Privacy policy

This privacy policy (last updated on 14 October 2026) tells you what you can expect me to do with your personal information.

Contact details

Chris Scrace
chris@chrisscrace.com

I am a sole trader and the data controller responsible for your personal information.

What information I collect and use, and why

I collect and use the following information to provide and improve editorial services for my clients (including managing freelance suppliers on their behalf), respond to queries, complaints or claims, keep the business records I am required to keep by law and contact clients and other publishing professionals infrequently to offer my services:

Names and contact details
Addresses
Occupations
Records of meetings and decisions
Correspondence
Financial information for invoicing (such as billing details and purchase order numbers) and records of payments received
Gender and/or pronoun preferences (only if you volunteer these in your messages to me; I never ask for these)

Separately, to serve the pages on my website to visitors, compile basic web analytics and improve my website I collect and use data about how you interact with and use my website, including your IP address and basic user journey information (page views, country, web browser and device type).

Lawful bases and data protection rights

Under UK data protection law, I must have a lawful basis for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis I rely on may affect your data protection rights which are set out in brief below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:

Your right of access: You have the right to ask me for copies of your personal information. You can request other information such as details about where I get personal information from and who I share personal information with. There are some exemptions which means you may not receive all the information you ask for. Read more about the right of access.
Your right to rectification: You have the right to ask me to correct or delete personal information you think is inaccurate or incomplete. Read more about the right to rectification.
Your right to erasure: You have the right to ask me to delete your personal information. Read more about the right to erasure.
Your right to restriction of processing: You have the right to ask me to limit how I can use your personal information. Read more about the right to restriction of processing.
Your right to object to processing: You have the right to object to the processing of your personal data. Read more about the right to object to processing.
Your right to data portability: You have the right to ask that I transfer the personal information you gave me to another organisation, or to you. Read more about the right to data portability.

If you make a request, I must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact me using the contact details at the top of this privacy policy.

My lawful bases for the collection and use of your data

My lawful bases for collecting or using personal information to provide and improve editorial services for my clients (including managing freelance suppliers on their behalf), respond to queries, complaints or claims, keep the business records I am required to keep by law and contact clients and other publishing professionals infrequently to offer my services are:

Contract: I have to collect or use your information so I can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
Legal obligation: I have to keep records of my invoices and payments (which necessarily contain your information) to meet HMRC’s record-keeping rules. Your rights to erasure, portability and to object do not apply to these records.
Legitimate interests: I have to collect or use your information because it benefits you, my business or someone else, without causing an undue risk of harm to anyone. All of your data protection rights may apply, except the right to portability. My legitimate interests are:
- To ensure that I comply with editorial service standards and provide a beneficial service to my clients, including clear and timely communication.
- To contact you infrequently to offer my services to improve your products.
- To find and contact other professionals in the publishing industry, mainly through LinkedIn messages, to introduce my services.

You can ask me to stop contacting you about my services at any time, and I will stop.

My lawful basis for collecting or using personal information to serve the pages on my website to visitors, compile basic web analytics and improve my website is:

Legitimate interests: I need to use basic technical information, such as your IP address, to deliver my website to your device securely. I also have a legitimate interest in understanding, in general terms, how many people visit and which pages they view, so that I can improve the website. This uses the minimum information needed.

All of your data protection rights may apply except the right to portability. For more information on my use of legitimate interests as a lawful basis you can contact me using the contact details set out above.

Where I get personal information from

Directly from you
From my clients (for example, contact details of their colleagues, or of freelancers I work with on their behalf)
Publicly available professional profiles on LinkedIn (I note only your name, so that I can contact you through LinkedIn messaging)

How long I keep information

I keep personal information only for as long as I need it:

Project files (including any personal information in them): six months after the end of the contract, including copies in my backups.
Contact details of clients and freelancers: three years after the end of our most recent contract, so that I can follow up on completed work and offer my services.
Enquiries that do not lead to work: twelve months after your last message.
Names noted from LinkedIn: twelve months after I last contacted you.
Invoices and payment records: six years after the self-assessment deadline at the end of January for the tax year they relate to.
Website data: Cloudflare keeps its technical logs and visitor statistics for limited periods, as set out in its own privacy policy.

For more information on how long I store your personal information or the criteria I use to determine this please contact me using the details provided above.

Data processors

Cloudflare

This data processor collects essential information about the device you use to access my website only, for the purpose of delivering the website to your device and for basic web analytics.

Proton AG

Proton AG provides my email service and my encrypted cloud storage (Proton Drive), which I use to back up my work files and business records.

Others I share personal information with

To complete a project-management contract, it is often necessary for me to share your personal information with other suppliers, such as freelance copyeditors and proofreaders, so that they can perform necessary functions under the terms of the contract. In the same way, I share freelancers’ contact details with my clients when this is needed.
When a client gives me personal information about other people as part of a job (for example, authors’ details), I handle it on that client’s behalf, following their instructions and their data protection policy rather than this one.
Some clients ask me to use their own platforms for meetings and file transfers (for example Microsoft Teams, OneDrive, Dropbox or WeTransfer). Information shared through those platforms is handled under the client’s own arrangements with that platform.

Sharing information outside the UK

Where necessary, my data processors will share personal information outside of the UK. When doing so, they comply with the UK GDPR, making sure appropriate safeguards are in place.

For further information or to obtain a copy of the appropriate safeguard for any of the transfers below, please contact me using the contact information provided above.

Organisation name: Cloudflare
Category of recipient: Website host
Country the personal information is sent to: Worldwide
How the transfer complies with UK data protection law: the UK Extension to the EU–US Data Privacy Framework, and the UK International Data Transfer Addendum to the EU standard contractual clauses (both set out in Cloudflare’s data processing addendum)

Organisation name: Proton AG
Category of recipient: Email and encrypted cloud storage provider
Country the personal information is sent to: Switzerland
How the transfer complies with UK data protection law: Switzerland is covered by UK adequacy regulations, so no additional safeguards are needed

Cookies

My website does not set any cookies itself. Cloudflare, which hosts my website, may occasionally set a strictly necessary security cookie on your device if it detects unusual traffic, to protect the website from attack. No optional, advertising or tracking cookies are used, so I do not ask for your consent to cookies.

How to complain

If you have any concerns about my use of your personal information, you can make a data protection complaint to me:

Email: chris@chrisscrace.com

If you remain unhappy with how I have used your data after raising a complaint with me, you can also complain to the ICO.

The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint