Last updated: 2 November 2026

This page explains what personal information I collect when you use this website, why I collect it, who it goes to, how long I keep it, and what rights you have. I’ve tried to keep it in plain language, and to describe what actually happens on this site rather than what a template says might.

Who I am

I’m Sarah Hutt, and I run Wild Rose Path from Cumbria, England. Under UK data protection law I am the “data controller”, which means I’m the person responsible for looking after the personal information described on this page. If you have any question about it, email me at sarah@wildrosepath.co.uk.

The short version

  • I collect only what you choose to give me, such as your name and email address, plus the basic technical information any website receives when it is visited.
  • I don’t sell your information, and I don’t pass it on for anyone else’s marketing.
  • If you join the letters, your email address is held by Kit, the service I use to send them. You can unsubscribe at any time using the link at the bottom of every email.
  • The visitor figures I look at are anonymous and don’t use cookies.
  • Videos and audio from YouTube and Spotify only load if you say yes to them in the cookie banner.

What I collect, why, and my legal basis

UK data protection law says I need a lawful reason (a “legal basis”) for using your information. Here is each thing I do, and the reason for it.

Joining the Stile or the weekly letters

When you sign up through a form on this site, I collect your first name and email address. I use them to send you the Stile, the weekly letters from the Path, and occasionally news of my work, such as a new offer. Kit, which sends the emails for me, also records how you interact with them, such as whether you opened an email and which links you clicked, and roughly where in the world you are. I use this to see what is helpful and to keep my list tidy.

My legal basis is your consent, which you give by signing up. You can withdraw it at any time by unsubscribing.

Taking the Stile

The Stile is five questions. Your answers stay in your browser while you answer them, and are held in your browser tab for the length of your visit so that a refresh doesn’t lose them. At the end I ask for your first name and email address before showing your result, and for you to tick a box to say you’re happy for me to send it. When you press the button, your name, email address, your result (the landscape you land in) and the scores behind it are sent to Kit and saved on your subscriber record, as described under joining the Stile above. My basis for this is your consent. If you close the page before that point, nothing is sent.

Applying for Crossing the Threshold

Applications are made through a Google Form. I collect your name, your email address and your answers to the questions, which ask about what is changing in your life. I use them to read your application, reply to you personally and, if we go ahead, to prepare for working together.

My legal basis is that it’s a step you’ve asked me to take before we agree to work together, along with my legitimate interest in running my business and replying to people who get in touch.

Please share only what you’re comfortable with. You don’t need to include health information. If you do choose to tell me something sensitive about yourself, such as something about your health, you’re giving me your explicit consent to use it to consider your application and, if we work together, to support you through the sessions. I’ll keep it private and won’t share it, except where the law requires me to.

Getting in touch

If you use the contact form on this site or email me, I collect your name, your email address and whatever you write in your message. I use them to reply. The contact form sends your message to my email inbox. My legal basis is my legitimate interest in answering people who write to me, or taking steps you have asked for before we work together.

Working together

If we work together, I keep the details needed to do that: your contact details, what we agree, and notes from our sessions. Sessions take place by video call, currently on Zoom. I won’t record a session without asking you first.

If you pay by card or through an online payment service, the payment is handled by that service and I don’t see or store your full card details. I keep a record of what you paid and when, because I’m required to keep accounting records. My legal bases are carrying out our agreement and meeting my legal obligations.

Comments on the Journal

Some Journal posts allow comments. If you leave one, I collect what you type into the form (your name, your email address, and a website if you add one), plus your IP address and your browser’s user agent, which help me deal with spam. Your name and comment are shown publicly. If you tick the box to remember your details, your browser saves them in cookies for a year so you don’t have to type them again.

WordPress may send an anonymised version of your email address (a hash) to Gravatar to check whether you have a profile picture. Gravatar’s privacy policy is at automattic.com/privacy. My legal basis is your consent, and my legitimate interest in keeping the site free of spam.

Visiting the website

Like every website, this one receives some technical information when you visit: your IP address, the page you asked for, the date and time, and details of your browser and device. My web host, SiteGround, keeps this in its server logs for a limited time. Security tools on the site, including Jetpack from Automattic, use it to spot and block attacks and suspicious login attempts. My legal basis is my legitimate interest in keeping the website running and secure.

Visitor statistics

To see how many people visit and which pages are read, I use Koko Analytics, a privacy-focused tool that runs on this website itself rather than on someone else’s servers. It doesn’t use cookies and doesn’t store anything on your device.

Each visit is counted using a one-way hash made from your IP address, your browser details and a secret that changes every day. The hash can’t be turned back into your IP address, can’t be used to link your visits from one day to the next, and the temporary files are wiped every night. What I keep is simple totals, such as how many times each page was viewed and which sites people came from. I don’t use this information to identify you, to build a profile of you or to advertise to you, and I don’t share it with anyone.

My legal basis is my legitimate interest in understanding how the site is used so I can improve it. If you have any concern about this, please email me.

Cookies and similar technologies

Cookies are small files that a website stores on your device. This site uses very few:

  • A small cookie from Complianz, the consent tool, which remembers your cookie choice, for up to 12 months.
  • Comment cookies, only if you tick the box when you leave a comment (one year).
  • Kit’s signup forms can store small items in your browser, for example to remember that you have already signed up or closed a form, so it isn’t shown to you again.
  • Cookies from YouTube and Spotify, but only if you allow embedded content (see below).

Visitor statistics on this site don’t use cookies. When I log in to manage the site, WordPress sets login cookies, which apply only to me.

You can change your cookie choice at any time using the “Manage Consent” link at the bottom of every page. You can also delete cookies in your browser settings.

Embedded content and other websites

Some pages and Journal posts include videos from YouTube (owned by Google) and audio from Spotify. These stay blocked until you allow marketing cookies in the cookie banner. Once you do, they behave as if you were visiting those sites directly, which means they can set cookies and collect information about you. Their own privacy policies explain what they do with it.

This site also links to other places, such as Instagram, Facebook, YouTube and Substack. When you follow a link, you leave this website and the privacy policy of that site applies instead.

Who I share your information with

I don’t sell your information. I use a small number of trusted services to run my work, and they handle your information on my behalf, only for the purposes I’ve described:

  • Kit (kit.com), which holds my email list, runs the signup forms and sends the emails.
  • Google, for the application form and for email.
  • Zoom, or a similar video service, for sessions.
  • SiteGround, my web host, and Automattic (Jetpack), which helps protect the site.
  • YouTube and Spotify, only if you allow embedded content.
  • Payment services, if you pay online.
  • My accountant or bookkeeper, and authorities such as HMRC, where I’m required to share records.

I may also use other online business tools to manage my website, email list and notes, which may process your information on my behalf.

Information sent outside the UK

Some of these services, including Kit, Google and Zoom, are based in the United States or store information there. Where information goes outside the UK, I rely on providers that use approved safeguards, such as the UK extension to the EU-US Data Privacy Framework or standard contractual clauses with the UK addendum (or the UK’s International Data Transfer Agreement). Kit explains its safeguards at help.kit.com. If you’d like to know more, email me.

How long I keep your information

  • Email list: until you unsubscribe. I keep a record that you unsubscribed so I don’t email you again by mistake. If you’d like everything about you deleted, ask me and I will.
  • Applications: if we don’t work together, up to 12 months after I’ve replied, then I delete them.
  • Enquiries: up to two years after our last message.
  • Working together: agreements and session notes for up to two years after we finish, then I delete them.
  • Payment and accounting records: for as long as the law requires, usually six years.
  • Comments: until I remove them or you ask me to.
  • Visitor statistics: the daily hash is wiped every night. The anonymous totals are kept.
  • Server logs: for a short period, set by my web host.

Your rights

You have the right to:

  • ask for a copy of the personal information I hold about you
  • ask me to correct anything that’s wrong or incomplete
  • ask me to delete your information
  • ask me to limit how I use it
  • object to me using it where I rely on legitimate interests
  • ask for the information you gave me in a format you can take elsewhere
  • withdraw your consent at any time, where I’m relying on it (for example, by unsubscribing from the letters). Withdrawing doesn’t affect anything I did before you withdrew.

To use any of these rights, email me at sarah@wildrosepath.co.uk. I’ll reply within one month, and there’s no charge. I may need to check it’s really you before I share or change anything. I don’t make decisions about you using automated processes.

If you’re unhappy with how I’ve handled your information, I’d like the chance to put it right first. You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

Children

My work is for adults. I don’t knowingly collect information from anyone under 18. If you think a child has given me their details, email me and I’ll delete them.

Keeping your information safe

I use reputable providers and security tools, and I limit who can access your information. No online system is completely secure, so I can’t promise perfect security, but I take care.

Changes to this page

If what I do with your information changes, I’ll update this page and change the date at the top. For anything significant, I’ll let you know by email if I hold your address.

Contact

Questions about any of this are welcome: sarah@wildrosepath.co.uk.