Privacy Policy

Version: 1.0
Last Updated: 3 August 2026
Next Scheduled Review: August 2027

1. Introduction

At The Bristol PA trading as Layla Cummins ("The Bristol PA", "we", "us" or "our"), we are committed to protecting your privacy and handling your personal information responsibly.

This Privacy Policy explains how we collect, use, store and protect your personal information when you visit our website, contact us or use our services. It also explains your rights under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations (PECR) and other applicable UK data protection legislation.

We believe in being open and transparent about how your information is handled. We only collect the information we genuinely need to provide our services, communicate with you and operate our business effectively.

Please read this Privacy Policy carefully. By using our website or contacting us, you acknowledge that you have read and understood how we process your personal information.

If you have any questions about this Privacy Policy or how we use your personal information, please contact us using the details provided at the end of this document.

2. Who We Are

The Bristol PA is the trading name of Layla Cummins, an independent Virtual Assistant and Operational Support Specialist based in Bristol, United Kingdom.

For the purposes of UK data protection law, The Bristol PA trading as Layla Cummins is the Data Controller for the personal information collected through this website and in relation to enquiries, prospective clients and our own business operations.

In some circumstances, we also act as a Data Processor when providing services to our clients. This means we process personal information on behalf of, and under the instructions of, our clients, who remain the Data Controller for that information. Details of these arrangements are set out separately in our Data Processing & Confidentiality Statement.

Contact Details

Business Name: The Bristol PA trading as Layla Cummins

Location: Bristol, United Kingdom

Email: layla@thebristolpa.co.uk

Website:https://www.thebristolpa.co.uk

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us using the email address above.

3. The Information We Collect

The personal information we collect depends on how you interact with The Bristol PA. We only collect information that is necessary to provide our services, respond to enquiries, manage our business and comply with our legal obligations.

The types of personal information we may collect include:

Information you provide directly

When you contact us, complete a form on our website or become a client, we may collect:

  • Your name

  • Company or business name

  • Email address

  • Telephone number (if provided)

  • Any information you include within your enquiry or correspondence

  • Information relating to the services you require

  • Billing and invoicing information where applicable

You are under no obligation to provide this information, but if you choose not to, we may be unable to respond to your enquiry or provide our services.

Information collected automatically

When you visit our website, certain technical information may be collected automatically through cookies and analytics tools. This may include:

  • IP address

  • Browser type and version

  • Device type

  • Operating system

  • Website pages visited

  • Date and time of your visit

  • Time spent on our website

  • Referring website or source

  • General geographic location (where available)

  • Website usage statistics

This information helps us understand how visitors use our website and enables us to improve its performance and user experience.

Client information

If you engage The Bristol PA to provide virtual assistant or operational support services, we may collect additional information necessary to deliver those services.

Depending on the nature of the work, this may include:

  • Contact information for you and your organisation

  • Information required to carry out agreed administrative, operational or project support services

  • Business correspondence

  • Documents and files you ask us to manage

  • Financial information necessary for invoicing and bookkeeping support

  • Information you choose to share with us during the course of our working relationship

Where we process personal information on behalf of our clients, we do so only in accordance with their instructions and applicable data protection legislation.

We ask that you only provide personal information that is relevant to your enquiry or the services we are providing. Please avoid sending sensitive personal information unless we have specifically requested it or it is necessary for us to carry out our work.

Special Category Data

The Bristol PA does not intentionally collect or request Special Category Personal Data (such as information relating to health, ethnicity, religious beliefs, political opinions or biometric data).

If you voluntarily provide this type of information, we will only process it where it is necessary to do so and where there is an appropriate lawful basis under UK data protection legislation.

Children's Information

Our website and services are intended for businesses, professionals and individuals aged 18 years or over.

We do not knowingly collect personal information from children under the age of 18. If we become aware that personal information relating to a child has been collected unintentionally, we will take reasonable steps to delete it promptly.

4. How We Collect Your Information

We collect personal information in a number of different ways, depending on how you interact with The Bristol PA.

Information you provide directly

We collect information that you voluntarily provide when you:

  • Complete the contact form on our website

  • Contact us by email or telephone

  • Enquire about our services

  • Become a client

  • Correspond with us during the course of providing our services

  • Send us documents or information necessary for us to carry out our work

Information collected automatically

When you visit our website, we may automatically collect certain technical information through cookies and analytics technologies.

This information helps us understand how visitors use our website, identify areas for improvement and monitor website performance. Further information can be found in our Cookie Policy.

Information from third parties

Occasionally, we may receive personal information from third parties where:

  • You have been referred to us by an existing client or business contact.

  • You are introduced to us through a networking event or professional recommendation.

  • A client provides information necessary for us to carry out work on their behalf.

Where appropriate, we will ensure that any personal information received has been shared lawfully.

5. How We Use Your Information

We only use your personal information where it is necessary and lawful to do so.

Depending on your relationship with us, we may use your information to:

  • Respond to enquiries and requests for information.

  • Discuss our services with you.

  • Prepare quotations or proposals.

  • Provide virtual assistant and operational support services.

  • Manage client relationships.

  • Deliver agreed projects and ongoing support.

  • Communicate regarding work in progress.

  • Arrange meetings and appointments.

  • Process invoices and payments.

  • Maintain accurate business records.

  • Improve our website and services.

  • Analyse website usage through Google Analytics.

  • Comply with our legal and regulatory obligations.

  • Protect the security of our website and business.

We will never sell your personal information to third parties.

We will only use your information for the purposes for which it was collected or where we have another lawful reason to do so.

6. Lawful Bases for Processing

Under UK data protection legislation, we must have a lawful basis for processing your personal information.

The lawful basis we rely on depends upon why we are using your information.

Responding to enquiries
Providing contracted services
Client communication
Issuing invoices
Maintaining financial records
Complying with HMRC requirements
Improving our website
Google Analytics
Sending marketing emails
Defending legal claims

Where we rely on your consent, you may withdraw that consent at any time.

Where we rely on Legitimate Interests, we ensure that our interests are balanced against your rights and freedoms.

7. Acting as a Data Controller and Data Processor

Depending on the services we provide, The Bristol PA may act as either a Data Controller or a Data Processor.

When we are the Data Controller

We act as the Data Controller for personal information relating to:

  • Visitors to our website

  • People who contact us directly

  • Prospective clients

  • Existing clients

  • Suppliers

  • Business contacts

  • Marketing communications

As the Data Controller, we determine how and why this personal information is processed.

When we are the Data Processor

Many of the services provided by The Bristol PA involve processing personal information on behalf of our clients.

Examples include administrative support, operational support, document management, email management, diary management, CRM updates, bookkeeping support and project coordination.

In these circumstances:

  • our client remains the Data Controller;

  • we act solely as the Data Processor;

  • we only process personal information in accordance with our client's documented instructions;

  • we apply appropriate technical and organisational measures to protect personal information;

  • we maintain confidentiality regarding all information processed on behalf of clients.

Further information is available in our separate Data Processing Form.

8. Sharing Your Information

We treat your personal information with care and confidentiality.

We do not sell, rent or trade your personal information to third parties.

However, we may share personal information where necessary with trusted service providers who help us operate our business. This may include providers of:

  • website hosting;

  • email services;

  • cloud storage;

  • bookkeeping software;

  • payment processing;

  • analytics services;

  • marketing platforms; and

  • business productivity software.

We only share the minimum information necessary for the relevant service to be provided.

All third-party providers are expected to process personal information securely and in accordance with applicable data protection legislation.

We may also disclose personal information where required by law, regulation or legal process.

9. Third-Party Service Providers

To operate our business efficiently and provide our services, we use a number of trusted third-party providers. These providers may process personal information on our behalf in accordance with their own privacy policies and applicable data protection legislation.

Our current service providers include:

Squarespace - Website hosting and contact form submissions
Google Workspace - Business email, document storage and business communications
Google Analytics - Website analytics and performance monitoring
Zoho Books - Bookkeeping and financial record management
Canva - Creation of marketing and business materials
Microsoft 365 - Business productivity and communication tools

These providers only receive the information necessary to perform the services we require.

We take reasonable steps to ensure that third-party providers handle personal information securely and in accordance with UK data protection requirements.

For more information about how these providers process personal information, please refer to their individual privacy policies.

10. International Transfers of Personal Information

Some of the third-party providers we use may process personal information outside the United Kingdom.

Where personal information is transferred internationally, we take reasonable steps to ensure that appropriate safeguards are in place to protect your information. These safeguards may include:

  • UK International Data Transfer Agreements (IDTAs)

  • UK Addendums to the EU Standard Contractual Clauses

  • Transfers to countries recognised by the UK Government as providing an adequate level of data protection

  • Other legally recognised transfer mechanisms under UK data protection law

We only transfer personal information where appropriate safeguards are in place.

11. How We Protect Your Information

Protecting the confidentiality and security of personal information is an important part of how we operate.

We maintain appropriate technical and organisational measures designed to safeguard personal information against unauthorised access, loss, misuse, alteration or disclosure.

These measures include, where appropriate:

  • Password-protected business systems

  • Multi-factor authentication where available

  • Secure cloud storage

  • Restricted access to client information

  • Regular software and security updates

  • Secure communication platforms

  • Encryption provided by trusted third-party providers where available

  • Confidential handling of client information

Although we take reasonable steps to protect personal information, no method of transmitting information over the internet or storing electronic data can be guaranteed to be completely secure.

12. How Long We Keep Your Information

We only retain personal information for as long as necessary to fulfil the purposes for which it was collected, comply with legal obligations and resolve disputes where required.

Our typical retention periods are:

Retention Period
Website enquiries - Up to 12 months
Client correspondence - Up to 6 years after the end of the client relationship
Contracts and agreements - Up to 6 years
Financial and accounting records - 6 years (or longer where required by law)
Marketing subscribers - Until you unsubscribe or withdraw your consent
Google Analytics data - In accordance with our Google Analytics settings
Contact form submissions - Up to 12 months unless a client relationship is established

Where personal information is no longer required, it will be securely deleted or anonymised where appropriate.

13. Marketing Communications

From time to time, we may send marketing communications relating to our services.

We will only send marketing emails where:

  • you have asked to receive them;

  • you have given your consent; or

  • we are otherwise permitted to do so under applicable law.

You may unsubscribe from marketing communications at any time by:

  • clicking the unsubscribe link contained within our emails; or

  • contacting us directly.

Opting out of marketing communications will not affect service-related communications necessary to provide our services.

14. Cookies

Our website uses cookies and similar technologies to improve your browsing experience, understand how our website is used and help us improve our services.

Some cookies are essential for the operation of the website, while others are used only with your consent.

Where required by law, we will request your consent before placing non-essential cookies on your device.

Further information about the cookies we use, their purpose and how you can manage your preferences can be found in our separate Cookie Policy.

15. Your Rights

Under UK data protection legislation, you have a number of rights regarding the personal information we hold about you.

These rights include:

Right of Access

You have the right to request a copy of the personal information we hold about you.

Right to Rectification

You have the right to ask us to correct inaccurate or incomplete personal information.

Right to Erasure

In certain circumstances, you have the right to request that we delete your personal information.

Please note that this right is not absolute, and we may be required to retain certain information to comply with our legal obligations.

Right to Restrict Processing

You may ask us to restrict how we use your personal information in certain circumstances.

Right to Data Portability

Where applicable, you have the right to receive personal information you have provided to us in a structured, commonly used and machine-readable format.

Right to Object

You have the right to object to our processing of your personal information where we rely on Legitimate Interests as our lawful basis.

You also have the right to object to direct marketing at any time.

Rights Relating to Automated Decision-Making

The Bristol PA does not use automated decision-making or profiling that produces legal or similarly significant effects.

Exercising Your Rights

If you wish to exercise any of your rights, please contact us using the details provided at the end of this Privacy Policy.

We will respond to your request without undue delay and, in most cases, within one month, as required by UK data protection law.

We may ask you to provide proof of identity before responding to your request.

16. Raising a Data Protection Concern

The Bristol PA is committed to handling personal information fairly, securely and transparently.

If you have any concerns about how we have collected, used or managed your personal information, we encourage you to contact us in the first instance so that we can investigate the matter and work towards a resolution.

You can submit a concern by contacting us directly using the details at the end of this Privacy Policy or by completing our Data Protection Concerns Procedure, which is available to view on our website. We can also provide a PDF copy upon request.

View our Data Protection Concerns Procedure

We aim to acknowledge concerns promptly and investigate them fairly and in accordance with our internal procedures.

17. Complaints to the Information Commissioner's Office (ICO)

If you are not satisfied with how we have handled your personal information or responded to your concern, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent authority for data protection.

We would appreciate the opportunity to address your concerns before you contact the ICO, but you are not required to do so.

Further information about your rights and how to make a complaint can be found on the ICO's website:

Website: https://ico.org.uk/

Telephone: 0303 123 1113

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in:

  • applicable legislation;

  • regulatory guidance;

  • our business practices;

  • the services we provide; or

  • the third-party providers we use.

The most recent version will always be published on our website, and the "Last Updated" date at the beginning of this Privacy Policy will be amended accordingly.

We encourage you to review this Privacy Policy periodically to ensure you remain informed about how we collect and use your personal information.