Privacy policy

I’m Becca Anderson. Poppy’s Playbook is a name I use for my domain and LinkedIn presence; it is not a separate legal entity. The data controller is Anderson Rebeka Dóra egyéni vállalkozó, a Hungarian sole trader, registration number 62683834. My registered business address is 1139 Budapest, Petneházy utca 37-47. 7/73, Hungary.

For privacy questions or requests, email becca@poppysplaybook.com, or write to that address. More business details are in the Terms & conditions.

This notice covers visitors, people who enquire or book calls, business contacts and people whose recommendations appear on the site. If a client asks me to handle their customers’ or community members’ data on their behalf, that work is covered by our agreement and the client’s privacy information.

• Enquiries: your name, email, business name, optional website, the support you need, your situation and desired outcome, budget and budget type, preferred timing, and any confirmation of the Embedded support minimum. Netlify also handles submission and spam-prevention data, which can include your IP address.
• Emails and calls: your contact details, the messages or information you choose to share, and correspondence about your enquiry or project.
• Bookings: information you enter into Calendly, such as your name, email, appointment details and answers to any booking questions. I receive the details needed to arrange the call.
• Client administration: contact and billing details, agreed work, invoices, payment records and relevant project correspondence if we work together. The website does not collect payment-card details.
• Website requests: hosting servers receive technical information such as your IP address, requested page, time, browser information and referring page where your browser supplies it.
• Professional recommendations: names, roles, photographs, LinkedIn profile links and recommendation text shown on the site are supplied directly by contributors or come from professional recommendations and profile information on LinkedIn.

Most information comes directly from you. I may also review the business website you share to understand your enquiry. Please only send information you are entitled to share, and leave out passwords, sensitive personal information and identifiable customer records from the initial enquiry.

You can browse without sending an enquiry. Sending one is voluntary, but the form needs the fields it asks you to complete so I can understand and answer it. The website field is optional. If you prefer not to use the form or Calendly, you can email me instead. Without enough contact information or context, I may not be able to respond or assess the work.

Billing information may be required by law if we work together. I will explain what is needed at that stage.

• Considering work and delivering it: where you would be my client personally, including as a sole trader, I use necessary information to take steps you request before a contract and to perform that contract.
• Communicating with someone acting for a business: I rely on my legitimate interests in answering enquiries, arranging calls, preparing proposals and managing client relationships. This also covers relevant business context needed to understand an enquiry.
• Operating the site: my legitimate interests are keeping it available, preventing spam and misuse and fixing errors. This includes hosting and delivering the site’s locally stored fonts.
• Understanding site traffic: I rely on my legitimate interest in understanding which pages people find useful and identifying missing pages through Netlify’s server-based reports. I use traffic summaries, without advertising profiles or linking visits to enquiry records.
• Showing professional recommendations: my legitimate interest is explaining my experience using relevant recommendation text and professional context, subject to your rights and reasonable expectations. This does not override copyright or image rights. Public availability on LinkedIn is not treated as permission to reuse a profile photograph; that requires separate permission. You can ask me to correct or remove information concerning you.
• Accounting and tax: I keep the records required to meet my legal obligations.
• Handling disputes and privacy requests: I use necessary information to meet legal obligations and, where relevant, for my legitimate interest in establishing or defending legal claims.

Legitimate interests must be balanced against your rights, and you can object as explained below. An enquiry is not consent to marketing. Where I rely on your consent, including for permitted profile-photo publication, you can withdraw it at any time by emailing me. Withdrawal does not affect earlier lawful use. If I introduce another optional activity that requires consent, I will ask separately.

Netlify Web Analytics produces reports from hosting server logs. These include page views, popular pages, referring sources, broad visitor locations and missing pages. Its visitor counts use IP addresses to distinguish requests within the reporting period. It does not add an analytics script or analytics cookies to your browser. I use the reports to understand site traffic and fix problems, not to build advertising profiles or match browsing activity to enquiry records.

Web Analytics is enabled for this website. It works on Netlify’s servers rather than through a browser tracker, so blocking cookies does not turn these reports off. This policy explains the processing; reading it or continuing to browse is not treated as consent. Your right to object is explained below.

Google Search Console shows me search-performance and indexing reports, including clicks, impressions and search queries reported by Google, grouped by things such as page, country and device. These are reports about the site’s appearance in Google, not a list of named visitors. I do not use Google Analytics on this site.

• Netlify: hosts the site, processes and stores form submissions, filters spam and provides Web Analytics. See its privacy notice and data processing agreement.
• Google Workspace: my business mailbox uses Gmail within Google Workspace. Google processes email content and any form notifications sent to this mailbox on my behalf under its Cloud Data Processing Addendum. This is separate from Google’s handling of information for its own service-administration purposes.
• Google Search Console: provides search-performance reports. This service has its own applicable terms; it is not covered simply by having a Workspace mailbox. See Google’s privacy policy.
• Calendly: handles information submitted on my booking page to arrange calls. For that booking information, I remain responsible as controller and Calendly provides processing services. Calendly also handles some information for its own purposes, described in its privacy notice.

Spaceship supplies the domain registration and related domain services. It is not used as the enquiry form or email mailbox provider: those services are provided by Netlify and Google Workspace respectively.

Information may also need to be shared with professional advisers or authorities to meet legal obligations or deal with a dispute, limited to what is needed. Service providers can use their own authorised providers. Their role depends on the service: some information is processed on my behalf, while information they use for their own purposes is covered by their own privacy notices. I do not sell personal information.

All fonts, including Fraunces and Instrument Sans, are stored with this website and delivered by its host. Your browser does not contact Google Fonts to display these pages.

The site uses your browser’s session storage to remember scroll positions when you move between pages. This supports navigation, is kept for the browsing session in that tab, and is not used for analytics or advertising.

This site does not use advertising pixels or analytics cookies. Cookie-free analytics still involves processing technical information, as explained above. Calendly and social-media links take you to separate websites; their cookies and data practices apply when you visit them. There is no embedded Calendly booking widget on this site.

Some providers, including Netlify, Google and Calendly, process information in the United States and other countries outside the European Economic Area. Protection under local law may differ. Depending on the provider and service, safeguards include the European Commission’s standard contractual clauses or an applicable adequacy decision, including the EU-US Data Privacy Framework for covered transfers to certified organisations. Relevant UK safeguards apply where required.

Netlify’s data processing agreement and Calendly’s data processing addendum explain their arrangements. Google Workspace’s Cloud Data Processing Addendum sets out safeguards for business email. Google also explains its international transfer frameworks. You can email me for information about the safeguards relevant to your data and how to obtain a copy.

• Enquiries and introductory bookings that do not become paid work: no longer than 12 months after our last contact, including relevant form submissions and email copies I control. I delete them sooner when they are no longer needed or an applicable deletion rule requires it. Particular records may need to be kept for a legal obligation or an active dispute.
• Client work: I keep the information needed while the work continues. Afterwards, essential contract and delivery records are retained only for outstanding obligations or legal claims. The ordinary Hungarian limitation period for a claim is five years from when it becomes due; an interruption, suspension, different applicable rule or ongoing dispute can change that period. Unneeded working copies are deleted sooner.
• Invoices and tax records: under sections 78 and 202 of Hungary’s Act CL of 2017, records supporting tax obligations are generally retained until the assessment period expires: normally five years from the end of the calendar year in which the relevant return, notification or payment was due. A specific rule can require longer, including ten years for records covered by section 78(6a) concerning income or assets within a double-taxation treaty. Any applicable extension or other mandatory retention rule takes precedence.
• Website reports: Netlify’s standard Web Analytics dashboard shows the last 30 days. This reporting window is not a promise that every underlying security log or provider backup is deleted after 30 days. Provider-controlled logs and backups follow the relevant service’s retention arrangements.
• Professional recommendations: while relevant to my work, subject to your rights, correction or removal requests and any agreed permission period. A photograph used on consent is removed from publication if that consent is withdrawn; only a necessary record of the permission and withdrawal may be retained to demonstrate compliance or deal with a claim.

Deletion from my active accounts can be followed by the provider’s documented deletion and backup cycle; it does not mean every backup disappears immediately. Providers may retain information they control independently under their own policies. If I need to keep a particular record longer, I limit its use to the reason it is being retained.

Depending on the circumstances, you can ask to access your personal information, correct it, delete it, restrict its use, or receive it in a portable format. You can object to processing based on legitimate interests for reasons relating to your situation. These rights have conditions and exceptions; for example, I may need to retain an invoice even if you ask me to delete an enquiry.

Email becca@poppysplaybook.com to make a request. I normally respond within one month and do not charge a fee. If a legally permitted extension is needed because of the complexity or number of requests, I will explain why within that first month; the extension can be up to two additional months. I may ask for proportionate information to verify your identity.

You can complain directly to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), or another competent supervisory authority, including in the EU country where you live or work or where you believe an infringement occurred. Where UK data protection law applies, you can contact the Information Commissioner’s Office. You do not have to contact me first.

NAIH’s postal address is 1363 Budapest, Pf. 9., Hungary; its office is at 1055 Budapest, Falk Miksa utca 9-11., Hungary. For formal submission options, use its official case-submission guidance. You also have the right to seek a judicial remedy under applicable data protection law.

The form checks required answers and uses spam prevention. I do not use your information to make decisions based solely on automated processing that have legal or similarly significant effects on you. If the form prevents you from sending an enquiry, email me instead.

I use and share information for the purposes described in this notice. Please use the enquiry form for an initial outline; we can agree a suitable way to share more detailed project information if needed.

I will update this notice if the services I use or the way I handle information changes. The date at the top shows the latest update. If I intend to use your information for a new purpose, I will provide the relevant information before doing so and obtain consent where it is required.