Privacy Policy
Last updated: 7 August 2026
This policy explains what personal information I collect through this website, why I collect it, what I do with it and what control you have over it. I have written it in plain English rather than legal boilerplate, because a policy nobody can read is not much of a policy.
Who I am
I am Chris Willman. I trade as Big Brand Blueprint, providing marketing advisory, fractional CMO work, audits, speaking and workshops to founders and B2B organisations.
Big Brand Blueprint is a trading name of Blueprint Advisory Group Ltd, a company registered in England and Wales with company number 17241329. Registered office: 84 Hasker Road, Basingstoke, Hampshire, RG24 9NF.
For the purposes of UK data protection law, Blueprint Advisory Group Ltd is the data controller for the personal information described in this policy. That means I decide what is collected and why, and I am responsible for looking after it.
You can reach me about anything in this policy at chris@bigbrandblueprint.com, or by post at Blueprint Advisory Group Ltd, 84 Hasker Road, Basingstoke, Hampshire, RG24 9NF.
What this policy covers
This policy covers bigbrandblueprint.com and any subdomain of it. It covers information you give me through this site and information collected automatically while you browse it.
It does not cover other websites you reach from links here, including Amazon, LinkedIn and any event or publication site. Those organisations have their own policies and I have no control over them.
If you become a client, the way I handle information during an engagement is set out in our engagement paperwork rather than here.
The information I collect
Information you give me
When you use the contact form or request an intro call. Your name, your email address, your organisation, and whatever you choose to write in the message. If you include a phone number or details about your business, I hold that too.
When you book a call. Booking is handled by Calendly. Calendly collects your name, your email address, the time you selected and anything you type into the booking form, and passes it to me.
When you subscribe to emails or download a guide. Your email address, and your first name if you give it. Downloads on this site are gated behind an email address, so subscribing and downloading are the same act.
When you use the Before You Spend assessment. This one collects more, so it gets its own section below.
When you email, call or message me directly. Whatever the message contains, plus the record that we spoke.
I do not ask for and do not want special category information, which means things like health, ethnicity, religious or political views. Please do not put any of that into a form on this site.
Information collected automatically
Analytics. I use Google Analytics to understand how many people visit, which pages they read and roughly where in the world they are. That produces information such as your approximate location at city level, your device and browser type, the pages you viewed, how long you stayed and which site or search you arrived from. I use it in aggregate. I am not trying to work out who you are and the reports do not tell me. Google Signals and advertising personalisation are switched off, so this data is not fed into any advertising system.
Server and hosting logs. This site is hosted by Replit. Like any web host, its servers record technical information including IP addresses, in order to serve pages and keep the service secure.
Search Console. I use Google Search Console, which tells me which search queries lead to this site and how pages perform in search results. It reports in aggregate and does not identify individuals.
The Before You Spend assessment
This tool asks you a series of questions and produces a scored report. Because it stores what you enter, it deserves a straight explanation rather than a footnote.
What it stores
When you start the assessment I store your first name, your email address, your sector, your turnover band, how long you have been operating, your marketing spend band, your answer to the optional free-text question about what is frustrating you, and a record of your consent with the date and time.
Your answers are saved as you go, question by question, rather than only at the end. That means if you stop halfway through, what you have already entered is stored.
When you finish, the calculated score, the pillar results, the pattern identified and the rest of the report data are stored alongside your profile.
Why, and my lawful basis
To produce and deliver your report, and to improve the tool. Lawful basis: your consent, given when you start the assessment, which you can withdraw at any time by emailing me.
Your email address and your overall score are also sent to Kit, my email platform, so I can send you the report and so that follow-up emails make sense in context. Your individual answers are not sent to Kit.
How your report is accessed
Your report lives at a unique web address containing a long random token. Anyone who has that link can open the report, so treat the link as private and think before you forward it. There is no login, which keeps it simple, but it means the link is the key.
How long it is kept
Completed assessments are deleted 24 months after completion. Assessments that were started but not finished are deleted after 90 days.
One request
The free-text question asks what is frustrating you about your marketing. Please keep it about the marketing. Do not put confidential business information, or anything about identifiable individuals such as members of your team, into that box.
Why I use it, and my lawful basis
UK data protection law requires a specific lawful basis for each use. Here is the honest breakdown.
To reply to your enquiry and talk about working together. Lawful basis: legitimate interests, and where we are moving toward an engagement, steps taken at your request before entering a contract. My legitimate interest is straightforward, which is responding to people who have asked me to.
To deliver work if you become a client. Lawful basis: performance of a contract.
To send you emails you have asked for, including guides and articles. Lawful basis: your consent, which you give when you subscribe and can withdraw at any time.
To produce and send your Before You Spend report. Lawful basis: your consent.
To send occasional relevant emails to business contacts at organisations. Lawful basis: legitimate interests, and the corporate subscriber position under the Privacy and Electronic Communications Regulations. My legitimate interest is in offering a relevant service to organisations likely to want it. Every such email says who I am and gives you a one-click way to stop them.
To understand how the site is used and improve it. Lawful basis: legitimate interests. My legitimate interest is in knowing whether the site works. See the cookies section for how to opt out.
To keep proper business and tax records. Lawful basis: legal obligation, and legitimate interests in running a company properly.
To protect the site and deal with misuse. Lawful basis: legitimate interests in keeping the service secure.
If you want to know how I have weighed my interests against yours in any of the legitimate interests cases above, ask and I will explain it.
Email and marketing
If you subscribe, you get articles, occasional guides and notes about what I am working on. You can leave at any time using the unsubscribe link at the foot of every email, and it takes effect immediately. You do not have to give a reason and I will not email to ask for one.
I do not sell, rent, trade or otherwise hand your email address to anyone else for their own marketing. Ever. That is a commitment, not a formula.
When you unsubscribe I keep a record of your email address on a suppression list. That sounds counterintuitive but it is the only reliable way to make sure you are not added back later by accident.
My email is sent using Kit, formerly ConvertKit. Kit processes your email address and records whether emails were opened or clicked, so I can tell whether what I write is worth reading.
Who else sees your information
I keep the list short and I only use organisations that are contractually bound to process data on my instructions.
Kit. Email marketing. Holds your email address, name if given, engagement records and your Before You Spend score.
Calendly. Call booking. Holds the details you enter when booking.
Google. Analytics and Search Console, and Google Workspace for email, which means messages you send me are stored there.
Replit. Website hosting, the site database and the associated server logs.
Professional advisers. My accountant sees invoicing records. If I ever needed legal advice on a matter involving you, a solicitor would see what was relevant.
I will also disclose information where I am legally required to, for example in response to a valid request from a regulator, a court or a law enforcement body. If that happened I would tell you unless I were legally prohibited from doing so.
I do not sell your personal information. Nothing on this site involves passing your details to a third party for their own purposes.
Where your information is held
Some of the organisations above are based in the United States or store data outside the United Kingdom. Where that is the case, transfers are covered by the safeguards UK law recognises, which in practice means the UK International Data Transfer Agreement, the UK Addendum to the European Commission's standard contractual clauses, or the UK Extension to the EU-US Data Privacy Framework.
If you want to know which mechanism applies to a specific provider, ask and I will tell you.
How long I keep it
Enquiries that do not become work. Up to 24 months from our last contact, then deleted. Marketing advisory has a long consideration cycle and people often come back a year later, but there is no reason to hold it indefinitely.
Client records. For the duration of the engagement and then seven years from the end of the financial year in which it ended, which is what HMRC expects for company records.
Email subscribers. Until you unsubscribe. If you have not opened anything in 24 months I will either ask whether you still want to be there or remove you. A suppression record of an unsubscribed address is kept indefinitely, because that is what stops you being re-added.
Before You Spend assessments. 24 months after completion. 90 days if started but not finished.
Calendly bookings. Held for the duration of the booking and then in my email and calendar records under the enquiry or client timescales above.
Analytics. Retained in Google Analytics under its retention setting, currently 14 months.
Server logs. Retained by the host for a short period for security and diagnostics.
Keeping it secure
I use reputable providers, two-factor authentication on every account that offers it, and a password manager. Access is limited to me. Where a provider offers encryption at rest and in transit, it is on.
I will not pretend any system is completely secure, because none is. If there were a breach affecting your information that presented a real risk to you, I would tell you and I would report it to the Information Commissioner's Office within the required timeframe.
Your rights
Under UK data protection law you have the right to:
- Ask what personal information I hold about you and get a copy of it
- Have inaccurate information corrected
- Ask me to delete information, where there is no good reason for me to keep it
- Ask me to restrict how I use it while a question about it is resolved
- Object to my use of information where I am relying on legitimate interests
- Object to direct marketing at any time, which is absolute and which I must always honour
- Receive certain information in a portable machine-readable format
- Withdraw consent at any time, where consent is the basis I am relying on
Exercising any of these is free and you do not need to give a reason.
To use any of them, email chris@bigbrandblueprint.com. I may ask you to confirm who you are, which is a protection for you rather than an obstacle. I will respond within one month. If a request is genuinely complex I may extend that by up to two further months, and if I do I will tell you why within the first month.
Complaints
If you are unhappy with how I have handled your information, tell me first at chris@bigbrandblueprint.com. I will acknowledge your complaint within 30 days and I will try to sort it out properly rather than defensively.
You also have the right to complain directly to the Information Commissioner's Office, whether or not you have raised it with me. The ICO can be reached at ico.org.uk, on 0303 123 1113, or at Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
Children
This site is aimed at people running organisations and is not intended for anyone under 18. I do not knowingly collect information about children. If you believe a child has given me information, tell me and I will delete it.
Links to other sites
This site links to other places, including Amazon, LinkedIn and various event and publication websites. Following a link puts you on someone else's site under someone else's policy. I have no control over how they handle your information, so it is worth a look at their policy before handing anything over.
Changes to this policy
I will update this policy when what I do changes, or when the law does. The date at the top always reflects the current version. If a change materially affects how I use information you have already given me, I will tell subscribers by email rather than quietly editing the page.
Contact
Questions, requests or complaints about anything in this policy: chris@bigbrandblueprint.com, or Blueprint Advisory Group Ltd, 84 Hasker Road, Basingstoke, Hampshire, RG24 9NF.
See also: Terms of Use