Scope and controller
Michelle Penney Design operates michellepenney.com and is responsible for personal information described here. Questions may be sent to [email protected].
Information you provide
An enquiry may include your name, email, organization, project description, timeframe, documents, and correspondence. Do not send confidential credentials, regulated health records, payment-card data, or information you are not authorized to share.
Technical information
Hosting infrastructure may process IP address, user agent, requested path, timestamp, response status, referring page, approximate region, and security events to deliver and protect the site.
Purposes and basis
Information is used to respond to requests, evaluate project fit, prepare proposals, deliver contracted work, keep business records, secure systems, and meet legal obligations. Depending on context, processing rests on request, contract, consent, or legitimate operational interests.
Service providers
Hosting, email, file storage, collaboration, accounting, and professional advisers may process limited information for us under appropriate duties. We do not sell personal information or use it for behavioral advertising.
Client work
Engagement records can include research notes, workshop outputs, contact lists, prototypes, approvals, and delivery records. A project agreement defines confidentiality, ownership, access, and any special security or retention requirements.
Retention
Unsuccessful enquiries are kept only as reasonably useful for follow-up and records. Client materials follow contractual, accounting, legal, and operational retention needs, then are deleted or de-identified where appropriate.
Rights and choices
Depending on location, you may request access, correction, deletion, restriction, portability, or objection, and may complain to a regulator. Rights can be limited by lawful exceptions and identity verification.
Security and transfers
Reasonable administrative and technical safeguards are used, but no method is risk-free. Providers may process data across jurisdictions using available contractual and legal safeguards.
Updates and contact
This policy may change as services or obligations change. The current version is posted here. Contact [email protected] with a privacy request.