Privacy notice

Who is responsible and how to make contact

David Lema, trading as Grant Resource Studio, is the controller for website operation, enquiries and administration of client relationships. Operating Knowledge Studio is the name of the wider consulting work described on this site. ICO registration number ZC284020.

Contact hello@grantresourcestudio.com about this notice, your information or an objection to processing.

This notice concerns this website, enquiries and arranging a conversation. The signed engagement agreement governs client material and any processing on a client's instructions. The funding practice has its own notice for its correspondence and activities.

Website visits and external services

The public website is intended to be hosted on Netlify. Hosting infrastructure processes connection information such as an IP address, requested address, date, time and browser information to deliver and protect the site. The basis is legitimate interests in secure website operation under Article 6(1)(f).

Fonts and images are local site assets. There is no contact form, file upload, advertising cookie, marketing pixel or automatically loaded calendar. The site does not use browser storage to track visitors.

GoatCounter provides visitor statistics through a dedicated Operating Knowledge Studio counter. It counts page visits and provides information such as referrers, browser type, screen size and approximate location. Page paths may include a short campaign label. It does not set cookies or store tracking data in your browser. These statistics help me understand use of the site and its resources.

The knowledge base discovery-call link opens Cal.com only when followed. The calendar is not loaded with the page. External services apply their own privacy terms.

Netlify manages its infrastructure and security logs under its service terms. Its public statement bases retention on purpose, sensitivity and legal obligations; no fixed period for this site's request logs is established. This practice keeps no separate visitor-log database. See Netlify's privacy statement, its data processing terms, GoatCounter's privacy information and Cal.com's privacy notice.

Enquiries, scheduling and accounts

For enquiries and engagements, the practice uses contact names, roles, work contact details, meeting arrangements, notes and correspondence. Legitimate interests supports responding to enquiries, assessing fit and administering consultancy work with an organisation. You choose what to provide. Essential contact and scheduling details are needed to arrange a conversation.

Contracting, invoicing and accounting records include signatory and billing details, signatures and payment references. Legal obligation under Article 6(1)(c) applies to tax and accounting records. Legitimate interests supports contract administration and legal claims. Where steps towards a contract with you personally are necessary at your request, the contract basis applies; representing a charity does not by itself make you the contracting party.

Systems include Cal.com, business email, controlled local files and Google Drive sync. Client work is kept separate by engagement. Contact administration records remain during the relationship and the 12-month continuity window, with earlier deletion where no longer needed. The practice keeps contract, invoice and tax records for six years. Tax records are kept for at least five years after the 31 January submission deadline for the relevant tax year, and longer where an applicable requirement or unresolved enquiry requires it. That deadline takes precedence if it extends beyond the six-year policy period.

Organisational material and AI

Where a client supplies personal information for a commissioned build, the client remains controller and the practice acts as processor under the signed agreement and documented instructions. The client owns its source material and final knowledge content, held in its chosen workspace.

Suitable sources describe the organisation, its work, aggregate evidence and published working roles. Beneficiary details, safeguarding and pastoral records, children's personal information, health or DBS information, personal contact details, home addresses, bank details and private HR records are excluded. Unredacted excluded material is not passed to an AI tool for cleaning.

If excluded material is shared by mistake, I stop using it, tell the client without delay and agree removal or replacement with a cleaned version. Identify confidential unpublished strategy or negotiations before sharing, so handling can be agreed.

The website does not provide an AI chat or automatically send browsing activity to AI providers. Named tools on service pages are examples of possible working environments. Before AI-assisted engagement work, the selected provider, plan, permitted sources, settings and retention are confirmed. The signed agreement governs client-material retention and deletion; this notice does not impose another engagement's platform timetable.

Turning model training off is not zero retention. Providers can retain conversations and files under the terms of the selected service. A person reviews AI-assisted output and decides whether an engagement is suitable.

Recipients, safeguards and international processing

David and the relevant hosting, scheduling, email and storage providers access information for the purposes described here. AI services receive only material permitted for the agreed work. Other people's access to client material requires prior written agreement.

Some providers process information in the United States and other countries. Applicable provider transfer terms use adequacy arrangements or contractual safeguards, including standard contractual clauses and a UK Addendum where required. Ask for details of the providers and safeguards relevant to your information. A UK-hosted workspace does not mean every provider processes information only in the UK.

Your rights

Depending on the circumstances, you can request access, correction, erasure or restriction, and object to processing based on legitimate interests. Data portability applies where its legal conditions are met. If a use relies on consent, you can withdraw it for that use without affecting earlier lawful processing.

Use the email address above. Identity may need checking before information is disclosed. Requests are considered within the applicable legal timescales. You may complain to the Information Commissioner's Office without contacting the practice first.

The site does not make solely automated decisions with legal or similarly significant effects. This notice will be reviewed when the website or processing changes.