Privacy

Privacy notice

Last updated 20 October 2026.

This explains what I do with your personal information, why, and what you can do about it. It is written to be read rather than to be got past. If anything here is unclear, email me and I will explain it properly.

Who I am

Hawthorn & Horten Ltd is the data controller for the information described here. The company is registered in Scotland, company number SC802070, and is based in Ayrshire.

You can contact me about anything on this page at info@hawthornandhorten.com.

What I collect

If you complete the Ground Truth Scorecard

• Your name and email address.
• Your organisation and role, if you give them.
• Your answer to each of the twelve statements.
• Your total score, your result band, your four area scores, and the result the site showed you.
• Whether you ticked the box agreeing to hear from me.

Your score is worked out in your own browser and appears on the page straight away. It is not emailed to you. I do see your twelve answers and your result, because that is what makes them worth reading, and I read them myself.

If you use the enquiry form

• Your name and email address.
• Your organisation, if you give it.
• What you chose from the list of topics, and whatever you write in the message box.

If you email me

Whatever you put in the email, including your name, address and anything you tell me about your organisation or your programme.

If you become a client

The information needed to do the work and to run the company properly. Contact details, contract and invoicing records, and the notes and material generated during an engagement.

What I do not collect

This site sets no cookies, runs no analytics, and does not track you around the internet. There is no advertising here and nothing on this site profiles you.

Why I use it, and my legal basis

What for	Legal basis
Getting in touch about your scorecard result, and sending occasional notes about change work	Consent, which you give by ticking the box. You can withdraw it at any time, and every email includes a way to stop it.
Replying to an enquiry you have sent me, by the form or by email	Legitimate interests. You contacted me and expect an answer.
Delivering work for a client	Performance of a contract.
Keeping accounting and tax records	Legal obligation.

Giving me any of this is entirely up to you. The tick box is optional, and leaving it unticked does not stop you seeing your score. Nothing else on the site requires anything from you.

Who else sees it

I am a one person business. Nobody else reads your enquiry. I do use a small number of suppliers to run the website and my email, and they process information on my behalf under contract:

• My website host, which receives and stores scorecard and enquiry form submissions.
• My email provider, which handles the emails I send and receive.
• My accountant, for invoicing and tax records, where relevant.

I do not sell your information, share it with advertisers, or pass it to anyone else, unless I am legally required to.

Where it goes

Some of these suppliers are based in the United States or store information there. Where that happens, the transfer relies on the UK extension to the EU to US Data Privacy Framework, or on the standard contractual clauses approved for use in the UK, together with the additional safeguards those require.

How long I keep it

• Scorecard submissions and enquiries that do not become work: two years from our last contact, then deleted.
• Mailing list details: until you unsubscribe or ask me to remove you.
• Client records and anything with a financial or contractual element: six years after the end of the engagement, which is what tax and company law require.

How it is kept

Access is limited to me. Accounts are protected with strong unique passwords and two factor authentication. Devices are encrypted. Client material is kept only as long as it is needed and is not stored on anything shared.

Your rights

Under UK data protection law you have the right to:

• Ask what information I hold about you, and get a copy of it.
• Have anything inaccurate corrected.
• Ask me to delete it.
• Ask me to restrict what I do with it.
• Object to my using it, including for direct marketing, which I will always act on.
• Receive it in a portable form, or have it sent to someone else.
• Withdraw your consent at any time, where consent is what I relied on. Withdrawing it does not undo anything done before you withdrew it.

There is no automated decision making here. Your scorecard result is worked out by a simple calculation in your browser, and no decision about you is made on the back of it.

Complaints

If you are unhappy with how I have handled your information, tell me first and I will try to put it right.

You also have the right to complain to the Information Commissioner's Office, which is the UK regulator for data protection. You can do that without coming to me first.

Changes to this notice

If I change how I use your information, I will update this page and change the date at the top. If the change is significant and I hold your details, I will tell you directly.