Last updated: 25 September 2026

1. Who I Am

1.1 This website and business are run by Sarah Edwards, trading as Beyond the Mountains Virtual Support ("Beyond the Mountains", "I", "me"). I am the data controller for the personal information described in this policy.

1.2 I am registered with the Information Commissioner's Office (registration ZB615247).

1.3 If you have any questions about this policy or your information, please email [email protected].

2. What This Policy Covers

2.1 This policy explains how I collect and use personal information about website visitors, people who enquire or book a call, newsletter subscribers, and clients.

2.2 It also explains how I handle information held in clients' own systems when I work in them. This is covered in section 5.

3. Information I Collect

3.1 I may collect:

• your name, email address, phone number, and business details, when you fill in a form, book a call, or get in touch
• notes from calls and the content of emails and messages we exchange
• information needed to deliver work for you, such as project details and platform access
• billing details, such as your business address and payment records (card payments are handled by Stripe, and I do not see or store your card details)
• your email address and preferences, if you sign up to my newsletter
• basic technical information about how the website is used, through cookies (see section 10)

4. How I Use Your Information

4.1 I use your information, and rely on the following lawful bases, to:

• reply to enquiries and arrange calls, before we agree any work (legitimate interests, or steps taken at your request before a contract)
• deliver the work we have agreed and manage our working relationship (contract)
• send invoices and keep financial records (legal obligation)
• send my newsletter, if you have signed up (consent, which you can withdraw at any time by unsubscribing)
• keep the website running securely and understand how it is used (legitimate interests)

4.2 I do not sell your information, and I do not use it for automated decision-making.

5. When I Work in Your Systems

5.1 When I work in a client's systems, such as their CRM, website, email platform, or practice management software, I may be able to see personal information about their customers, patients, or contacts. In these cases the client is the data controller, and I act as a data processor on their behalf.

5.2 As a data processor, I will:

• only access or use that information as needed for the work the client has asked me to do
• keep it confidential and never use it for any other purpose
• tell the client without undue delay if I become aware of a data breach affecting their information
• help the client respond to requests from the people whose data they hold
• remove my access and delete any login details within 6 weeks of our work ending

5.3 Some clients hold health information or information about children. I hold an Enhanced DBS certificate and current safeguarding training, and handle this information with particular care.

5.4 For clients with a GoHighLevel sub-account provided by me, further detail is set out in the Sub-Account Terms.

6. Who I Share Your Information With

6.1 I use trusted service providers to run my business. They only process your information on my behalf, and include:

• GoHighLevel, for my website, forms, bookings, CRM, and emails
• Google Workspace, for email, calendar, and file storage
• Stripe, for card payments
• Zoom, for video calls

6.2 I may also share information with professional advisers, such as an accountant or insurer, where needed, or where I am required to by law.

7. International Transfers

7.1 Some of my service providers store data outside the UK, including in the United States. Where this happens, the transfer is protected by the UK-US Data Bridge or by approved contract terms, such as the UK International Data Transfer Addendum.

8. How Long I Keep Your Information

• Enquiries that do not lead to work: up to 2 years from our last contact
• Client records and financial records: 7 years after our work ends, to meet tax and legal requirements
• Newsletter details: until you unsubscribe
• Client login details and access: deleted within 6 weeks of our work ending
• GoHighLevel sub-account data: as set out in the Sub-Account Terms

9. Keeping Your Information Secure

9.1 I take appropriate steps to protect your information. These include multi-factor authentication on my accounts, a secure password manager for storing and sharing login details, and using reputable providers who meet recognised security standards.

9.2 I work alone, so your information is not shared with staff or subcontractors unless I have agreed this with you first.

10. Cookies

10.1 This website uses cookies that are needed for it to work, such as those that keep forms and bookings running securely. It does not use advertising cookies.

10.2 You can control or delete cookies through your browser settings. Blocking essential cookies may stop some parts of the website from working.

11. Your Rights

11.1 Under UK data protection law, you have the right to:

• ask for a copy of the information I hold about you
• ask me to correct information that is wrong or incomplete
• ask me to delete your information
• ask me to limit how I use your information
• object to how I use your information
• ask for your information in a format you can move to another provider
• withdraw your consent at any time, where I rely on consent

11.2 To make a request, email [email protected]. There is no charge, and I will respond within one month.

11.3 If your information is held in a client's system that I work in, your request should go to that business, as they are the data controller. I will help them respond.

12. Complaints

12.1 If you are unhappy with how I have handled your information, please contact me first so I can put it right.

12.2 You also have the right to complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.

13. Children

13.1 This website and my services are aimed at businesses and are not intended for anyone under 18.

14. Changes to This Policy

14.1 I may update this policy from time to time. The date at the top of this page shows when it was last changed.

If you have any questions about this policy, please email [email protected].