Privacy Policy
Last updated: 1 September 2026.
At The Online PA, we take your privacy seriously. This Privacy Policy explains what personal information we collect, why we use it, how we look after it and the choices you have.
We’ve tried to keep it as clear and straightforward as possible.
Who we are
The Online PA provides virtual assistant and business support services to businesses in the UK.
For personal information collected through this website and in connection with running The Online PA, we are the data controller. This means we decide how and why that information is used.
You can contact us about privacy or data protection at:
The Online PA
Henleaze Business Centre
Henleaze
Bristol
BS9 4PN
The information we collect
The personal information we collect depends on how you interact with us.
When you contact us
If you send an enquiry through our website, email us or otherwise get in touch, we may collect:
your name
your email address
your telephone number, if provided
your business or organisation name
information about your business and the support you are looking for
anything else you choose to include in your message
our correspondence with you
We use this information to respond to your enquiry, understand what you need and decide whether and how we may be able to help.
When you become a client
If you work with us, we may also collect information needed to manage our working relationship, including:
contact and business details
information needed to provide the agreed services
contractual information
billing, payment and transaction records
records of our communications
information reasonably required to manage and deliver our services
We only collect information that is relevant to the work we are carrying out.
When you join our mailing list
If you choose to join our mailing list, we collect your:
first name
last name
email address
We use this information to send occasional emails with practical ideas, useful information, business updates and relevant news from The Online PA.
You can unsubscribe at any time using the unsubscribe link included in our emails.
When you use our website
We collect information about how the website is used through Squarespace Analytics and Google Analytics 4 (GA4).
This may include:
pages visited
approximate geographical location
device and browser information
how you arrived at the website
interactions with pages and content
dates and times of visits
website usage and performance information
We use this information to understand how people find and use our website, identify what is useful and improve the website and our marketing.
Google Analytics is treated as an optional analytics service and is controlled through our cookie consent settings where consent is required.
You can find more information in our Cookie Policy.
Why we use your information
Under UK data-protection law, we need a valid reason — known as a lawful basis — for using personal information.
Depending on the circumstances, we rely on the following.
Contract
We may use your information where it is necessary to:
take steps at your request before entering into a contract
provide services you have asked us to provide
manage our contractual relationship with you
Legitimate interests
We may use personal information where it is reasonably necessary for our legitimate business interests and those interests do not override your rights.
This may include:
responding to general enquiries
managing client relationships
operating and improving our business
keeping appropriate business records
maintaining the security and performance of our website and systems
preventing fraud or misuse
establishing, exercising or defending legal claims
Where we rely on legitimate interests, we consider the impact on your privacy and only use information where we believe the use is necessary and proportionate.
Consent
We rely on your consent where appropriate, including for:
sending marketing emails where consent is required
using Google Analytics 4 and other optional cookies or similar technologies where consent is required
You can withdraw your consent at any time.
Legal obligations
We may also need to use or retain information to comply with legal or regulatory requirements, including tax, accounting and other record-keeping obligations.
Google Analytics 4
We use Google Analytics 4 (GA4) on this website.
Google Analytics helps us understand how visitors find and interact with the website so that we can measure its performance and make informed improvements.
Information collected through Google Analytics may include:
pages viewed
website interactions and events
approximate geographical area
device type
browser information
traffic source
how visitors move through the website
Google Analytics uses cookies including _ga and cookies beginning _ga_ to distinguish visitors and sessions and measure website usage.
For visitors in the UK, Google states that Google Analytics does not log or store individual IP addresses. IP addresses may be used temporarily to derive general geographical information before being discarded.
Google Analytics cookies are managed through our cookie consent system where consent is required.
You can accept, decline or manage analytics cookies through the cookie controls available on this website.
More information about the cookies used by Google Analytics is available in our Cookie Policy.
Mailing list and marketing
We will only send you marketing emails where we have an appropriate lawful basis to do so.
If you actively join our mailing list, we will normally rely on your consent.
Every marketing email we send will include a way to unsubscribe.
If you unsubscribe, we may retain a minimal record of your email address on a suppression list so that we can respect your preference and avoid accidentally adding you back to marketing communications.
Your right to object to direct marketing
You have the right to object to the use of your personal information for direct marketing at any time.
You can do this by using the unsubscribe link in an email or contacting us.
We will stop using your information for direct marketing following your request.
Who we share information with
We do not sell your personal information.
We may share information with trusted organisations that help us operate the website and run the business where this is necessary.
These may include:
Squarespace, which hosts and supports our website and may process website, form and mailing-list information
Google, through our use of Google Analytics 4
email, cloud storage and other technology providers
members of The Online PA team and trusted contractors where access is necessary to provide services
accountants, insurers, legal advisers and other professional advisers
government bodies, regulators, law-enforcement agencies or other authorities where we are legally required to provide information
Where another organisation processes personal information on our behalf, we expect it to handle that information securely and in accordance with applicable data-protection requirements.
When we process information for our clients
As part of providing virtual assistant and business support services, The Online PA may sometimes handle personal information that belongs to or is controlled by a client.
For example, this could include information contained within a client's:
inbox
CRM
administrative systems
customer or client records
website
booking systems
other business tools
In these circumstances, the client will normally be the data controller and The Online PA will act as a data processor on the client's instructions.
That processing is governed by the arrangements we have with the relevant client, including appropriate data-protection terms where required.
This Privacy Policy primarily explains how The Online PA uses personal information for its own business purposes.
International transfers
Some of the technology providers we use, including Google and Squarespace, operate internationally.
This means personal information may sometimes be processed or made accessible outside the UK.
Where a restricted international transfer takes place, we take appropriate steps to ensure the information is protected in accordance with UK data-protection law.
Depending on the provider and destination, safeguards may include:
UK adequacy regulations or an applicable UK data bridge
approved contractual safeguards
the UK International Data Transfer Agreement
the UK Addendum to approved standard contractual clauses
another lawful transfer mechanism
You can contact us if you would like more information about safeguards relevant to your personal information.
How long we keep information
We only keep personal information for as long as we reasonably need it for the purpose for which it was collected, including legal, accounting and reporting requirements.
Enquiries
If you make an enquiry but do not become a client, we will normally retain relevant correspondence and contact information for up to two years after our last meaningful contact, unless there is a reason to keep it for longer.
Client records
Where you become a client, we retain information for the duration of our working relationship and afterwards for as long as reasonably required for legal, contractual, insurance, accounting and tax purposes.
Certain business and financial records may need to be retained for around six years.
Mailing list
We retain your mailing-list information until you unsubscribe or we otherwise decide it is no longer appropriate to keep it.
We may retain a minimal suppression record after you unsubscribe so we can continue to respect your preference.
Website analytics
Google Analytics 4 user-level and event-level data is retained for up to 14 months, in accordance with our Google Analytics data-retention settings.
GA4 allows user-level and event-level data to be retained for a defined period, while aggregated reporting information may be retained differently.
Squarespace Analytics information is retained in accordance with Squarespace's applicable systems and settings.
We periodically review the information we hold and securely delete or anonymise information that we no longer need.
Keeping your information secure
We take reasonable technical and organisational measures to protect personal information from:
unauthorised access
accidental loss
misuse
alteration
inappropriate disclosure
Access to personal information is limited to people who reasonably need it for their work.
No method of storing or transmitting information can be guaranteed to be completely secure, but we take proportionate steps to reduce the risks.
Your data-protection rights
Depending on the circumstances, UK data-protection law gives you rights over your personal information.
These may include the right to:
access the personal information we hold about you
correct inaccurate or incomplete information
ask us to delete your information in certain circumstances
ask us to restrict how your information is used in certain circumstances
object to certain uses of your information
receive or transfer certain information in a portable format
withdraw consent where we rely on consent
These rights are not absolute and different rights apply depending on why and how we are using your information.
If you would like to exercise a right, please contact us.
We may need to ask for enough information to confirm your identity before dealing with a request.
We will respond in accordance with the timescales required by data-protection law.
Automated decision-making
We do not use personal information to make decisions about you based solely on automated processing where those decisions would have legal or similarly significant effects.
Data-protection complaints
If you have a concern or complaint about the way we have handled your personal information, please contact us.
We will take appropriate steps to consider and investigate your complaint and will deal with it in accordance with applicable UK data-protection requirements.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data-protection regulator.
Information you choose to send us
Please take care when including personal information in free-text enquiry forms or emails.
We do not generally need sensitive or special-category personal information through our website, so please avoid providing it unless it is genuinely necessary.
If we receive such information, we will handle it in accordance with applicable data-protection law.
Links to other websites
Our website may contain links to websites, platforms or services operated by other organisations.
We are not responsible for the privacy practices of those third parties.
If you follow an external link, the privacy policy of that organisation will apply to any information it collects.
Cookies
Our website uses cookies and similar technologies.
Some are necessary for the website to function. Others, including Google Analytics 4 and Squarespace analytics cookies, are used in accordance with the choices available through our cookie banner where consent is required.
You can choose to accept, decline or manage optional cookies.
For more information, please see our Cookie Policy.
Changes to this Privacy Policy
We may update this Privacy Policy from time to time if:
our services change
the technology we use changes
our use of personal information changes
relevant laws or regulatory guidance change
The date at the top of this page shows when the policy was last updated.
Contact us
For questions, requests or complaints about privacy or personal information, contact:
The Online PA
Henleaze Business Centre
Henleaze
Bristol
BS9 4PN