Privacy Policy

Who is responsible for your data

The data controller for this website is Helena B. Scott, an independent sole trader established in Ireland. Privacy questions and requests may be submitted through the contact page. Please write “Privacy Request” in the subject line so that the request can be identified promptly.

Information collected

Depending on how you use the website, the following information may be collected:

• account details, such as your name, email address, user identifier and account status;
• newsletter details, including your email address, subscription status, signup source, consent wording and consent date;
• contact and enquiry details, including your name, email address, optional organisation, country, telephone number, proposed date, enquiry type and the message you choose to send;
• order, entitlement and resource-access records, including order reference, items, amount, payment status and content access;
• information needed to arrange consultations, lectures, research commissions or other requested services; and
• limited technical and preference data used to operate the site, accounts, cart, language, text-size and reduced-motion settings.

Please do not send medical records, identity documents or other highly sensitive material through the general contact form. If sensitive information is genuinely required for a requested service, the purpose and appropriate safeguards will be discussed separately.

Why information is used

Personal data is used only where there is a lawful basis:

• Contract or steps requested before a contract: to provide accounts, resources, orders, bookings, consultations, commissions and customer support.
• Consent: to send the research newsletter and, where required, to process information you have deliberately supplied for a particular purpose.
• Legitimate interests: to answer enquiries, protect the website, prevent misuse, maintain records and improve the operation of the service, provided those interests do not override your rights.
• Legal obligation: to keep tax, accounting, consumer and transaction records or respond to a lawful request.

Newsletter & direct marketing

The Helena B. Scott research newsletter is an independent website mailing list and is separate from Substack. Subscription is voluntary and requires an affirmative signup. The website records the wording shown at signup and the time of consent. Newsletter consent is not required to create an account, submit an enquiry, make a purchase or obtain a resource presented as a standalone free resource.

A selected resource may occasionally be offered expressly as a newsletter welcome gift. Where that is the offer, the signup page will state clearly, before submission, that the person is joining the newsletter and will receive the resource as part of that subscription. Newsletter consent is not inferred from an account, enquiry, order, resource request or unticked box.

Every newsletter will provide a way to unsubscribe. You may also withdraw consent through the contact page. Withdrawal is as easy as signup, does not affect processing already carried out lawfully and does not revoke a copy of a welcome gift already downloaded. After an unsubscribe request, a minimal suppression record may be retained so that the address is not added again by mistake.

Accounts, resources, orders & payments

Account and private-library information is used to authenticate users and keep purchased or claimed material available to the correct person. Order records are used for fulfilment, access, refunds, support, accounting and legal compliance.

Secure card payments are not currently active. If Stripe checkout is enabled, Stripe will process payment-card data under its own privacy terms. This website will receive transaction and fulfilment information but will not store full card details.

Contact forms & service enquiries

Information submitted through a contact form is transmitted through the website platform and email-delivery service to Helena so that the enquiry can be reviewed and answered. It is not automatically added to the newsletter. Information supplied for a consultation or professional commission is used to assess, arrange and deliver that requested service.

Cookies, local storage & embedded media

The website uses strictly necessary session technologies for authentication and secure access. It also stores functional preferences on your device, including language, text size, reduced motion, cart contents and whether an opening sequence or protected preview has already been seen. These settings can be removed by clearing site data in your browser.

Google Analytics is used with Google’s Advanced Consent Mode to understand how visitors find and use the website, including page views, traffic sources, approximate geography, device and browser information, and engagement with site content. Analytics storage is denied by default. If a visitor declines analytics, Google Analytics cookies remain disabled and Google may receive limited cookieless measurement signals for aggregate measurement and modelling. If the visitor chooses to allow analytics, analytics storage is enabled. Google Analytics is not used here for advertising, remarketing or personalised ads. The visitor’s choice is stored locally on the device and can be changed later through “Analytics Settings” in the site footer.

Embedded videos use YouTube’s privacy-enhanced domain; loading or playing an embedded video may nevertheless allow YouTube to receive technical information under its own terms.

Who receives information

Information is shared only where needed with service providers acting for, or independently providing a service to, Helena. These may include Base44 for website hosting, authentication and database services; Google Analytics for consent-aware aggregate website measurement, including limited cookieless signals where analytics storage is denied; an email-delivery provider for contact messages and future newsletters; Stripe if payments are activated; and professional advisers where reasonably necessary. Patreon, Substack, YouTube and social-media sites are separate services: data is shared with them only when you choose to follow an external link or use their content.

Personal data is not sold. If a provider processes information outside the European Economic Area, legally recognised safeguards are used where required, such as an adequacy decision or approved contractual protections.

How long information is kept

• newsletter records are kept while you remain subscribed; after unsubscribe, only information reasonably needed to demonstrate consent and honour the opt-out is retained;
• ordinary enquiries are normally reviewed for deletion within two years after the last meaningful correspondence, unless they develop into a contract, dispute or continuing professional relationship;
• account and library records are kept while the account or access remains active and are periodically reviewed when no longer needed;
• order, invoice and accounting records may be retained for at least six years where Irish tax or legal obligations require it; and
• device preferences remain on your device until you clear them.

Longer retention may be necessary for a legal claim, safeguarding concern, regulatory requirement or continuing contract. Data that is no longer needed is deleted or anonymised where reasonably practicable.

Your data-protection rights

Subject to the conditions in data-protection law, you may request access to your data, correction, deletion, restriction, portability or objection to processing. Where processing relies on consent, you may withdraw that consent at any time. You may also ask for an explanation of how a decision affecting you was made.

This website does not use solely automated decision-making that produces legal or similarly significant effects. Administrative tools or AI-assisted systems may support future workflows, but responsibility for substantive editorial, professional and customer decisions remains human.

To exercise a right, use the contact page. Reasonable identity verification may be requested before disclosing personal data. You also have the right to complain to the Data Protection Commission, Ireland’s supervisory authority.

Children

The website, newsletter, store and private services are not directed to children under 16. Personal data is not knowingly collected from a child under 16 through these services without the authorisation required by Irish law. A parent or guardian who believes a child has submitted information should make contact so it can be reviewed.

Security & changes to this policy

Reasonable technical and organisational measures are used to protect personal data, including access controls and restricted administrative records. No internet service can guarantee absolute security. Please use a strong, unique password and do not share private-library access.

This policy may be updated when services, providers or legal requirements change. Material changes will be identified on this page. If a new use would require consent, it will not be assumed from an older consent.