitimate business reason to retain all or part of the data.
The General Data Protection Regulation (GDPR) provides that processing of your data shall only be lawful if and to the extent that at least one of the following applies:
All personal data is managed to ensure that it is either erased from my system when it is no longer required for the purpose for which it was collected, retained for legal reasons, or minimised and retained. Any special category data collected from you has special protection and is limited to that permissible by law. In all instances where special category data is collected I will obtain your express consent.
You have a number of legal rights in relation to the personal data that I hold about you, and you can exercise your rights by contacting me at nina@nina-mistry.com. These rights include:
If you believe I've handled your personal data incorrectly — whether that's how I collected or used it, how long I've kept it, or how I responded to a request — you can raise a complaint directly with me. I take all data concerns seriously and aim to respond within 30 calendar days.
Full details of how to raise a complaint, what happens next, and how to escalate to the ICO if you're not satisfied are set out in my data protection complaints procedure.
To raise a complaint, contact me at nina@nina-mistry.com. If you remain unsatisfied after my response, you can contact the Information Commissioner's Office.
My site contains links to and from other websites operated by individuals and companies over which I have no direct control. If you follow a link to any of these websites, please note that they have their own privacy and terms of use policies. I do not accept any responsibility or liability for these policies. I advise you to check the policies for third party sites before you submit any personal data to them.
I may send you marketing emails and communications when you have opted in or otherwise given consent for me to do so. I will make it as easy as I can for you to opt out of unwanted processing, providing it does not restrict my ability to provide you with the primary service you have requested.
If you wish to unsubscribe from any marketing emails you have signed up for, you can do so by emailing nina@nina-mistry.com or clicking the unsubscribe link on the marketing email. It may take up to 24 hours for this to become effective.
I use website analytics to provide the best user experience and service, and to evaluate and improve my site. I use third party data analytics service providers to improve visibility and monitor website behaviour and navigation.
These third-party providers collect information using cookies on my behalf in accordance with my instructions and in line with their own privacy policies. They may collect the following data about how you use my site, which will almost always be anonymised and aggregated before being reported to me:
From time to time I may use the information collected about you to present you with targeted advertisements using platforms such as Facebook, Instagram, or Google.
If you wish to limit or reject cookies associated with my website you can do this in your browser settings. Please be aware that limiting or rejecting cookies may mean you are not able to use or benefit from certain features of the site.
This Privacy Statement is reviewed every 6 months, or upon changes to relevant Data Protection Legislation being published, whichever is sooner. I do not intend to process your personal information except for the reasons stated within this Privacy Statement, however I reserve the right to update it from time to time. Where appropriate, I will contact you to notify you of any material changes.
If you have any questions or concerns regarding my data protection or privacy policies, please contact me at nina@nina-mistry.com. If you still have concerns after my response, you should contact the relevant supervisory authority — in the UK this is the Information Commissioner's Office.