Nine Bar
MembersGet started

Privacy and cookies.

What we know about you, why, who else sees it, how long we keep it and what you can ask us to do. Last updated 5 October 2026.

The short version

  • We use your details to sell you the Programme and The Room, run the member area, keep the website secure, answer your emails and keep the records the law requires. Nothing else.
  • Stripe takes your payment. We never see your full card number.
  • We do not keep a customer database. Stripe is our record of who has paid.
  • We do not use analytics or advertising cookies. The member area uses one cookie to keep you signed in.
  • We do not sell your data and we do not send marketing emails.
  • You can ask to see, correct or delete your data at any time.

Who is responsible for your data

Jamie Mussett Harford, a self-employed sole trader (autónomo) in Spain, trading as Nine Bar, is the controller of your personal data. That means Jamie decides how it is used and is responsible for it.

We have not appointed a data protection officer. Jamie deals with every privacy question personally.

What we use and why

Buying and paying

  • What: your name, email address, country, what you bought, and whether your payments went through. Stripe also tells us your card type and the last four digits of your card.
  • Why: to take your payment, give you what you bought, run your Room membership, send receipts and reminders, handle refunds, and email you about your membership, such as changes to sessions, prices or these terms.
  • Legal basis: it is needed for our contract with you.
  • How long: we keep invoices and payment records for six years, to meet Spanish tax and accounting rules. Stripe also keeps its own records, as its privacy policy sets out.

Your member area and sign-in

  • What: your email address, your Stripe customer reference, which products you have, and when you signed in. Your personal sign-in code is worked out from your email address. It is not stored anywhere.
  • Why: to sign you in, show you the lessons that are open to you, and check now and then with Stripe that your membership is still active.
  • Legal basis: it is needed for our contract with you.
  • How long: the sign-in cookie stays on your device until 180 days after you last used the member area, or until you sign out. Jamie can look up your sign-in code if you lose it.

The Room

  • What: your name, and what you choose to say or show in sessions and in your group of six. Other members of your group see this.
  • Why: to run the sessions and groups you joined.
  • Legal basis: it is needed for our contract with you.
  • Recordings: we tell you before a session is recorded. You can keep your camera and microphone off and still take part. Recordings are shared only with members inside the member area, never published. If you appear in a recording and want it removed, ask us and we will remove it or cut you out. Recordings are kept while the member area is open.

Emails, enquiries and applications

  • What: whatever you send us, such as your name, email address, and details about you and your business. Please do not send health details or other sensitive information unless you need to.
  • Why: to answer you, and to consider applications for The Table or Private Counsel.
  • Legal basis: for applications and questions about buying, taking steps you asked for before a contract. For other messages, our legitimate interest in answering the people who write to us.
  • How long: two years after our last exchange. Applications that do not lead to a seat or an engagement: 12 months. We keep anything needed for a purchase record, a complaint or a legal claim for as long as that needs.

Running and protecting the website

  • What: technical data your browser sends with every request, such as your IP address, browser type, the page asked for and the time.
  • Why: to deliver the pages, keep the site secure and stop misuse, such as people trying to get into the member area without paying.
  • Legal basis: our legitimate interest in running a secure website. You can object to this (see "Your rights").
  • How long: our hosting provider keeps these logs for a short time only, as its own terms set out. We do not use analytics.

Keeping records and dealing with claims

  • What: the records above, where we need them.
  • Why: to meet our tax and accounting duties, respond to complaints and rights requests, and deal with legal claims.
  • Legal basis: our legal obligations, and our legitimate interest in defending legal claims.

You need to give your email address and payment details to buy. Without them, we cannot sell to you. We do not make decisions about you by automated means that have legal or similarly serious effects. The member area simply checks, automatically, what you have paid for so it can show you the right pages.

Who else sees your data

We share only what each of these needs to do its job.

  • Stripe takes payments, runs subscriptions and sends receipts, reminders and payment emails. Stripe handles your payment on our behalf. For some purposes, such as preventing fraud and meeting its own legal duties, Stripe decides how to use the data itself, under its own privacy policy. The same applies if you choose to save your details with Stripe's Link on the payment page. If you pay with a digital wallet offered on that page, the wallet provider also handles the payment under its own privacy notice.
  • Vercel hosts the website. It runs the member area's server code in London and delivers pages from servers around the world.
  • Google provides our email (Gmail) and the typeface our pages use (Google Fonts). When a page loads, your browser asks Google for the font and so sends Google your IP address. Google does not set cookies for this.
  • YouTube (part of Google) or Vimeo play the lesson videos inside the member area. YouTube videos use its privacy-enhanced mode.
  • The video-call and group service used for The Room. We will name it here before The Room opens.
  • People who help Jamie run The Room, such as a session host, or a guest who leads a session in Jamie's place. They see what they need to run sessions and groups.
  • Our accountant or tax adviser, to keep our accounts and file tax returns.
  • Public bodies, such as the Spanish Tax Agency, courts or police, only when the law requires it.
  • Professional advisers, such as a lawyer, if we need advice about a complaint or claim.

We do not sell your data. We do not share it for advertising.

Data sent outside Europe

Stripe, Vercel, Google and Vimeo are based in, or use companies in, the United States. Each is certified under the EU-US Data Privacy Framework, which the European Commission has decided gives adequate protection. Where that does not cover a transfer, they use the European Commission's standard contractual clauses. Our server code runs in London. The European Commission has decided the UK gives adequate protection.

Cookies and similar technology

A cookie is a small file a website stores in your browser. Local storage works in a similar way. We use only what the member area needs to work. We do not use analytics or advertising cookies.

nb_session (cookie)

  • Set by: us.
  • What it does: keeps you signed in to the member area. It holds your email address, your Stripe customer reference, which products you have and when it was issued. It is signed, so it cannot be changed without us knowing.
  • How long: it is renewed when you use the member area, so it lasts until 180 days after your last visit, or until you sign out.

nb-done (local storage)

  • Set by: us, in your browser.
  • What it does: remembers which lessons you have marked as done. It stays in your browser and is not sent to us.
  • How long: until you clear your browser's data for this site.

Video players

  • Set by: YouTube or Vimeo.
  • What it does: when you open a lesson page that has a video, your browser loads the player from YouTube or Vimeo. The provider receives your IP address and may store information in your browser, especially once you press play.
  • How long: set by the provider.

Stripe's payment page

  • Set by: Stripe, on Stripe's own website.
  • What it does: Stripe uses cookies on its payment page for security and to prevent fraud.
  • How long: set by Stripe.

We use our own cookie and local storage only to run the member area you asked for. We do not use them to track you. You can delete them in your browser settings at any time. Deleting the cookie signs you out.

Your rights

You can ask us to:

  • give you a copy of the personal data we hold about you
  • correct anything that is wrong
  • delete your data, unless we have to keep it, for example for tax records
  • limit how we use it while a question about it is sorted out
  • stop using it where we rely on our legitimate interests
  • give you the data you gave us in a format you can take elsewhere

Where we rely on your consent, you can withdraw it at any time. To use any of these rights, email harfordjamie7@gmail.com. It is free. We reply within one month. If a request is complex, we may need up to two more months, and we will tell you if so. We may ask you to confirm who you are.

Complaining to a regulator

If you are unhappy with how we use your data, please tell us first so we can put it right. You can also complain to the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD), C/ Jorge Juan 6, 28001 Madrid, www.aepd.es. You can complain to the regulator in the country where you live instead. In the UK, that is the Information Commissioner's Office, ico.org.uk.

Children

Nine Bar is for adults. We do not knowingly sell to, or collect data from, anyone under 18.

Changes to this notice

We will update this notice when how we use data changes. The date at the top shows when it last changed. If a change matters to you, we will tell you by email before it takes effect.