Privacy policy.
The SideKick Co. customer privacy notice
The SideKick Co. is the trading name of Grainne Dunne Limited (“we”, “us” and “our”). This privacy notice explains how we collect and use your personal information when you contact us, visit our website or use our services. Grainne Dunne Limited is responsible for the personal information we handle for these purposes. Registered in England and Wales, company number 16853829. ICO registration number: ZC166940. Registered office: 95a Lavender Hill, Tonbridge, Kent, England, TN9 2AX.
· What information we collect, use, and why
· Lawful bases and data protection rights
· Where we get personal information from
· How long we keep information
Contact details
What information we collect, use, and why
We collect or use the following information to provide and improve products and services for clients:
· Names and contact details
· Addresses
· Occupation
· Payment details (including card or bank information for transfers and direct debits)
· Transaction data (including details about payments to and from you and details of products and services you have purchased)
· Usage data (including information about how you interact with and use our website, products and services)
· Video recordings
· Audio recordings (eg calls)
· Records of meetings and decisions
· Website user information
We collect or use the following personal information for the operation of client or customer accounts:
· Names and contact details
· Purchase or service history
· Account information, including registration details
· Marketing preferences
We collect or use the following personal information for information updates or marketing purposes:
· Names and contact details
· Marketing preferences
· Purchase or account history
· Website and app user journey information
Lawful bases and data protection rights
Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.
Which lawful basis we rely on may affect your data protection rights which are in brief set out below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:
· Your right of access - You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. You can read more about this right here.
· Your right to rectification - You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. You can read more about this right here.
· Your right to erasure - You have the right to ask us to delete your personal information. You can read more about this right here.
· Your right to restriction of processing - You have the right to ask us to limit how we can use your personal information. You can read more about this right here.
· Your right to object to processing - You have the right to object to the processing of your personal data. You can read more about this right here.
· Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. You can read more about this right here.
· Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time. You can read more about this right here.
If you make a request, we must respond to you without undue delay and in any event within one month.
To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.
Our lawful bases for the collection and use of your data
Our lawful bases for collecting or using personal information to provide and improve products and services for clients are:
· Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
· Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
Our lawful bases for collecting or using personal information for the operation of client or customer accounts are:
· Consent - we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.
· Contract – we have to collect or use the information so we can enter into or carry out a contract with you. All of your data protection rights may apply except the right to object.
We send newsletters and promotional emails on the basis of your consent when you actively subscribe. You can withdraw consent at any time using the unsubscribe option or by emailing grainne@thesidekickco.co.uk. Withdrawal does not affect processing that took place before you withdrew consent.
We retain accounting and tax information where necessary to comply with our legal obligations.
With participants’ permission, we use Fathom and Granola to capture meeting content and produce transcripts, notes and summaries for our work together. Fathom can retain recordings; Granola processes meeting audio to produce transcripts and notes rather than storing an audio recording. We explain the purpose before starting and rely on consent for this recording and transcription. You can decline or withdraw permission by telling us.
Where we get personal information from
· Directly from you
Who we share information with
Our UK-based accountant and UK-based freelancers may access client information under contract where it is needed for their work. We also use service providers to support our business, including Xero for accounting, Microsoft 365 for business communications and documents, Kirmada for managing client workspaces, Squarespace for website hosting and analytics, Mailchimp for newsletters and subscriber management, and Granola and Fathom for meeting transcription, notes and, where applicable, recordings. Access is to be limited to information needed for the relevant service.
Overseas processing
Some of our service providers process personal information outside the UK, including in the United States. Mailchimp processes subscriber information in the US, and Granola stores meeting notes and transcripts there. Provider data-processing terms set out the safeguards for relevant transfers, including standard contractual clauses with the UK Addendum where applicable. You can contact us for information about the safeguards relevant to your data. Further details are available in Mailchimp’s data-processing terms, Granola’s data-processing terms and Fathom’s data-processing terms.
Website analytics and cookies
Our website is hosted by Squarespace and uses Squarespace Analytics to report on visits, traffic sources and how the site is used. This can involve technical and usage information, such as browser and device information, pages visited, referring websites and IP addresses. Squarespace uses essential cookies for website functionality and analytics cookies to measure visitor activity. Optional analytics cookies are restricted until you consent. Use Accept all, Decline all or Manage cookies in the banner to choose. You can change or withdraw your choice at any time using the Cookie Preferences button. We rely on consent for optional analytics cookies and the associated personal information. Essential cookies remain enabled to support core website functions. You can also manage or delete cookies through your browser settings; blocking essential cookies may affect website functionality. For cookie names, purposes and durations, see Squarespace’s cookie information.
Information we handle for clients
When we handle personal information on a client’s behalf, such as information about their customers or contacts, the client generally determines why and how that information is used. Our policy is to handle it only for the agreed services and in accordance with the client’s documented instructions and applicable data protection requirements. Requests concerning that information should normally be directed to the relevant client; we will assist them as required.
How long we keep information
Our retention policy, adopted on 10 October 2026, sets the following periods:
Enquiries that do not become client work: up to 12 months after the last meaningful contact.
Core client contracts and records needed to establish what was agreed or resolve disputes: six years after the engagement ends.
Routine project working files: up to 12 months after completion, unless the client contract requires earlier return or deletion.
Accounting and tax records: six years from the end of the last company financial year they relate to, or longer where legally required.
Call and meeting recordings and full transcripts: up to 90 days after the meeting, unless a different period is specifically agreed with participants for an ongoing purpose. Brief notes needed for the client work follow the relevant client-record retention period.
Mailing-list information: while you remain subscribed. We retain only the minimum information needed to record an opt-out and prevent further marketing for as long as that remains necessary.
Personal information handled solely on a client’s behalf: returned or deleted in accordance with the client’s instructions and our contract; our default is within 30 days of the engagement ending.
We review records quarterly for deletion or anonymisation. Relevant records may be retained longer where required by law or needed for an active complaint or legal claim, with access restricted. Backup copies are subject to the relevant provider’s deletion cycle and must not be returned to ordinary use after deletion. This schedule also applies to existing records.
How to complain
If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice.
If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint
Last updated
10 October 2026