privacy policy

Privacy Policy

The Work In Progress · Olya Karpova

Last updated: April 2026

This policy explains what personal data I collect, why I collect it, how I use it, and what your rights are. It applies to anyone who visits the-work-in-progress.com, subscribes to the newsletter, purchases a workshop ticket, or enquires about or books a 1:1 therapy session.

I take privacy seriously and only collect what I genuinely need. Your data is never sold.

1. Who is responsible for your data

The data controller is Olya Karpova, trading as The Work In Progress, a sole trader based in London, UK.

ICO Registration Number: [ADD ONCE REGISTERED] · Email: hello@the-work-in-progress.com · Website: the-work-in-progress.com

2. What data I collect, why, and the legal basis

UK GDPR requires that I have a lawful basis for processing your personal data. Below is a breakdown of what I collect, why, and the legal basis I rely on in each case.

Newsletter subscribers

I collect your name and email address when you sign up for the newsletter. This is used solely to send you the bi-weekly newsletter you opted in to receive. The lawful basis is consent — you signed up voluntarily, and you can withdraw that consent at any time by unsubscribing.

Workshop ticket purchases

When you buy a ticket, I collect your name and email address to process your booking, send you joining instructions, and deliver the recording after the event. Payment is handled by Stripe, who collect your payment details directly. The lawful basis is contract — this information is necessary to fulfil your purchase.

1:1 therapy enquiries and sessions

When you get in touch to enquire about or book a therapy session, I collect your name, email address, and any details you share in your message. This is used to respond to your enquiry and, if you become a client, to manage our working relationship. The lawful basis is legitimate interests — it is necessary to provide the service you have requested.

Website visitors

When you visit the-work-in-progress.com, Squarespace automatically collects technical data including your IP address, browser type, device information, and pages viewed. This is used to keep the website running securely and to understand how it is being used. The lawful basis is legitimate interests.

Session scheduling via Calendly

If you book a 1:1 session using Calendly, Calendly collects your name, email address, and booking details. This is used to manage scheduling and send you appointment reminders. The lawful basis is contract and legitimate interests.

Cookies and tracking data

If you accept cookies via the banner on this website, analytics and marketing cookies may be set. This includes the Meta Pixel, which tracks certain actions on the site for the purpose of measuring ad performance and building advertising audiences. The lawful basis is consent. See section 4 for full details on cookies.

3. Third-party tools and processors

I use the following third-party services to run my business. Each acts as a data processor on my behalf, meaning they handle your data only as I instruct them to, and only for the purposes described.

Squarespace

My website is hosted on Squarespace. Squarespace collects technical data about your visit (browser, device, IP address, pages viewed) to keep the site running securely. Squarespace’s privacy policy is available at squarespace.com/privacy.

Flodesk

I use Flodesk to manage the newsletter and to process workshop ticket purchases via Flodesk Checkout. Flodesk stores your name and email address and sends emails on my behalf. Flodesk’s privacy policy is available at flodesk.com/privacy.

Stripe

Workshop ticket payments are processed by Stripe. I do not store your card details — Stripe handles payment processing securely. Stripe’s privacy policy is available at stripe.com/gb/privacy.

Google Meet and Gmail

I use Google Meet to host online therapy sessions and Google’s Gmail service for email enquiries and client communications. Google’s privacy policy is available at policies.google.com/privacy.

Calendly

I use Calendly to manage session scheduling for 1:1 therapy. When you book a session, Calendly collects your name, email address, and the details of your booking. Calendly’s privacy policy is available at calendly.com/privacy.

Meta (Facebook and Instagram)

I use Meta advertising tools to promote workshops and services on Facebook and Instagram. This includes the Meta Pixel, a small piece of code on my website that collects data about your visit (such as pages viewed and actions taken) when you have consented via the cookie banner.

This data is sent to Meta and used to measure how my ads perform, build audiences for advertising, and show relevant ads to people who have visited my site. Meta may also use this data in accordance with their own privacy policy, available at facebook.com/privacy/policy. You can manage your Meta ad preferences at facebook.com/ads/preferences.

Meta Pixel data is only collected when you have accepted the relevant cookies via the cookie banner on this website. If you decline cookies, the Pixel does not fire.

Google Fonts

This website uses Google Fonts to display text. When a page loads, your browser may send a request to Google’s servers, which may include your IP address. Google’s privacy policy is available at policies.google.com/privacy.

4. Cookies

This website uses cookies — small text files stored on your device. The cookie banner on the site gives you the option to accept or decline non-essential cookies.

Essential cookies

These are necessary for the website to function. They are set by Squarespace and cannot be turned off.

Analytics and performance cookies

These cookies collect information about how visitors use the site (pages visited, time spent, clicks). This helps me understand what’s working and improve the site. These are only set if you accept cookies.

Marketing cookies (Meta Pixel)

The Meta Pixel is activated only when you accept cookies. It tracks certain actions on this website to help measure ad performance and build advertising audiences on Facebook and Instagram. See section 3 for more detail.

You can withdraw your cookie consent at any time by clearing your browser cookies and revisiting the site, where the cookie banner will reappear.

5. How long I keep your data

I only keep your data for as long as necessary. Below are the retention periods I apply.

  • Newsletter subscribers: until you unsubscribe. Once you unsubscribe, your data is removed from the active list promptly.

  • Workshop attendees: up to 2 years after the event, to handle any follow-up queries and for my records.

  • 1:1 therapy clients: session notes and related records are kept for 7 years after the end of the therapeutic relationship, in line with professional guidance. Financial records are kept for 7 years in accordance with HMRC requirements.

  • General enquiries via Gmail: up to 1 year, unless the enquiry converts to an active client relationship.

  • Stripe payment records: 7 years, as required by HMRC.

After these periods, data is securely deleted.

6. Who I share your data with

I do not sell your data or share it with third parties for their own marketing purposes. Data is shared only with the processors listed in section 3, and only to the extent necessary for them to provide their services.

I may be required to disclose data if obligated to do so by law or a regulatory authority. Where this happens, I will notify you unless I am legally prevented from doing so.

Some of the third-party services I use (including Meta and Google) may process data outside the UK or EEA. Where this occurs, they are required to ensure appropriate safeguards are in place in accordance with UK GDPR.

7. Your rights

Under UK GDPR, you have the following rights in relation to your personal data:

  • Right to access: you can request a copy of the personal data I hold about you.

  • Right to rectification: you can ask me to correct any inaccurate or incomplete data.

  • Right to erasure: you can ask me to delete your data, subject to any legal obligations I have to retain it.

  • Right to restrict processing: you can ask me to limit how I use your data in certain circumstances.

  • Right to data portability: you can request your data in a structured, commonly used format.

  • Right to object: you can object to processing based on legitimate interests. If you object to receiving marketing communications, you can unsubscribe at any time.

  • Rights related to automated decision-making: I do not make any automated decisions about you using your personal data.

To exercise any of these rights, please email hello@the-work-in-progress.com. I will respond within one calendar month. I may need to verify your identity before processing your request.

8. How to make a complaint

If you have a concern about how I handle your data, please contact me first at hello@the-work-in-progress.com and I will do my best to resolve it.

If you are not satisfied with my response, you have the right to lodge a complaint with the UK’s data protection regulator, the Information Commissioner’s Office (ICO).

ICO website: ico.org.uk

9. Changes to this policy

I may update this policy from time to time, for example if I start using a new tool or if the law changes. The current version will always be available at the-work-in-progress.com. If I make a significant change, I will let active newsletter subscribers know by email.

10. Contact

If you have any questions about this policy or how I handle your data, please get in touch: hello@the-work-in-progress.com.

The Work In Progress · Olya Karpova · hello@the-work-in-progress.com · the-work-in-progress.com