Privacy notice.

Who I am

This website and my events work are run by Thomas Rhys Morris, trading as Rhys Morris, an event host and MC based in Essex, UK. I am the controller of the personal data described here. Contact me about anything in this notice at hello@rhysmorris.com or on 07977 611665.

TRM Flex Limited is a separate company with its own privacy notice at trmflex.com. This notice covers my hosting, MC and events work only.

What I collect and why

Enquiries. When you use the enquiry form, email or call me, I collect what you send: usually your name, email, phone, organisation, event details and budget. I use it to reply, quote and, if you book, to plan and deliver the event. Lawful basis: taking steps at your request before entering a contract, and performing that contract (UK GDPR Article 6(1)(b)).

Bookings and invoices. For confirmed work I keep the booking, event details, the on-site contact and invoice records. Lawful basis: contract (Article 6(1)(b)) and my legal obligation to keep financial records (Article 6(1)(c)).

Business contacts. I keep work contact details of people at agencies, venues, event organisers and other businesses I work with or would like to work with. These come from you directly, from your organisation's website or other public business sources, or from an introduction. I use them to introduce my services and keep in touch about work. Lawful basis: my legitimate interests in running and growing my business (Article 6(1)(f)). Business email of this kind is sent in line with the Privacy and Electronic Communications Regulations, and you can always tell me to stop. If you do, I will, and I will keep only a note that you opted out so you are not contacted again.

Website use. I use Google Analytics without cookies: it sets nothing on your device that lasts beyond your visit, IP addresses are anonymised and advertising features are switched off. A random visit number and the page you arrived on are held in your browser tab only while it is open (sessionStorage), so I can see which pages are visited, how people find the site, and whether enquiries were sent. If you send an enquiry, the form also includes the page you arrived on and the website that referred you, so I know how you found me. Lawful basis: legitimate interests in understanding and improving the site (Article 6(1)(f)). Switch off analytics on this device. Videos load from YouTube's privacy-enhanced (no-cookie) domain only when you press play. If you book a call, Calendly processes the details you enter.

I do not sell personal data, and I do not use it for automated decision-making or profiling. I do not ask for special category data; if you choose to tell me something sensitive (for example access needs for an event), I use it only to meet that need.

Who processes data for me

I use carefully chosen service providers who act on my instructions under data-processing terms:

• Netlify: hosts this website and receives enquiry form submissions.
• Supabase: my private, encrypted client and booking system, hosted in London (UK).
• Microsoft 365: my email.
• Google: website analytics, as described above.
• Calendly: call booking, if you use it.

Some of these providers are based in, or may access data from, the United States. Where personal data leaves the UK it is protected by UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or the UK International Data Transfer Addendum.

How long I keep it

• Enquiries and business contacts with no ongoing work: deleted automatically after 24 months without any contact.
• Clients with booked and invoiced work: booking and financial records kept for 6 years, as HMRC requires, then deleted.
• Copies of form submissions held by my website host: deleted regularly, and within 90 days.

How I protect it

My client system is encrypted, hosted in the UK, accessible only to me, and protected by two-factor or passkey sign-in. Every change is recorded in an audit log, and I review sign-ins regularly.

Your rights

You can ask me to: give you a copy of the personal data I hold about you; correct it; delete it; restrict how I use it; object to my using it (including an absolute right to object to direct marketing); or transfer it to you or another organisation. Email hello@rhysmorris.com. I will respond within one month and there is normally no charge.

If you are unhappy with how I have handled your data, please tell me first so I can put it right. You also have the right to complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint or 0303 123 1113.

Changes

I will update this notice if how I use personal data changes. The date at the top shows the latest version.