Privacy Policy

This policy explains what personal data this website collects, why, and what you can do about it. It is written to be read rather than to be skipped, and it describes what the site actually does — the technical detail below is accurate, not boilerplate.

Who is responsible

Louie Doherty is the data controller for this website. For any question about this policy or to exercise the rights described below, email management@louiedoherty.com.

What is collected, and why

When you submit a form

Contact, sponsorship and training enquiry forms collect the name, email address and any other details you choose to enter. Booking requests also record the session and dates you asked about. This is used to reply to you and to manage the enquiry, and it is kept for as long as the business relationship is live, plus six years for accounting purposes where money changed hands.

The lawful basis is legitimate interest (responding to an enquiry you sent us) or, where a contract follows, performance of that contract.

When you subscribe to the newsletter

Your email address and, optionally, your name. The list uses double opt-in: nothing is sent until you click the confirmation link, and the lawful basis is consent. Every email carries a one-click unsubscribe link that works without signing in. Unsubscribing removes you immediately.

When you buy something

Your name, email address, delivery address and order contents. Card details are never seen or stored by this site — payment is processed by Stripe, and only a payment reference is retained. Order records are kept for six years, as UK tax law requires.

When you simply visit

This site runs its own analytics rather than a third-party tracker, and it is built to need no cookie banner:

• No tracking cookies are set. The only cookies used are strictly necessary ones — a shopping bag identifier if you add an item, and a session cookie if you are an administrator signing in.
• No identifier is stored on your device. Visits are counted using a one-way hash of your IP address and browser, mixed with a secret that rotates every day. It distinguishes visitors within a single day and is meaningless afterwards.
• Raw IP addresses are not stored in the analytics data.

What is recorded is the page visited, roughly how long it was visible, the referring site, country, device type and browser. The lawful basis is legitimate interest in understanding how the site is used, and the design above is what keeps that interest proportionate.

Abuse prevention

Form submissions are rate limited per IP address. To do that without storing IP addresses, a salted hash of the address is recorded alongside the form name and a timestamp. It cannot be reversed to identify anyone.

Who your data is shared with

Data is never sold. It is shared only with the services that run the site:

• Supabase — database, file storage and administrator authentication.
• Vercel — website hosting and delivery.
• Stripe — payment processing, if you buy something.
• The email provider used to send transactional messages and the newsletter.
• Google Analytics, if and only if it has been enabled — in which case a cookie notice will appear, because that is a different arrangement to the one described above.

Some of these providers operate outside the UK. Where that is the case, transfers are covered by the UK International Data Transfer Addendum or equivalent safeguards.

Embedded content

Video is embedded from YouTube using the privacy-enhanced youtube-nocookie.com domain, which does not set tracking cookies unless you press play. Once you do, YouTube’s own privacy policy applies.

Your rights

Under UK GDPR you can ask us to:

• give you a copy of the personal data held about you
• correct anything inaccurate
• delete it, where there is no legal reason to keep it
• restrict or object to how it is used
• provide it in a portable format
• withdraw consent at any time, where consent was the basis

Email management@louiedoherty.com and we will respond within one month. If you are unhappy with the response you can complain to the Information Commissioner’s Office at ico.org.uk.

Security

All traffic is encrypted in transit. Database access is governed by row-level security, so a leaked public key cannot read enquiries, orders or analytics. Administrator accounts require a password and support two-factor authentication, and every change made in the dashboard is recorded in an append-only audit log.

Children

This site is not directed at children under 13, and personal data is not knowingly collected from them. Coaching enquiries for under-18s should come from a parent or guardian.

Changes

Material changes to this policy will be reflected in the date at the top. Older versions are available on request.