Privacy Policy

Nightingale Content & Strategy is operated by Joseph Nightingale trading as Nightingale Content & Strategy. For the purposes of UK data protection law, Joseph Nightingale is the controller of the personal information described in this policy unless a different role is expressly agreed for a client project.

You can contact us about privacy or data protection at joseph@nightingalecontent.com or through https://nightingalecontent.com.

This policy explains how we collect and use personal information when you visit the website, complete the Content Diagnosis, make an enquiry, book a call, receive or respond to business communications, or work with Nightingale Content & Strategy as a client or business contact.

Depending on how you interact with us, we may collect the following information.

• Contact and professional information, including your name, job title, work email address, company or organisation, and other business contact details.
• Content Diagnosis information, including the sector, audiences, content problems, service interests, recommendation preferences, and additional context you choose to provide.
• Booking information, including your name, email address, selected appointment time, time zone, and booking status.
• Client and project information, including briefs, correspondence, contracts, statements of work, project files, feedback, invoices, payment records, and materials supplied for the work.
• Technical and security information, including limited request metadata, the page from which a form was submitted, anti-spam verification information, and information used to prevent repeated or abusive submissions.
• Business-development information obtained from public professional sources or referrals, such as a company website, professional profile, directory, or a mutual business contact, where relevant to lawful B2B outreach.

While you complete the Content Diagnosis, your selections are stored temporarily in your browser using sessionStorage. This helps preserve your progress during the current browser session. If you submit the diagnosis, the submitted selections remain visible for the remainder of that page load and are removed from browser storage when the page is next fully reloaded. They may also be cleared by resetting the diagnosis or ending the relevant browser session.

When you submit the diagnosis, the information you provide is sent to our server, validated, checked for automated abuse, and stored in our database so that we can review the enquiry and respond.

We use proportionate technical and organisational measures to protect the website and enquiry process. These include server-side validation, restricted database access, Cloudflare Turnstile, duplicate-submission controls, and rate limiting.

For rate limiting, a visitor’s IP address may be processed briefly to generate a cryptographic identifier. The raw IP address is not stored in the rate-limit database record. Rate-limit records are intended to expire shortly after the relevant security window.

Turnstile verification tokens are used to validate a submission and are not retained as part of the substantive enquiry record.

The Content Diagnosis and general website forms are designed for business enquiries. They are not intended for patient information, medical records, identifiable health information, or other special category personal data. Please do not submit confidential patient information or other sensitive personal information through the general website forms.

If a client provides personal data within project materials during a paid engagement, the parties’ respective data protection roles may differ. For example, a client may remain the controller while Nightingale Content & Strategy acts as a processor on the client’s instructions. Where appropriate, this will be addressed in the client agreement or a separate data processing agreement.

Most personal information is provided directly by you when you contact us, complete a form, book a call, or work with us.

For business development, we may also obtain professional contact information from public company websites, professional networking profiles, directories, referrals, or other legitimate business sources. Where required, we provide appropriate privacy information and honour objections to direct marketing.

We use a limited number of third-party providers where necessary to operate the website and deliver services. These may include:

• Vercel for website hosting and deployment infrastructure, and Google Cloud/Firebase for database services.
• Resend for transactional and internal notification emails.
• Calendly for appointment scheduling and booking management.
• Cloudflare Turnstile for bot, spam, and abuse prevention.
• Business email, accounting, payment, professional advisory, or technical service providers where reasonably necessary.
• Subcontractors or specialist collaborators where a client project requires them and appropriate confidentiality and data protection arrangements are in place.

We may also disclose information where reasonably necessary to comply with law, obtain professional advice, establish or defend legal claims, enforce contractual rights, prevent fraud, or protect the security of our business. We do not sell personal information.

Some service providers may process personal information outside the United Kingdom. Where a transfer is a restricted international transfer, we use or rely on an appropriate UK transfer mechanism or safeguard, such as UK adequacy regulations, an approved data privacy framework where applicable, the UK International Data Transfer Agreement, or the UK Addendum to approved standard contractual clauses.

You can contact us at joseph@nightingalecontent.com if you would like more information about the safeguards used for a particular provider.

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, security, and contractual requirements. Our normal retention approach is:

• Prospective client enquiries and Content Diagnosis submissions that do not lead to an engagement: normally up to 24 months after the last meaningful contact.
• Appointment information relating to a prospective client: normally up to 24 months after the last meaningful contact, subject to the settings and retention practices of the booking provider.
• Client project records, contracts, significant correspondence, and evidence of work delivered: normally up to 6 years after the end of the relevant engagement where reasonably necessary for legal, contractual, or business-record purposes.
• Invoices, payment, tax, and accounting records: for the period required by applicable tax and accounting law, normally up to 6 years or such longer period as the law requires.
• Marketing suppression records: for as long as necessary to ensure that an opt-out continues to be respected.
• Short-lived anti-abuse and rate-limit records: only for the operational period required to detect and prevent repeated abusive submissions, with automatic expiry configured where available.

We periodically review retained information and delete or anonymise it when it is no longer reasonably required.

Submitting a Content Diagnosis, making an enquiry, or booking a call does not by itself subscribe you to a marketing mailing list.

Where we send relevant B2B outreach or marketing, we do so only where permitted by UK data protection law and the Privacy and Electronic Communications Regulations. The rules can differ depending on whether a recipient is a corporate subscriber, sole trader, or certain type of partnership.

Every direct marketing communication will provide an appropriate way to opt out. You have an absolute right to object to the use of your personal information for direct marketing. If you object, we will stop using it for that purpose and may keep a minimal suppression record to ensure your preference is respected.

You can object at any time to the use of your personal information for direct marketing. If you do, we will stop using it for that purpose and may keep a minimal suppression record so that your preference continues to be respected.

Depending on the circumstances and the lawful basis used, you may have rights to access your personal information, correct inaccurate information, request deletion, restrict processing, object to processing, and receive certain information in a portable form. Where processing is based on consent, you can withdraw consent at any time. These rights are not absolute and may not apply in every circumstance.

To exercise a right, contact joseph@nightingalecontent.com. We may need to verify your identity before responding.

We do not use personal information to make solely automated decisions that produce legal effects or similarly significant effects about you. Automated security systems may identify or block suspected automated, duplicate, or abusive website activity.

We use reasonable technical and organisational safeguards designed to protect personal information against unauthorised access, loss, misuse, or alteration. No internet or storage system can be guaranteed to be completely secure, so we cannot promise absolute security.

This website and our services are intended for businesses and adult professionals. They are not directed at children, and we do not knowingly seek to collect personal information from children through the website.

The website may link to websites operated by other organisations. We are not responsible for their privacy practices. You should review their privacy information separately.

If you have a concern about how we use your personal information, you can make a data protection complaint by contacting joseph@nightingalecontent.com. We will acknowledge a data protection complaint within 30 days, take appropriate steps to investigate it, keep you informed where necessary, and provide an outcome without undue delay.

You also have the right to complain to the Information Commissioner’s Office, the UK’s data protection regulator. Information about making a complaint is available at ico.org.uk.