Privacy notice
Last updated 6 November 2026
I run a privacy-first hospitality consultancy, marketing, and website service. This notice explains what personal data I collect when you visit this site or work with me, why, who else handles it, how long I keep it and what you can do about it.
The short version: this site uses no tracking cookies, no Google Analytics, no Meta Pixel and no other behavioural tracking. I only collect what you choose to give me, plus the basic technical records any website needs to run.
1. Who I am
Atelier Sawyer is the trading name of Benjamin Bryan Sawyer, a sole trader (autónomo) resident and registered in Spain.
NIE: Y8443557H
Address: Calle Brújula, 3, Villa Lazara (Urb. Villa Yvonne), 29630 Benalmádena, Málaga, Spain
Email: enquiries@ateliersawyer.com
Phone: +44 20 4513 1445 (UK) · +34 603 20 43 39 (Spain)
I am the controller of your personal data: I decide how and why it is used. There is no separate data protection officer; questions come straight to me.
UK representative. Because I am based in Spain, I have appointed a representative in the UK under Article 27 of the UK GDPR: Abries Ltd, a company registered in England and Wales under number 07979362, whose registered office is at FAO Workwell Accountancy, Ground Floor East, Hyde, 38 Clarendon Road, Watford, Hertfordshire, WD17 1JW. You, or the Information Commissioner's Office, can contact them about anything in this notice, instead of or as well as me.
2. What I collect
| What | Examples | Where it comes from |
|---|---|---|
| Enquiries | Name, email, phone, business name, and whatever you write in your message | You, through the contact form, email, WhatsApp, or a call |
| Client information | Business details, contact details, and the figures, menus, rotas, and documents you share for the work | You, during an engagement or in the client portal |
| Portal and tool data | Your account, your venue's details, and the answers and figures you enter into the tools | You, through the client portal |
| Billing details | Invoices, amounts, and payment status. I never see or store your full card number. | You, Stripe, and Revolut |
| Technical records | IP address, browser, and the time of each request, kept in server and security logs | Your device, automatically, as with any website |
I do not knowingly collect special category data (such as health information). Please do not send it to me.
3. Why I use it, and the legal basis
| Purpose | Legal basis |
|---|---|
| Answering your enquiry and arranging a call | Steps before a contract, at your request; or my legitimate interest in replying to people who contact me |
| Delivering the work you have hired me for | Performance of a contract |
| Running your portal account and the free tools | Performance of a contract (the portal's terms of use) |
| Invoicing, taking payment, and keeping accounts | Performance of a contract; legal obligation (tax and accounting records) |
| Sending the monthly newsletter | Your consent, which you can withdraw at any time |
| Keeping in touch with clients and past clients about similar services | Legitimate interest, with an easy way to opt out each time |
| Anonymised benchmarks from tool results | Your consent (an opt-in in the portal). Once anonymised, the figures are no longer personal data. |
| Keeping the site and portal secure | Legitimate interest |
4. Where your data is held, and who else handles it
The website and the client portal are built and hosted on Lovable Cloud. Portal accounts, venue details, and the answers you give in the tools are stored in the European Union, on Amazon Web Services in Ireland. The website itself is delivered through Cloudflare's global network, so your request is handled at the server nearest to you (for UK visitors, usually London or Manchester). The platform's error monitoring, logs, and sign-in emails (the links that let you into the portal) may be processed outside the EU by the platform's own providers.
Enquiries sent through the contact form go straight to my client records in Notion.
I do not sell your data, and I do not share it with anyone for their own marketing. These services handle personal data for me, on my instructions, under contracts that require them to protect it:
| Service | What it does for me | Where data may be processed |
|---|---|---|
| Lovable Cloud (with Supabase and AWS) | Hosts the client portal and its data | EU (Ireland) at rest; platform logs and emails may be processed elsewhere |
| Cloudflare | Delivers the website | Worldwide, at the nearest server |
| Notion | My client records (CRM), including website enquiries | US and EU |
| Google Workspace | Email, calendar, call bookings, documents | EU, UK, and US |
| Motion | Task and calendar planning | US |
| Marblism | AI assistants that help me draft and manage communications | US |
| Anthropic (Claude) | AI assistant for drafting and analysis | US |
| Xolo | Accounting and tax filing | EU |
| Stripe | Monthly subscription payments | EU, UK, and US |
| Revolut Business | One-off invoice payments | EU and UK |
| WhatsApp (Meta) | Messages, if you choose to contact me that way | EU and US |
I may also share data with my professional advisers (such as my accountant or lawyer), or where the law requires it.
5. Data sent outside the UK and the EU
Data sent from the UK to me in Spain, and to services in the EU, is protected by the UK's adequacy decision for the EU, so no extra safeguards are needed.
Some of the services above process data in the United States or elsewhere. Where they do, the transfer is protected by an adequacy decision (such as the EU-US Data Privacy Framework and its UK Extension, for certified companies), or by the European Commission's standard contractual clauses together with the UK International Data Transfer Addendum.
6. Websites and systems I build for your venue
When I build a website for your venue, bookings, tickets, and reservations usually go through the system you already use or choose (for example OpenTable, ResDiary, DesignMyNight, or Guestline). Your guests' booking data then goes directly to that provider, under your agreement with them. I do not copy it, store it, or keep access to it.
Where a site I build or look after for you collects your guests' details itself (for example through an enquiry form or an AI assistant), your business is the controller of that data, and I handle it only on your instructions, under the data processing terms in your contract. Your own privacy notice should explain this to your guests.
7. How long I keep it
| Data | How long |
|---|---|
| Enquiries that do not become work | Two years from our last contact |
| Client records, contracts, and invoices | Six years after the work ends, for tax, accounting, and legal claims |
| Portal accounts and tool data | Until you delete your account, or two years after you last sign in |
| Newsletter | Until you unsubscribe |
| Newsletter suppression records | While your address remains on our do-not-contact list, so we can evidence that we honoured your opt-out |
| Server and security logs | As set by the hosting providers, usually no more than 90 days |
8. Cookies
This site sets no cookies for analytics, advertising, or tracking, and stores nothing in your browser when you simply visit.
Two things are strictly necessary, so the law does not require your consent for them:
- Cloudflare, which delivers the site, may set a security cookie (__cf_bm) that helps tell people apart from automated traffic. It expires after 30 minutes.
- If you sign in to your portal, your browser keeps what is needed to keep you signed in, until you sign out.
If I ever add anything that is not strictly necessary, I will ask for your consent before it is set, and update this notice.
9. Your rights
Under the UK GDPR and the EU GDPR, you can ask me to:
- give you a copy of your data;
- correct it;
- delete it;
- restrict how I use it;
- give it to you, or to someone else, in a usable format; or
- stop using it, where I rely on legitimate interest or for direct marketing.
Where I rely on your consent, you can withdraw it at any time. Email enquiries@ateliersawyer.com. I will reply within one calendar month. There is no charge.
10. Complaints
Please tell me first, and I will try to put it right. You also have the right to complain to a regulator:
In the UK: the Information Commissioner's Office (ICO), ico.org.uk, 0303 123 1113.
In Spain: the Agencia Española de Protección de Datos (AEPD), aepd.es.
11. Security
Access to client data is limited to me, protected by strong passwords and two-factor authentication, and the portal shows each client only their own data. No system is perfectly secure; if something goes wrong that puts your data at risk, I will tell you and the regulator as the law requires.
12. Changes
When this notice changes, I will update the date at the top. If the change matters to how I use your data, I will tell clients directly.