Privacy Policy
Last updated: 10 September 2026
This Privacy Policy explains how Rosie Casson, trading as Rosebud Casson (“I”, “me” or “my”) collects, uses, stores and protects your personal information when you visit rosebudcasson.com, contact me, join my email list, download a free resource, enquire about my services or work with me as a client.

I take your privacy seriously and aim to collect only the information I genuinely need to run my business and provide my services.
For the purposes of UK data protection law, Rosie Casson trading as Rosebud Casson is the data controller of the personal information described in this policy.

The information I may collect
Depending on how you interact with me and my business, I may collect the following information.

Contact information
 Such as your name, email address, telephone number and business name.

Business and project information
 Such as your website, social media profiles, information about your business, project requirements, goals, preferences and other information you choose to provide when enquiring about or working with me.

Client information
 If we work together, I may collect information necessary to manage your project and our working relationship, including correspondence, questionnaires, project notes, feedback, contracts, proposals and information required for invoicing.

Payment and transaction information
 This may include billing information, payment status, invoices and transaction records.
Payments may be processed through third-party payment providers such as PayPal or Square, or made by bank transfer. I do not receive or store your complete payment-card details when a third-party payment provider processes your payment.

Email marketing information
 If you subscribe to my email list or request a free resource, I may collect your name, email address, subscription preferences and information about your interaction with emails I send.

Website and analytics information
 If you consent to analytics cookies, Google Analytics may collect information about how you use my website, such as pages visited, approximate location derived from technical information, device and browser information, referral source and interactions with the website.
Google Analytics does not load on this website unless you choose to allow analytics.  
You can find more information about this in my Cookie Policy.

Communications
 If you email me, submit an enquiry or otherwise communicate with me, I may keep a record of that communication and the information you provide.
How I collect your information
I may collect personal information directly from you when you:
complete an enquiry or contact form;
subscribe to my email list;
request or download a free resource;
book or purchase a service;
complete a questionnaire;
enter into a contract with me;
communicate with me by email or another agreed communication method; or
otherwise provide information to me while working together.
I may also receive limited information automatically through my website where you have consented to the relevant technology, as explained in my Cookie Policy.
In some circumstances, you may give me information relating to another person, for example a member of your team involved in a project. You should only provide another person's information where you have an appropriate reason to do so.

Why I use your information and my lawful bases
UK data protection law requires me to have a lawful basis for processing personal information. The lawful basis I rely on depends on why I am using the information.

To respond to enquiries and discuss potential work
I use the information you provide to respond to enquiries, understand what you need, discuss my services and prepare proposals or quotations.
My lawful basis is generally taking steps at your request before entering into a contract.

To provide services and manage client projects
If you become a client, I use your information to provide the services you've purchased, communicate with you, manage your project, administer our agreement and deliver the work.
My lawful basis is performance of a contract.

To process payments and maintain financial records
I use relevant information to issue invoices, record payments, manage my accounts and comply with tax, accounting and other legal obligations.
My lawful bases are performance of a contract and, where applicable, compliance with a legal obligation.

To operate and protect my business
I may use relevant information where reasonably necessary to administer my business, maintain records, establish or defend legal claims, prevent misuse or fraud, and keep my website, accounts and systems secure.
My lawful basis is legitimate interests.
My legitimate interests are running and protecting a sustainable business, maintaining appropriate business records and protecting my systems, business and legal rights.

To understand and improve my website
If you choose to allow Google Analytics, I use analytics information to understand how visitors find and use my website and to improve its content and performance.
My lawful basis for this processing is consent.
You can withdraw your analytics consent at any time through Cookie Settings in the website footer.

To send marketing emails
If you choose to join my email list, I use your information to send emails about my business, services, content, resources and other relevant updates.
Where required, I rely on your consent to send this marketing.
You can unsubscribe at any time using the unsubscribe link included in my marketing emails.
Withdrawing your consent does not affect the lawfulness of processing carried out before you withdrew it.
I may also send service-related or transactional communications to clients where those messages are necessary to manage our working relationship. These are not optional marketing communications simply because they are sent by email.

Who I share your information with
I don't sell your personal information.
I use trusted service providers to help operate my business. Depending on how you interact with me, these may include:
Showit — website hosting and website functionality.
Dubsado — enquiries, client relationship management, questionnaires, proposals, contracts, invoicing and project administration.
Flodesk — email marketing, subscriber management and delivery of free resources.
Google Workspace — business email, documents and file storage.
Google Analytics — optional website analytics, where you have consented.
PayPal and Square — payment processing where those payment methods are used.
I may also disclose personal information where reasonably necessary to professional advisers such as accountants, legal advisers or insurers, or where I am required to do so by law, regulation, court order or another lawful authority.
These organisations may act as processors on my behalf or, in some circumstances, as independent controllers of information they receive.
International transfers
Some of the service providers I use operate internationally, which means your personal information may be processed or stored outside the UK, including in the United States.
Where personal information is transferred to a country that is not covered by UK adequacy regulations, I use service providers that put appropriate safeguards in place as required by UK data protection law.
Depending on the provider and circumstances, these safeguards may include the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, approved Standard Contractual Clauses or other legally recognised transfer mechanisms.
For example, providers I use including Google, Flodesk, Dubsado, PayPal and Square maintain data-protection arrangements for international transfers. The precise mechanism can vary depending on the service, recipient and country involved.
You can contact me at [email protected] if you would like further information about the safeguards relevant to your personal information.

How long I keep your information
I keep personal information only for as long as reasonably necessary for the purpose for which it was collected, including meeting legal, tax and accounting requirements, resolving disputes and establishing or defending legal claims.
Enquiries that don't become client projects are generally kept only for as long as reasonably necessary to respond to your enquiry, follow up appropriately and maintain reasonable business records.
Client and project records may be retained after our work together ends where they are reasonably required for contractual, business-record, legal or professional purposes.
Financial, payment and tax records are generally retained for at least the period required by HM Revenue & Customs (HMRC). As a self-employed sole trader, I am normally required to keep relevant business records for at least five years after the 31 January Self Assessment submission deadline for the relevant tax year. Records may need to be kept for longer in some circumstances.
Email marketing information is retained while you remain subscribed. If you unsubscribe, I may retain limited information necessary to record and respect your opt-out preference.
Analytics information is retained according to the retention settings applied within Google Analytics.
Where there is no fixed retention period, I consider the nature and sensitivity of the information, why it was collected, whether I still need it, applicable legal or contractual requirements and the potential risks of retaining it.

How I protect your information
I take reasonable technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.
This includes using reputable service providers and password-protected systems and limiting access to personal information to where it is needed for legitimate business purposes.
However, no internet-based system or method of electronic storage can be guaranteed to be completely secure.

Your data protection rights
Depending on the circumstances and the lawful basis being used, UK data protection law may give you rights including:
The right of access — to ask for a copy of personal information I hold about you.
The right to rectification — to ask me to correct inaccurate or incomplete information.
The right to erasure — to ask me to delete your personal information in certain circumstances.
The right to restrict processing — to ask me to restrict how I use your information in certain circumstances.
The right to data portability — to receive certain information in a portable format or have it transferred to another organisation where this right applies.
The right to withdraw consent — where I rely on consent, you can withdraw it at any time.
Rights relating to automated decision-making — where applicable.
Not every right applies in every situation.

Your right to object
Where I process your personal information on the basis of legitimate interests, you have the right to object to that processing in certain circumstances.
You also have the right to object at any time to the use of your personal information for direct marketing.
If you would like to exercise any of your data protection rights, contact me at [email protected].
I may need to verify your identity before responding to a request.

Automated decision-making
I do not currently use personal information to make decisions based solely on automated processing that produce legal or similarly significant effects on you.

Links and third-party websites
My website may contain links to other websites or services, including social media platforms.
If you follow a link to another website, that organisation's own privacy practices and policies apply. I am not responsible for how independent third-party websites process your information.

Children's privacy
My services are intended for businesses and adult clients and are not directed at children.
I do not knowingly collect personal information from children through this website for the purpose of providing my services.

Changes to this Privacy Policy
I may update this Privacy Policy when my business, website, service providers or legal obligations change.
The current version will be published on this page with its latest update date.
If I begin using personal information for a new purpose, I will update the relevant privacy information and, where required, bring the change to your attention before beginning that processing.

How to contact me
If you have questions about this Privacy Policy, how I use your personal information or would like to exercise a data protection right, contact:
Rosie Casson trading as Rosebud Casson
 Email: [email protected]
 Website: rosebudcasson.com

How to complain
If you have a concern about how I use your personal information, please contact me so I have an opportunity to address it.
You also have the right to make a complaint to the Information Commissioner's Office (ICO), the UK's data protection regulator.
Make a data protection complaint to the ICO
You do not have to contact me before making a complaint to the ICO.