1. Who we are

Charlie Grabham T/A Bombshell Comms and The Bombshell Blueprint ("we", "us", "our") is a UK-based business providing public relations, fractional marketing services, digital products and coaching. We are the data controller for the personal data described in this policy.

Contact us about anything in this policy at bombshellblueprint@bombshellcomms.co.uk.

This policy explains how we collect, use and protect your personal data under the UK GDPR and the Data Protection Act 2018. It applies to charliegrabham.com ("the Website") and our services.

2. What data we collect

  • Identity and contact data: your name and email address, when you sign up for emails, free resources or courses, or contact us.

  • Transaction data: your billing address and details of what you have bought. Payment card details are collected by our payment providers, not by us.

  • Technical data: IP address, browser type, device and similar information.

  • Usage data: pages visited, time on site and links clicked, collected through cookies and analytics tools.

  • Communications data: messages you send us, and your email preferences.

  • Client data (Bombshell Comms): business contact details and project information you give us when we work together.

We do not knowingly collect data from anyone under 18. We do not collect special category data (such as health information) unless you choose to share it with us, for example in a coaching session.

3. How we use your data and our lawful basis

What we do

Lawful basis

Deliver the content, services or products you have signed up for or bought

Process payments and give you access to paid products

Keep financial and tax records

Send marketing emails about offers, events and new content

Consent (or, for existing customers, our legitimate interest in marketing similar products, with an easy opt-out)

Improve and secure the Website and our services

Respond to your enquiries

Legitimate interests, or contract where you are a customer

Where we rely on legitimate interests, we have considered the effect on you and believe our use is fair and proportionate. You can ask us about this at any time.

4. Email marketing and unsubscribing

We only send marketing emails if you have opted in, or if you are an existing customer and the email is about similar products. You can unsubscribe at any time using the link in every email. Unsubscribing from marketing does not stop service emails we need to send you, such as receipts or access details.

We use Systeme.io as our email platform. Your email address and related data are stored in Systeme.io's systems.

The Bombshell Blueprint newsletter and paid newsletter is provided through Substack. Substack acts as an independent controller for the data it collects when you subscribe, and its privacy policy applies. You can cancel through the Substack app or website, or by using the unsubscribe link in any paid email. If you need help, email bombshellblueprint@bombshellcomms.co.uk.

5. Payments

Payments are processed by third-party providers such as Stripe or PayPal. We do not store your full card details. Each provider handles your payment information under its own privacy and security policies.

6. Cookies and analytics

We use cookies and similar technologies. Strictly necessary cookies are always on. For analytics and marketing cookies, we ask for your consent through our cookie banner, and you can change your choice at any time.

7. Who we share your data with

We never sell your data or share it with third parties for their own marketing. We share it only with service providers who process it on our behalf, and only as needed, including:

  • Systeme.io (website, email platform and course hosting)

  • Stripe and PayPal (payments)

  • Google Workspace (email, documents and storage)

  • Substack (paid newsletter)

  • Google analytics

We may also share data where the law requires, with our professional advisers, or in connection with legal claims.

8. International transfers

Some of our providers are based outside the UK, or process data outside the UK, including in the EU and the United States. Where this happens, we make sure a lawful transfer mechanism is in place, such as UK adequacy regulations, the UK Extension to the EU-US Data Privacy Framework, or the ICO's International Data Transfer Agreement or Addendum. You can ask us for details of the safeguards for a particular provider.

9. How long we keep your data

We keep data only as long as we need it for the purposes above:

  • Customer and transaction records: 6 years after the end of the tax year, for tax and accounting.

  • Email subscribers: until you unsubscribe, after which we keep a minimal suppression record so we do not email you again

10. Keeping your data secure

We use reasonable technical and organisational measures to protect your data, including secure platforms, access controls and strong passwords. No system is completely secure. If a breach is likely to risk your rights, we will tell you and the ICO as the law requires.

11. Your rights

Under the UK GDPR you have the right to:

  • be informed about how we use your data;

  • access the data we hold about you;

  • have inaccurate data corrected;

  • have your data erased, in certain circumstances;

  • restrict how we use your data, in certain circumstances;

  • receive your data in a portable format, where we use it by consent or contract;

  • object to processing based on legitimate interests, and to direct marketing at any time;

  • withdraw consent at any time, without affecting earlier processing; and

  • not be subject to solely automated decisions with legal or similarly significant effects. We do not make such decisions.

To use any of these rights, email bombshellblueprint@bombshellcomms.co.uk. We will reply within one month and may need to confirm your identity first. There is normally no charge.

12. Complaints

If you are unhappy with how we have handled your data, please contact us first at bombshellblueprint@bombshellcomms.co.uk. We will acknowledge your complaint within 30 days and aim to resolve it without delay.

You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113.

13. Changes to this policy

We may update this policy. We will post the new version here with its date, and tell you by email if the changes are significant.