Privacy and cookies

The short version

We use your details to sell you the Programme and The Room, run the member area, keep the website secure, answer your emails and keep the records the law requires. Nothing else.
Stripe takes your payment. We never see your full card number.
Stripe is our record of who has paid. The member area keeps its own small database: your Room profile, what you post, your messages, which lessons you have marked as done, and the private notes you write under a lesson.
Your email address is never shown to other members. They see the name and profile you choose.
We count visits without cookies (see "Counting visits"). The member area uses one cookie to keep you signed in. If we are advertising on Google, a small note asks whether Google may set its advertising cookies, and nothing is set until you say yes.
We do not sell your data and we do not send marketing emails.
You can ask to see, correct or delete your data at any time.

Who is responsible for your data

Jamie Mussett Harford, a self-employed sole trader (autónomo) in Spain, trading as Nine Bar, is the controller of your personal data. That means Jamie decides how it is used and is responsible for it.

Tax number (NIE/NIF): Y7301484X
Palma de Mallorca, Illes Balears, Spain.
Email: harfordjamie7@gmail.com

We have not appointed a data protection officer. Jamie deals with every privacy question personally.

What we use and why

Buying and paying

What: your name, email address, country, what you bought, and whether your payments went through. Stripe also tells us your card type and the last four digits of your card.
Why: to take your payment, give you what you bought, run your Room membership, send receipts and reminders, handle refunds, and email you about your membership, such as changes to sessions, prices or these terms.
Legal basis: it is needed for our contract with you.
How long: we keep invoices and payment records for six years, to meet Spanish tax and accounting rules. Stripe also keeps its own records, as its privacy policy sets out.

Your member area and sign-in

What: your email address, your Stripe customer reference, which products you have, and when you signed in. Your personal sign-in code is worked out from your email address. It is not stored anywhere.
Why: to sign you in, show you the lessons that are open to you, and check now and then with Stripe that your membership is still active.
Legal basis: it is needed for our contract with you.
How long: the sign-in cookie stays on your device until 180 days after you last used the member area, or until you sign out. Jamie can look up your sign-in code if you lose it.

The Room

What: the profile you fill in (the name you choose, one line about what you do, and if you wish your city, sector, what the next twelve months are about and a few lines about you); the threads, replies and direct messages you write; your group's chat; the posts you mark as useful; members you block; reports you make; the group you join; when you agreed to the house rules; and when you last came in. Also what you choose to say or show in live sessions.
Who sees it: every member of The Room sees your profile, your threads and your replies. Your group's chat is seen only by the members of your group. A direct message is seen only by you and the person you wrote to. Jamie, and a host if Jamie appoints one, can read a message only when somebody reports it, and then only that message and the ten before and after it. Jamie can see your email address in the Room's member list; a host cannot.
Why: to run The Room, the groups and the sessions you joined, and to keep The Room safe under its house rules.
Legal basis: it is needed for our contract with you. Handling reports and keeping The Room safe is also in our legitimate interest and that of the other members.
How long: while the member area is open. If you leave The Room, what you wrote stays, so that other members' conversations still make sense. Ask us and we will erase your profile, your replies and your messages; a thread you started that others have answered stays, with your opening post replaced by a note.
Be careful what you share: please do not post health details or other sensitive information about yourself unless you are happy for the members who can see it to read it, and never post anybody else's.
Recordings: we tell you before a session is recorded. You can keep your camera and microphone off and still take part. Recordings are shared only with members inside the member area, never published. If you appear in a recording and want it removed, ask us and we will remove it or cut you out. Recordings are kept while the member area is open.

Your progress and notes

What: which lessons you have marked as done; the private notes you write under a lesson; and two small markers: that you have added the dates to your diary, and that you have put away the first-week list.
Who sees it: only you. They are kept under your Stripe customer reference, not your email address. No other member can see them, and Jamie's tools do not show them.
Why: so your progress and notes follow you from one device to the next.
Legal basis: it is needed for our contract with you.
How long: while the member area is open. You can remove a note by deleting its text, and untick a lesson at any time. Ask us and we will erase all of them. If you ask us to erase your Room profile, they are erased with it.

Free accounts

What: the name and email address you give, which page you made the account from, whether you asked for occasional emails, when you made it and when you first signed in with your code. For a day, a scrambled form of your internet address, only to limit how many accounts one device can make in an hour.
Why: to give you the free resources, send your sign-in code, and, only if you ticked the box, send you new resources and Jamie's notes now and then.
Legal basis: it is needed to provide the account you asked for. The occasional emails rest on your consent, which you can withdraw at any time by replying to one of them or emailing Jamie.
How long: until you delete the account, which you can do yourself on the free resources page, or ask us to. The sign-in cookie stays on your device for up to 180 days, or until you sign out.

Emails, enquiries and applications

What: whatever you send us, such as your name, email address, and details about you and your business. Please do not send health details or other sensitive information unless you need to. An application or enquiry made with a form on this site is kept in the member area's database (hosted by Neon, in London) for Jamie to read; one made by email stays in email.
Why: to answer you, and to consider applications for The Table or Private Counsel.
Legal basis: for applications and questions about buying, taking steps you asked for before a contract. For other messages, our legitimate interest in answering the people who write to us.
How long: two years after our last exchange. Applications that do not lead to a seat or an engagement: 12 months. We keep anything needed for a purchase record, a complaint or a legal claim for as long as that needs.

Running and protecting the website

What: technical data your browser sends with every request, such as your IP address, browser type, the page asked for and the time.
Why: to deliver the pages, keep the site secure and stop misuse, such as people trying to get into the member area without paying.
Legal basis: our legitimate interest in running a secure website. You can object to this (see "Your rights").
How long: our hosting provider keeps these logs for a short time only, as its own terms set out.

Counting visits

What: which pages are viewed, the site that sent you, and your country, browser and type of device. We use Vercel Web Analytics, run by our hosting provider.
How: no cookies and nothing stored in your browser. Visits are counted with a short-lived anonymous identifier that changes every day and cannot be used to follow you across days or other sites. We never see your IP address or who you are.
Why: to know how many people read each page and each product, so we can improve them. Legal basis: our legitimate interest in running and improving the site.
How long: totals are kept by Vercel for the period its plan allows, as its terms set out.

Keeping records and dealing with claims

What: the records above, where we need them.
Why: to meet our tax and accounting duties, respond to complaints and rights requests, and deal with legal claims.
Legal basis: our legal obligations, and our legitimate interest in defending legal claims.

You need to give your email address and payment details to buy. Without them, we cannot sell to you. We do not make decisions about you by automated means that have legal or similarly serious effects. The member area simply checks, automatically, what you have paid for so it can show you the right pages.

Who else sees your data

We share only what each of these needs to do its job.

Stripe takes payments, runs subscriptions and sends receipts, reminders and payment emails. Stripe handles your payment on our behalf. For some purposes, such as preventing fraud and meeting its own legal duties, Stripe decides how to use the data itself, under its own privacy policy. The same applies if you choose to save your details with Stripe's Link on the payment page. If you pay with a digital wallet offered on that page, the wallet provider also handles the payment under its own privacy notice.
Vercel hosts the website. It runs the member area's server code in London and delivers pages from servers around the world.
Google provides our email (Gmail) and the typeface our pages use (Google Fonts). When a page loads, your browser asks Google for the font and so sends Google your IP address. Google does not set cookies for this.
Google Ads (part of Google) measures our advertising, when we are advertising. Its tag tells Google that a page was opened, and that an enquiry, a free account or a payment happened, so Google can count which adverts work. With your consent it also sets the cookies described under "Cookies" below; without it, Google receives only a cookieless ping with no identifier of you. Google handles this data under its own privacy policy.
Vimeo or Google Drive play course videos inside the member area. Course videos are shared only with enrolled members and never uploaded to YouTube or shared publicly. Other Room recordings may use YouTube (part of Google) in its privacy-enhanced mode.
Neon hosts the member area's database (Room profiles, posts, messages and groups, and your lesson progress and notes) on servers in London.
Google Meet (part of Google) runs the live sessions: the Monday lesson recording and the Thursday sessions. When you join, Google handles your name, your picture and voice if you turn them on, and anything you type in the call's chat. When a session is recorded, the recording is saved in Jamie's Google Drive and shown to members inside the member area. Google handles call data under its own privacy policy.
People who help Jamie run The Room, such as a session host, or a guest who leads a session in Jamie's place. They see what they need to run sessions and groups.
Our accountant or tax adviser, to keep our accounts and file tax returns.
Public bodies, such as the Spanish Tax Agency, courts or police, only when the law requires it.
Professional advisers, such as a lawyer, if we need advice about a complaint or claim.

We do not sell your data. We do not share your name, email address or anything you tell us for advertising.

Data sent outside Europe

Stripe, Vercel, Google, Vimeo and Neon are based in, or use companies in, the United States. Each is certified under the EU-US Data Privacy Framework, which the European Commission has decided gives adequate protection. Where that does not cover a transfer, they use the European Commission's standard contractual clauses. Our server code runs in London. The European Commission has decided the UK gives adequate protection.

Cookies and similar technology

A cookie is a small file a website stores in your browser. Local storage works in a similar way. We use what the member area needs to work, and, only if you allow it, Google's advertising cookies. Our visit counting uses no cookies.

nb_session (cookie)

Set by: us.
What it does: keeps you signed in to the member area. It holds your email address, your Stripe customer reference, which products you have and when it was issued. It is signed, so it cannot be changed without us knowing.
How long: it is renewed when you use the member area, so it lasts until 180 days after your last visit, or until you sign out.

nb-done (local storage)

Set by: us, in your browser.
What it does: remembers which lessons you have marked as done, so a page can show it straight away. The same list is saved to your account (see "Your progress and notes" above). Two small markers sit beside it: nb-done-synced records that this browser has handed its list to your account, and nb-install that you have hidden the note about keeping Nine Bar on your phone.
How long: until you clear your browser's data for this site.

Video players

Set by: YouTube, Vimeo or Google Drive.
What it does: when you open a course lesson with a video, your browser loads the player from Vimeo or Google Drive. Other Room recordings may also use YouTube. The provider receives your IP address and may store information in your browser, especially once you press play.
How long: set by the provider.

Google Ads (cookies and local storage, only with your consent)

Set by: Google, on this site, only after you press "Allow" on the cookie note.
What it does: cookies such as _gcl_au and _gcl_aw remember that you arrived from a Google advert, so Google can count an enquiry, a free account or a payment against that advert. If you press "No thanks", or do not answer, no advertising cookie is set and Google receives only a cookieless signal without any identifier of you.
How long: up to 90 days.
Your choice: we remember your answer in local storage (nb-consent) so the note does not return.

Stripe's payment page

Set by: Stripe, on Stripe's own website.
What it does: Stripe uses cookies on its payment page for security and to prevent fraud.
How long: set by Stripe.

We use our own cookie and local storage only to run the member area you asked for and to remember your cookie choice. We do not use them to track you. You can delete them in your browser settings at any time. Deleting the cookie signs you out.

Your rights

You can ask us to:

give you a copy of the personal data we hold about you
correct anything that is wrong
delete your data, unless we have to keep it, for example for tax records
limit how we use it while a question about it is sorted out
stop using it where we rely on our legitimate interests
give you the data you gave us in a format you can take elsewhere

Where we rely on your consent, you can withdraw it at any time. To use any of these rights, email harfordjamie7@gmail.com. It is free. We reply within one month. If a request is complex, we may need up to two more months, and we will tell you if so. We may ask you to confirm who you are.

Complaining to a regulator

If you are unhappy with how we use your data, please tell us first so we can put it right. You can also complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. You can complain to the regulator in the country where you live instead. In the UK, that is the Information Commissioner's Office, ico.org.uk.

Children

Nine Bar is for adults. We do not knowingly sell to, or collect data from, anyone under 18.

Changes to this notice

We will update this notice when how we use data changes. The date at the top shows when it last changed. If a change matters to you, we will tell you by email before it takes effect.

Privacy and cookies.