Privacy Policy

1. Who is responsible for your data

This site, trevorfenner.com, is operated by Trevor Fenner. I am the data controller for the purposes of the UK and EU General Data Protection Regulation (GDPR). I operate from Bali, Indonesia, and the site is hosted in the United States.

Contact for anything privacy-related: trevor@ecommerceparadise.com.

2. Information you give me

Contact form

When you use the form on the Contact page I collect your name, email address, subject, and message. Submissions are emailed to me and also stored in this site’s database so I don’t lose them. The form is powered by Jetpack (Automattic), which also screens submissions for spam.

Newsletter

If you subscribe, I collect your email address. My newsletter runs on Kit (formerly ConvertKit). Kit records your signup, whether you open emails and click links, and the IP address you subscribed from. Every email has an unsubscribe link, and unsubscribing takes effect immediately.

Comments

If you comment on a post I collect your name, email address, any website you enter, your comment, your IP address, and your browser user agent. Comments are held for moderation. Your email address is not published, but a hashed version may be sent to Gravatar (Automattic) to display an avatar — see the Automattic privacy policy.

Booking a consulting call

If you book a call from the Offerings page, scheduling is handled by Calendly. The name, email, and any details you enter go to Calendly and to me. See the Calendly privacy policy.

3. Information collected automatically

Like nearly every website, some data is collected the moment you load a page:

• Server logs kept by my host, GoDaddy — your IP address, the pages requested, timestamps, and your browser and device type. Used for security, abuse prevention, and troubleshooting.
• Google Analytics 4, added through the Site Kit plugin — pages viewed, time on page, approximate location derived from a truncated IP, referring site, and device type. This tells me which posts are worth writing more of.
• Security and platform data from Jetpack (Automattic) and GoDaddy, used to block malicious traffic and keep the site online.

I do not use this data to build advertising profiles, and I do not run display ads on this site.

4. Cookies and similar technologies

Cookies are small files stored by your browser. This site currently sets or permits the following categories:

• Strictly necessary — WordPress cookies that keep the site working, remember comment details you entered, and keep you logged in if you have an account here.
• Analytics — Google Analytics cookies (names beginning _ga) that distinguish visitors and sessions.
• Hosting and platform — cookies set by GoDaddy (names beginning _tccl) and Automattic/Jetpack (names beginning tk_) for traffic measurement and security.
• Embedded content — if a page embeds a YouTube video or a Calendly widget, those providers may set their own cookies once the embed loads.
• Affiliate attribution — if you click an affiliate link, the merchant or its network may set a cookie so any purchase is credited to me. Details are in my Disclosures.

You can block or delete cookies in your browser settings, and you can opt out of Google Analytics entirely using Google’s opt-out browser add-on. Blocking cookies will not break this site.

5. Why I am allowed to process your data (GDPR legal bases)

• Consent — for the newsletter. You can withdraw it any time by unsubscribing.
• Legitimate interests — for keeping the site secure, understanding which content performs, and replying to messages you send me. I have weighed these against your rights and kept the data collected to a minimum.
• Contract — when you book or buy a consulting call, to actually deliver it.
• Legal obligation — where I have to keep records, for example for tax purposes.

6. Who your data is shared with

I do not sell your personal information, and I never trade or rent email addresses. Data is shared only with the service providers that make this site run, each acting as a processor under their own privacy terms:

• GoDaddy — web hosting and server logs
• Google (Analytics, Search Console via Site Kit) — site analytics and search performance
• Automattic / Jetpack — contact form processing, spam filtering, security, Gravatar
• Kit (ConvertKit) — newsletter delivery and engagement statistics
• Calendly — consulting call scheduling
• YouTube (Google) — embedded videos

I may also disclose information if I am legally required to, or to protect the rights, safety, or property of myself or others.

7. International transfers

I live in Indonesia and the providers above are mostly based in the United States, so your data will be transferred outside the UK, EEA, and your home country. Where GDPR requires it, these transfers rely on the European Commission’s Standard Contractual Clauses or an equivalent safeguard offered by the provider. You can ask me for details.

8. How long I keep it

• Contact form messages — kept while the conversation is useful, then deleted on request.
• Newsletter subscribers — until you unsubscribe or ask to be deleted.
• Comments — kept indefinitely so threads still make sense, unless you ask me to remove yours.
• Analytics — retained according to Google’s data retention settings, currently a maximum of 14 months for user-level data.
• Server logs — retained by my host on a short rolling basis.

9. Your rights under GDPR (UK and EEA visitors)

If you are in the UK or the European Economic Area you have the right to:

• Access the personal data I hold about you
• Correct it if it is wrong
• Have it erased (the “right to be forgotten”)
• Restrict how I process it
• Receive it in a portable, machine-readable format
• Object to processing based on legitimate interests, including any direct marketing
• Withdraw consent at any time, without affecting processing that already happened

Email trevor@ecommerceparadise.com and I will respond within one month. There is no charge. If you are unhappy with how I handle it, you can complain to your national data protection authority — in the UK that is the Information Commissioner’s Office.

10. Your rights under CCPA/CPRA (California residents)

If you are a California resident, the California Consumer Privacy Act as amended by the CPRA gives you specific rights. In the last 12 months this site has collected these categories of personal information:

• Identifiers — name, email address, IP address (from forms, comments, newsletter signups, and server logs)
• Internet or network activity — pages viewed, referring site, browser and device information (from analytics and logs)
• Approximate geolocation — a coarse city or country estimate derived from your IP address
• Commercial information — records of consulting calls booked, if you book one

This information comes directly from you, or automatically from your device, and is used for the purposes described in section 3. It is disclosed for business purposes only to the service providers listed in section 6.

Sale and sharing

I do not sell your personal information, and I have no actual knowledge of selling the personal information of anyone under 16. I also do not share personal information for cross-context behavioural advertising as CPRA defines it. However, analytics cookies are treated as a “sale” or “share” under some readings of the law, so to be safe: you can opt out at any time by using the Google Analytics opt-out add-on linked in section 4, by blocking cookies in your browser, or by enabling Global Privacy Control, which this site honours where technically supported.

Your California rights

• The right to know what personal information is collected, used, and disclosed
• The right to delete personal information I hold about you
• The right to correct inaccurate personal information
• The right to opt out of any sale or sharing of personal information
• The right to limit the use of sensitive personal information (note: I do not collect sensitive personal information as CPRA defines it)
• The right not to be discriminated against for exercising any of these rights — you will get the same content and service either way

To exercise any of these, email trevor@ecommerceparadise.com with “California privacy request” in the subject line. I will verify your request by replying to the email address I hold for you, and respond within 45 days. You may use an authorised agent, in which case I will ask for written proof of their authority.

11. Security

The site runs over HTTPS, sits behind my host’s security layer, and uses Jetpack for brute-force protection and spam filtering. No website can promise perfect security, but I keep the amount of personal data I hold deliberately small, which is the most effective protection there is.

12. Children

This site is aimed at adults building businesses. It is not directed at children, and I do not knowingly collect personal information from anyone under 16. If you believe a child has given me information, email me and I will delete it.

13. Links to other sites

This site links to other businesses I own, to tools I recommend, and to affiliate partners. Once you follow a link, that site’s own privacy policy applies, not this one. My commercial relationships are set out in full in my Disclosures.

14. Changes to this policy

If I change how data is handled I will update this page and move the “last updated” date. Material changes affecting people already on my list will be announced by email.

15. Contact

Questions, requests, or complaints: trevor@ecommerceparadise.com.