Website & Enquiries Privacy Notice

Version: 9 June 2026

William Smith EI, 8 bis Rue Abel, 75012 Paris, France | SIRET 847 789 195 00033 | [email protected] | +44 (0)7394 421 596 / +33 (0)6 95 04 05 95 | BACP 375157

1. Who I am

I'm the data controller for the personal information described here. That means I'm responsible for deciding how and why your data is used, under the EU General Data Protection Regulation (and UK GDPR where it applies).

2. What this Notice covers

This Notice covers personal data collected when you browse queer-sex.com, join the waitlist, or make an initial enquiry — in other words, everything up to the point where we agree to work together.

Should you become a client, a separate, fuller Sex & Relationship Therapy Services Privacy Policy will apply, and the information you gave me at this stage will roll into your client record under that policy.

3. What I collect, why, on what basis, and how long I keep it

I collect only what's necessary. The lawful bases below come from Article 6 of the GDPR (and, for any sensitive data, Article 9).

A. Browsing the website

• What I collect: Technical information your browser sends automatically — IP address, device and browser type, the pages you visit, and the date and time. The site is hosted on Cloudflare Pages and served through Cloudflare's network, which also processes this data to keep the site available and protect it from attacks.
• Why: To deliver the website, keep it secure, and diagnose technical problems.
• Legal basis: Article 6(1)(f) — my legitimate interest in running a secure, working website.
• How long: Server and security logs are short-lived and kept only as long as needed for security and troubleshooting, then overwritten.

B. Cookies and analytics

This site sets no tracking cookies and uses no tracking pixels.

C. Joining the waitlist and enquiries

• What I collect: Your name, email, phone number, anything you write in your message, and — if you join the waitlist — the fact that you'd like to be told when the service opens.
• Why: To add you to the waitlist and notify you when the service opens, to respond to enquiries, and to judge together whether we're likely to be a good fit when the time comes.
• Legal basis: Article 6(1)(b) — steps taken at your request before entering into a contract; and, for waitlist notifications you've asked for, Article 6(1)(a) — your consent (you can ask to be removed at any time).
• Sensitive information: Given the nature of this service, you may choose to share details about your health, sexuality, relationships or circumstances. Please keep your first message brief — there's no need to explain everything up front, and email isn't a secure channel. If you do share such details, you're explicitly consenting to my holding them in order to respond, under Article 9(2)(a). I keep them to the minimum needed and don't ask for more at this stage.
• How long: Waitlist details are kept until the service opens and you've decided whether to proceed, or until you ask to be removed — whichever comes first. Enquiries that don't lead to an engagement are deleted after 12 months. If you become a client, your information rolls into your client record under the future service policy.

4. Where your information is held

Enquiry and waitlist data sits on the cloud services named in section 6, not on any clinical storage. My email and any documents are held on my Microsoft 365 Business tenant, whose main components are committed to French data residency; some adjacent components operate across the EU/EFTA region.

5. How I look after your information, and a note on email

I take reasonable technical and organisational steps to protect your data — including multi-factor authentication on my accounts, access controls, encryption in transit where supported, and regular updates. I can't promise anything is 100% secure — no one honestly can — but I do my best to make it hard for things to go wrong.

Email and messaging in particular can't be guaranteed secure. By contacting me through these channels you accept their inherent risks, which is why I suggest keeping enquiries brief and saving anything sensitive for a session, once the service is open and we've begun.

If a personal-data breach is likely to put your rights and freedoms at risk, I'll assess the impact and notify the relevant supervisory authority within 72 hours where required (GDPR Article 33). If the breach is likely to put your rights and freedoms at high risk, I'll inform you without undue delay (Article 34).

6. Service providers

I use the following providers ("processors"):

Banks and payment providers act as independent controllers in relation to any payment instructions, not as my processors.

7. International transfers

Where data leaves the EU/EEA, transfers rely on the EU-US Data Privacy Framework where the recipient is certified, and on the European Commission's Standard Contractual Clauses where it is not. I choose EU/EEA data residency where the provider offers it.

8. Your rights

Under EU GDPR (and UK GDPR where it applies), you have the right to: access your personal data; correct inaccurate or incomplete data; request erasure where applicable; restrict or object to processing; data portability where applicable; withdraw consent where processing relies on consent (including waitlist notifications and any sensitive details you chose to share); and to give post-mortem instructions and designate someone to exercise these rights after your death (Loi Informatique et Libertés, art. 85).

I normally respond within one month. I may need to verify your identity before I act. Exercising your rights is free of charge. To exercise your rights, please email me.

9. Automated decisions, marketing, and children

I don't carry out automated decision-making or profiling. I don't conduct direct marketing — waitlist messages are limited to telling you the service has opened, which you've asked me to do, and you can opt out at any time. I don't sell personal data. This service is for adults aged 18 or over, and this website is not directed at children — I don't knowingly collect children's data.

10. Complaints

Please contact me first; I'll do my best to resolve any concern directly. If you're not satisfied, you have the right to complain to a data protection supervisory authority:

• France: Commission Nationale de l'Informatique et des Libertés (CNIL)
• United Kingdom: Information Commissioner's Office (ICO)
• EU/EEA: Your national data protection authority — in your country of residence, your workplace, or where the issue occurred (GDPR Article 77)

11. Changes to this Notice

For material changes, I'll update the version date above. Changes required by law take effect as legally required.

12. Language

This Notice is provided in English. A French version is available on request. If there is any discrepancy between the two versions, your mandatory rights under applicable law are unaffected.