Privacy Notice
Version 1.0 · Effective 28 September 2026 · Last reviewed 28 September 2026
Draft — under legal review
This notice is current as of the date above and reflects our practices in good faith. A formal legal review by a UK data-protection specialist is in progress; any material update will be reflected here with the revision date. For questions on any specific section, contact ilya@happy-people.ltd.
1. Who we are
Happy People Ltd ("we", "us", "our") is a company registered in England and Wales, company number 16779979, with registered office in the United Kingdom.
We are the data controller for personal data described in this notice, unless we are processing personal data on behalf of a client under a services agreement, in which case the client is the controller and we act as a processor (see section 8).
Contact: ilya@happy-people.ltd
2. What this notice covers
This notice explains how we collect, use, and protect personal data when you:
- visit our website happy-people.ltd or subdomains
- receive business communications from us
- become a client and enter into a services agreement with us
- interact with us on business platforms (LinkedIn, Loom, DocuSeal, Cal.com, Stripe)
It does not cover personal data we process on a client's behalf as a data processor. That is governed by the Data Processing Agreement (if any) attached to the services agreement.
3. What personal data we collect
3.1 Data you provide directly
- Name, business email, business phone, job title, company name, country
- Content of email replies, call recordings (with your consent), scoping-call notes
- Contract details, billing details, tax identifiers (VAT / EIN / UTR)
- Payment information (processed by Stripe; we do not store card numbers)
3.2 Data collected automatically
- Website analytics: IP address, browser type, pages viewed, time on page (anonymised)
- Email engagement: opens, clicks, replies (via Instantly cold-email platform)
- Loom video views (aggregated, non-identifying unless you provide identifying information)
3.3 Data from third-party sources
- Publicly-listed business contact details from marine-industry directories, used for B2B communications under legitimate interest basis (see section 5).
- LinkedIn profile data available to public.
4. Why we collect it (purpose)
| Purpose | Data used | Lawful basis (UK GDPR Art. 6) |
|---|---|---|
| Business communications to marine SMBs | Business email, name, company, city | Legitimate interest — Art. 6(1)(f) |
| Responding to your inquiry | Email content, name | Legitimate interest / pre-contract steps — Art. 6(1)(b) |
| Discovery + scoping calls | Call notes, business context | Pre-contract steps — Art. 6(1)(b) |
| Delivering services under contract | Full contact set, systems credentials, business data | Contract performance — Art. 6(1)(b) |
| Billing + tax records | Company name, VAT/EIN, invoice history | Legal obligation (HMRC 7yr retention) — Art. 6(1)(c) |
| Improving our service | Aggregated analytics | Legitimate interest — Art. 6(1)(f) |
We do not use your data for automated decision-making or profiling with legal effect.
5. Legitimate interest for business outreach
Under UK GDPR Article 6(1)(f), we rely on legitimate interest to send B2B business communications to publicly-listed marine business contacts. Our balancing test:
- Our interest: finding SMB clients whose specific operational pain we can address (marine automation).
- Necessity: targeted outreach is the least intrusive way to reach small marine businesses who do not attend conferences or run PPC ads on our keywords.
- Impact on you: minimal — a single introductory email with clear opt-out; sequence stops immediately on any reply or unsubscribe.
- Your rights preserved: every email contains an unsubscribe link and our sender identity is transparent.
You can object at any time (see section 7). We will honour the objection immediately and suppress your address across current and future communications.
6. Who we share your data with
We share personal data only with:
- Sub-processors under contract with us, each bound to equivalent confidentiality and security obligations: Google Workspace, Instantly.ai, Stripe, DocuSeal, Cal.com, self-hosted n8n, Loom.
- Professional advisers: accountants, solicitors, insurers, on need-to-know basis.
- Regulators: if required by law (HMRC, ICO, Companies House).
We do not sell your personal data. We do not share it with advertising networks.
7. Your rights (UK GDPR)
You have the right to:
- Access — request a copy of the personal data we hold about you
- Rectify — correct inaccurate data
- Erase — request deletion ("right to be forgotten"), subject to legal-retention exceptions
- Restrict — pause our processing while a query is resolved
- Object — to processing based on legitimate interest (including all marketing)
- Portability — receive your data in structured, machine-readable format
- Withdraw consent — where processing was based on consent
To exercise any right: email ilya@happy-people.ltd with subject "Data Rights Request". We respond within 30 calendar days.
If you are unsatisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO): ico.org.uk · Helpline: 0303 123 1113
8. Data we process on client's behalf (processor role)
When we deliver automation services under a signed agreement, we may process personal data belonging to the client's own customers, suppliers, or employees. In that role:
- The client is the data controller; we are the data processor
- Our processing is governed by the Data Processing Agreement (DPA) annexed to or referenced in the services agreement
- We process such data only on the client's documented instructions
- We do not use client-controlled personal data for our own purposes
- On termination we return or delete the data at the client's option
9. International transfers
Some sub-processors are located outside the UK / EEA (primarily US). In each case:
- The provider is a signatory to the EU-US Data Privacy Framework, or
- We have Standard Contractual Clauses (SCCs) with the provider, or
- We have conducted a Transfer Impact Assessment and applied supplementary measures
You can request the specific transfer mechanism for any sub-processor by emailing ilya@happy-people.ltd.
10. How long we keep your data
| Data category | Retention |
|---|---|
| Outreach contacts (no reply) | 12 months from last send, then deletion |
| Prospects who replied but did not become clients | 24 months from last contact, then deletion |
| Active client records | Duration of contract + 6 years (HMRC) |
| Financial records | 6 years from end of accounting period |
| Website analytics | 26 months |
| Email suppression list (unsubscribes) | Indefinite — required to honour opt-out |
11. Security
We apply technical and organisational measures appropriate to the risk, including:
- TLS 1.3 encryption for data in transit
- Encrypted-at-rest storage on all sub-processor platforms
- Access on principle of least privilege
- Two-factor authentication on all business accounts
- Regular backups with integrity checks
- Sub-contractors bound by equivalent obligations
12. Changes to this notice
We may update this notice from time to time. The "Last reviewed" date at the top indicates the most recent revision. Material changes will be notified to active clients by email at least 14 days before taking effect. For prospects and website visitors, the current version at time of interaction applies.
13. Cookies
Our website uses:
- Strictly necessary cookies (session, CSRF) — no consent needed
- Analytics cookies (anonymised) — legitimate interest basis; opt-out via browser settings
We do not use advertising, tracking, or third-party marketing cookies.
14. Contact + complaints
Data protection contact: Ilya Kravtsov, Founder
Email: ilya@happy-people.ltd
Company: No. 16779979 (Companies House, England and Wales)
Response window: 30 calendar days for any rights request.
Escalation: Information Commissioner's Office (ico.org.uk)