Privacy and cookies | Grace George

Last updated: 28 September 2026

Who we are

This website belongs to Grace George, a singer-songwriter and live-looping performer based in Hertfordshire, who works as a sole trader. In this notice, “we”, “us” and “our” mean Grace George.

We are the controller of the personal data described here. That means we decide how it is used, and we are responsible for looking after it.

If you have a question about this notice or about your data, please get in touch through the booking form and say that your message is about privacy.

What we collect

We only collect what you choose to send us, plus the basic records every website keeps.

Booking enquiries. Your name, email address, phone number if you give one, the type of event, the event date, the venue and town, the approximate number of guests, the set you would like, how you heard about Grace, anything you write in your message, and your agreement to us using these details to reply.
Newsletter sign-ups. Your email address, your first name if you give it, a record of your consent (when you signed up and the wording you agreed to), and which part of the website you signed up from.
Form records. When you send a form, the website also records the date and time, the page you sent it from, your IP address and the type of browser you used. This helps us spot spam and misuse.
Server logs. Like almost every website, our web server keeps standard logs of each visit: your IP address, the page requested, the date and time, and the browser and device type your browser reports.

We do not ask for sensitive information, such as health details, and we ask you not to include any in your message.

Why we use it

UK data protection law asks us to name a lawful basis for each use of your data.

To answer your enquiry and plan your event. Our lawful basis is taking steps at your request before entering into a contract with you. If no booking follows, it is our legitimate interest in replying to messages people send us.
To send you the newsletter. News about releases, music videos and shows. Our lawful basis is your consent. You can withdraw it at any time with the unsubscribe link in every email, or by contacting us. Withdrawing consent does not affect emails sent before you did.
To keep the website secure and working. Server logs and form records help us fix problems and block spam. Our lawful basis is our legitimate interest in running a safe website.

We never sell your data. We do not use it for advertising, and we make no automated decisions about you.

Where it is stored and who can see it

Booking enquiries and newsletter sign-ups are stored in this website’s database, on our web hosting provider’s servers. Only Grace and the people who help her run the website can see them.

Each enquiry is also sent by email to Grace’s booking inbox so that she can reply to you.

We have not yet chosen an email provider for the newsletter. Once we do, your sign-up will be passed to that provider so it can send the emails, and we will name it on this page. If it stores data outside the UK, we will make sure the transfer has the safeguards UK law requires.

We do not share your data with anyone else unless the law requires us to.

How long we keep it

Booking enquiries. Twelve months after our last contact with you, then we delete them. If you book, we keep the booking records we need for tax and accounting for as long as the law requires.
Newsletter sign-ups. Until you unsubscribe or ask us to remove you. After you unsubscribe, we may keep your email address on a do-not-contact list so that you are not added again by mistake.
Server logs. A short period for security and troubleshooting, after which they are deleted automatically.

Your rights

Under UK data protection law (the UK GDPR and the Data Protection Act 2018) you have the right to:

know how your data is used, which is what this notice is for
get a copy of the data we hold about you
have anything inaccurate corrected
have your data deleted
ask us to limit how we use your data, or object to it
receive your data in a format you can take elsewhere, where that applies
withdraw your consent at any time, where we rely on it

To use any of these rights, contact us through the booking form. We will reply within one month, and there is normally no charge.

Complaints

If you are unhappy with how we have handled your data, please tell us first so that we can put it right.

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk.

Visitors from the EU and EEA

Grace is based in the UK, but her music, newsletter and bookings reach people across Europe. If you live in the European Union or the European Economic Area, the EU General Data Protection Regulation (EU GDPR) also protects your data when we send you the newsletter or answer your enquiry.

The same details, for the same reasons. We collect exactly what this notice describes above, on the same lawful bases: your consent for the newsletter, and the steps you ask us to take before a booking for enquiries.
Your rights under the EU GDPR. You can ask to see, correct or delete your data, to restrict or object to how we use it, and to receive it in a portable format. You can withdraw your newsletter consent at any time, without affecting anything we did before. Use the booking form to ask, or the unsubscribe link in any newsletter.
Where your data goes. Your details come to us in the UK and are held by our web hosting provider. When data moves from the EU to the UK, we rely on the protections EU law provides, such as the European Commission's adequacy decision for the UK while it is in force.
Complaints. You can complain to the data protection authority in the EU or EEA country where you live or work, as well as to the UK's ICO.

Cookies

Cookies are small files a website stores in your browser.

Visitors get no cookies. Browsing this website does not set any cookies. The only cookies it uses are the essential ones WordPress sets when someone logs in to manage the site.
No analytics, for now. We do not measure visits with analytics tools. If we add them, we will update this page first and ask for your consent where the law requires it, under the Privacy and Electronic Communications Regulations (PECR).
No embedded content. The site does not load videos, music players or social media feeds from other companies, and its fonts are served from this website. Viewing a page does not send your details to anyone else.
Links to other sites. Links to Spotify, YouTube, Instagram and other services open those sites, which have their own privacy and cookie policies.

Changes to this notice

We will update this page whenever something changes, for example when we choose a newsletter provider or add analytics, and change the date at the top.