Skip to content
home

Privacy notice

This notice explains what personal data I collect through terrymanu.com, why I collect it, who helps me handle it and what your rights are. I've kept it short and plain. If anything is unclear, ask me through the contact page.

Who I am

This is my personal website. I'm Terry Manu Hennah, and I run it as an individual, in a personal capacity. I am the controller of the personal data described here. That means I decide how it is used and I'm responsible for it under UK data protection law: the UK GDPR, the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

The best way to reach me about your data is the contact page. Please use the form rather than a LinkedIn message for privacy requests, so that I have a proper record and can reply properly.

What I collect and where it comes from

I only collect what you give me, plus a small amount of technical data your browser sends when you visit.

When you use the contact form, I collect your name, your email address, the topic you choose, your message, the page you sent it from, the wording you agreed to and the time you sent it.

When you sign up to the newsletter, I collect your email address, the exact wording you agreed to and when, the page you signed up on and any campaign tags in that page's address (such as where a link came from). I also record whether you have confirmed, when you confirmed and, if you leave, when you unsubscribed.

When you ask for a free resource by email, I collect your email address, which resource you asked for and when I sent it, and I email the download link to that address. Joining the newsletter is a separate choice: you're added only if you tick its box and then confirm.

When you download a free resource, I don't ask for anything: an instant download needs no email address. A download link sent by email lasts 72 hours. These links carry no personal data, and the links themselves are not stored.

When you visit the site, the hosting service receives the technical data every website receives: your IP address, the page you asked for, the time, and your browser's details. Search terms you type into the site's search box are part of the page address, so they are handled the same way. I don't keep a profile of you.

To stop spam and abuse, the site counts how often each form is used. It does this with a scrambled version of your IP address and of your email address (a keyed SHA-256 hash). The hash lets the site count repeat attempts, but it can't be turned back into your address. The counts, and the scrambled IP address saved with a message, are deleted after a day.

If you say yes to analytics, Google Analytics collects information about how you use the site. The data goes first to the site's own address, data.terrymanu.com, run for me on Microsoft Azure in the UK, which passes it on to Google. The cookie notice explains this in full.

If you say yes to advertising measurement or to personalised advertising, the advertising tags of Google Ads, Meta, LinkedIn and Microsoft Advertising collect information about your visit: the pages you visit and, with advertising measurement, whether you signed up, sent a message or downloaded a resource, with the identifiers in their cookies. With advertising measurement, when you send a message, the site's server also sends Meta a scrambled form of your email address (a SHA-256 hash). The cookie notice explains this in full.

Why I use your data and the lawful basis

  • Replying to your message. I use your contact details only to reply to you. My lawful basis is legitimate interests: you've asked me something and I want to answer.
  • Sending a free resource by email. I use your email address only to send you the link you asked for. My lawful basis is legitimate interests: you've asked me for it.
  • Sending the newsletter. I send it only if you ask for it and confirm by clicking the link in the confirmation email. My lawful basis is your consent, and I keep a record of exactly what you agreed to and when. You can withdraw your consent at any time with the one-click unsubscribe link in every email.
  • Analytics. Google Analytics runs only if you say yes to analytics in the cookie banner. My lawful basis is your consent, and you can change your mind at any time.
  • Advertising measurement, and personalised advertising and retargeting. The advertising tags run only if you say yes to that kind in the cookie banner, each kind separately. My lawful basis is your consent, and you can withdraw it at any time with "Cookie settings" in the footer.
  • Keeping the site safe. I use technical data and the hashed form counts to protect the site from spam, abuse and attacks. My lawful basis is legitimate interests: keeping the site working and secure for everyone.

I don't sell your data, and I don't use it for anything you wouldn't expect from this notice.

Who helps me handle your data

A few service providers handle data for me. They act only on my instructions.

  • Microsoft Azure hosts the website, its content system and its database, in the UK South region. Your messages, newsletter records and resource requests are stored there.
  • Azure Communication Services, also part of Microsoft Azure, sends the site's emails, such as the newsletter confirmation email and the copy of your message that comes to me. I receive that copy in my own email inbox.
  • Buttondown sends the newsletter. Once you've confirmed, your email address, the date you agreed and the page you signed up on are passed to Buttondown so it can send you each issue. When you unsubscribe, Buttondown is told straight away. Buttondown records whether each issue was delivered and may record whether it was opened or a link was clicked. I look at those figures only as totals for each issue.
  • Google provides Google Analytics, but only if you say yes to analytics. Until then, nothing from Google loads.
  • Google (Google Ads), Meta, LinkedIn and Microsoft (Microsoft Advertising) provide the advertising tags, but only if you say yes to advertising measurement or to personalised advertising. Until then, nothing from them loads. They also use this data for their own purposes, under their own privacy policies, so for advertising they don't act only on my instructions.

I may also share data if the law requires it.

Data stored outside the UK

Microsoft Azure stores the site's data in the UK. Buttondown, Google, Meta, LinkedIn and Microsoft may process data outside the UK, including in the United States. Where that happens, I rely on the safeguards UK law requires: a UK adequacy decision, such as the UK Extension to the EU-US Data Privacy Framework, or the UK International Data Transfer Addendum to the standard contractual clauses. You can ask me for details through the contact page.

How long I keep it

  • Contact messages: until I've dealt with your message, and no longer than 12 months after you sent it. The site deletes it automatically then. The scrambled IP address saved with it is deleted after a day.
  • Free resources sent by email: your email address is deleted automatically 7 days after the link is sent. The link stops working after 72 hours.
  • Newsletter sign-ups you don't confirm: the confirmation link stops working after 72 hours, and the sign-up is deleted automatically 30 days after the last confirmation email.
  • Newsletter subscribers: for as long as you stay subscribed.
  • After you unsubscribe: within a day, once the newsletter service has been told, your email address is deleted. What stays is a scrambled form of it (a keyed hash, which can't be turned back into your address), the dates you signed up, confirmed and left, and the wording you agreed to. That lets me show that I had your consent and that I stopped when you asked, and makes sure you're never added back unless you sign up again yourself. I keep it for as long as I send the newsletter. If you sign up again and confirm, it's removed.
  • Spam and abuse counts: the hashed records are deleted after a day.
  • Hosting logs: around 30 days.
  • Google Analytics: Google keeps the analytics data for 14 months, then deletes it. Google signals and ad personalisation are switched off, so the data isn't used for advertising. The cookie notice has the details.

Your rights

You have the right to:

  • ask for a copy of the personal data I hold about you
  • ask me to correct it if it is wrong
  • ask me to delete it
  • ask me to limit how I use it
  • object to my using it where I rely on legitimate interests
  • withdraw your consent at any time, where I rely on consent
  • ask for the data you gave me in a format you can take elsewhere

To use any of these rights, send me a message through the contact page. I may need to check it's really you before I act, for example by replying to the email address in question. I'll reply within one month. There is no charge.

To leave the newsletter, use the unsubscribe link in any email. It works in one click.

Complaints

If you're unhappy with how I've handled your data, please tell me first and I'll try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk.

Automated decisions

I don't make any decisions about you by automated means, and I don't profile you.

Children

This site is written for working professionals. It isn't aimed at children, and I don't knowingly collect children's data.

Keeping your data safe

The site sends everything over an encrypted connection. Your messages and subscriber records are stored in a database that only people I authorise can open, and the website itself can't read them back. Within the content system, only the people I give access to this site can see them. Confirmation and unsubscribe links use single-use codes, and only scrambled versions of those codes are stored.

Changes to this notice

I'll update this notice when the way I handle data changes. The date below shows when it last changed. If a change affects how I use data you've already given me, I'll tell you before it takes effect.

This notice was last updated on 16 October 2026.