Privacy notice
This version is dated 25 October 2026.
Pandion Studio is the trading name of Nicholas Cahill, a sole trader in the United Kingdom. This notice explains what personal information I collect, why, who sees it, how long I keep it, and the rights you have over it. It covers clients, prospective clients, business contacts, suppliers, and visitors to pandion.studio and to the private client site, app.pandion.studio.
Where I use “I”, that is Nic Cahill, who runs Pandion Studio personally and is the controller of your personal information.
Who I am and how to reach me
Nicholas Cahill trading as Pandion Studio
[email protected]
Pandion Studio is registered with the Information Commissioner's Office as a fee payer, registration reference ZC263404.
What I collect, and where it comes from
From you directly, when you email me, book a session or work with me:
- Your name, role and organisation, and how to contact you.
- What you tell me about your business and your work, so that I can advise you.
- Invoicing and payment details where we work together.
From the organisations I work with, where their people are part of the work: names, roles and contact details of the staff I deal with, and whatever those organisations share with me under our confidentiality arrangements.
From public sources such as Companies House, LinkedIn and business websites, when I am preparing to meet you or checking who I am dealing with.
From your visit to pandion.studio: the site uses Vercel Analytics and Speed Insights, which record page views and performance without cookies and without building a profile of you. Client pages are not on pandion.studio: they sit on a separate private site, app.pandion.studio, where Cloudflare Access sets a login cookie so that only the intended reader can open them. That site runs no analytics.
I do not collect special category information (such as health data) or information about criminal convictions, and my services are for businesses and adults, not children.
Why I use it, and the legal basis
| What I do | The information | Legal basis |
|---|---|---|
| Reply to your enquiry, arrange and hold sessions | Contact details, what you tell me | Legitimate interests (responding to you), then performance of our contract |
| Advise you and deliver the work we agree | Contact details, your business information, your colleagues' names and roles | Performance of our contract; legitimate interests of your organisation |
| Invoice you and keep accounts | Identity, contact and payment details | Performance of our contract; legal obligation (tax and accounting records) |
| Keep in touch with business contacts and the people I meet through networks | Name, role, organisation, contact details, notes of our conversations | Legitimate interests (running a professional practice) |
| Run, secure and improve the website | Technical data about visits | Legitimate interests (keeping the site working and secure) |
| Establish, exercise or defend legal rights, and meet legal obligations | Whatever is relevant | Legal obligation; legitimate interests |
I do not sell personal information, and I do not use it for automated decisions about you.
Who sees it
I work alone. Personal information is shared only with the service providers that run my practice, each under its own data protection terms:
- Google Workspace, for email, calendar and documents.
- HubSpot, for contacts and deals.
- GitHub and Supabase, where client and engagement records are kept, privately.
- Vercel and Cloudflare, which host and protect the website and the private client site.
- FreeAgent and my bank, for invoicing and payments.
- AI tools from Anthropic and OpenAI, which I use to draft, analyse and build. I use them with model training switched off, and I tell clients which tools are used on their work and what goes into them. Nothing an AI tool produces is relied on without my review.
- My accountant, insurer and other professional advisers, where needed.
Some of these providers store or process information outside the United Kingdom, mainly in the United States. Where that happens, the transfer is covered by safeguards recognised under UK data protection law, such as the UK Extension to the EU-US Data Privacy Framework or the International Data Transfer Agreement. Ask me if you want to know the arrangement for a particular provider.
I may also disclose information where the law requires it, or to establish or defend legal rights.
How long I keep it
| Information | How long |
|---|---|
| Records of the work I do for clients (correspondence, notes, documents, contracts) | Six years after the engagement ends, for tax, insurance and legal reasons |
| Invoices and accounting records | Six years after the end of the tax year they relate to |
| Enquiries that do not lead to working together | Twelve months after our last contact |
| Business contacts and networking notes | While we are in contact, reviewed each year |
| Website analytics | Aggregated figures only, kept by Vercel on its standard retention |
Where a client asks for its information to be returned or deleted under a confidentiality agreement, I do that, and confirm it in writing, except for the records I am required by law to keep.
When I no longer need information, I delete it or make it anonymous.
How I keep it safe
Client information lives in private repositories and private accounts, each protected by two-factor authentication. Client pages sit on a separate private site, gated by Cloudflare Access so only the intended reader can open them. I follow a written policy on where client documents may and may not go. If I ever believed your information had been put at risk, I would tell you and, where the law requires, the Information Commissioner's Office.
Your rights
You can ask me to:
- tell you what information I hold about you, and give you a copy;
- correct anything that is wrong or incomplete;
- delete it, where there is no good reason for me to keep it;
- restrict how I use it, or object to my using it, in certain circumstances;
- give you a copy in a form you can take elsewhere;
- stop sending you marketing, at any time, which I will always do;
- withdraw consent, where consent is what I rely on.
Email [email protected]. I may need to check that you are who you say you are. There is no charge, and I respond within one month.
Complaints
If you are unhappy with how I have handled your information, tell me first and I will look into it and reply in writing. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.
Changes to this notice
This version is dated 25 October 2026. I will update it when the way I work changes, and the current version is always the one at pandion.studio/privacy.