Privacy Policy

Who controls your data

Josh Willett Consultancy, a French single-member limited liability company (EURL), is the controller of the personal data collected through this website.

Processing is governed by the General Data Protection Regulation (GDPR) and the French Data Protection Act. Where it concerns people in the United Kingdom, the UK GDPR also applies. Josh Willett Consultancy is not required to appoint a data protection officer. Privacy requests go to the email address above.

What information is collected

The data collected depends on how you use the website.

• When you send an enquiry, the form collects your name, your email address, your website address and your message.
• When you correspond by email or telephone, the information you provide becomes part of the business correspondence.
• Google Analytics 4 may collect usage information such as the pages viewed, approximate location, device, browser, the source of the visit and interactions with the website.
• Cloudflare may process technical request data, including the IP address, browser information and security signals, in order to deliver and protect the website.

Josh Willett Consultancy does not knowingly collect sensitive data through the form. Please do not send confidential information that is not needed for your enquiry.

Why the information is used and on what legal basis

Personal data is used to reply to enquiries, discuss the services requested, prepare a proposal, deliver the agreed work, keep business records, protect the website and understand how it is used.

The legal basis depends on the activity:

• enquiries and early discussions rely on steps taken at your request before entering into a contract and, depending on the context, on the legitimate interest in replying to a business enquiry
• client work is processed to perform a contract
• invoicing, accounting and administrative records are kept to comply with legal obligations
• protecting and securing the website relies on legitimate interest
• business-to-business prospecting emails rely on legitimate interest: they concern an offer relevant to the recipient's job, and every message offers a way to opt out
• non-essential audience measurement cookies rely on your consent where consent is required

Cookies and analytics

The website uses technologies that are necessary for its security and operation. Cloudflare may use essential cookies to protect and deliver the website.

Google Analytics 4 is used to measure traffic and how the website is used. You can limit or delete cookies in your browser settings.

You can also use the opt-out tools Google provides for Google Analytics.

Service providers and recipients

Data is available only to the people and providers who need it to run the website, reply to enquiries or deliver the work concerned.

• Cloudflare for hosting, content delivery and website security
• Resend for passing form enquiries to the company's email inbox
• Google Workspace for email and business correspondence
• Google Analytics 4 for website measurement
• Google Fonts for delivering fonts when they are loaded from Google's services
• the company's accountant, for invoicing and accounting records

These providers act under their own terms and data protection commitments. Josh Willett Consultancy does not sell or rent your personal data.

Transfers outside the European Economic Area

Some providers may process data outside the European Economic Area, including in the United States. Where that happens, the processing is covered by an adequacy decision such as the EU-US Data Privacy Framework, by standard contractual clauses or by another transfer mechanism provided for by the GDPR, depending on the provider.

How long information is kept

• Enquiries and prospect correspondence are kept for up to three years after the last contact.
• Client records and contracts are kept for the length of the contract and five years after it ends.
• Invoices and accounting records are kept for ten years.

Technical security data and audience measurement data follow the retention periods configured with the providers concerned.

Your rights

Depending on the circumstances, you can ask for:

• access to your personal data
• correction of data that is inaccurate
• erasure of your data
• restriction of processing
• portability of the data concerned
• an end to processing based on legitimate interest, by objecting to it
• withdrawal of your consent where consent is the legal basis
• instructions to be recorded about what happens to your data after your death, a right provided by French law

Exercising your rights

To exercise a right, write to [email protected]. Proof of identity may be requested only where it is needed to confirm who is making the request.

You can also lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France, or visit cnil.fr. If you are in the United Kingdom, you can complain to the Information Commissioner's Office at ico.org.uk.

Data security

Proportionate technical and organisational measures are used to protect data against unauthorised access, loss, alteration or disclosure. No online service can guarantee absolute security.

JWC Social Publisher and Facebook Page data

JWC Social Publisher is the Facebook publishing tool operated by Josh Willett Consultancy EURL. It prepares and publishes approved Page posts through Meta’s API. Access is limited to Pages whose managers have authorised the service. The current live connection is a pilot on Josh Willett’s own Page; client connections require separate authorisation.

Information used by the publishing service

The service uses the authorised Page’s ID and name, its access credential, approved post text, links or images, approval and scheduling details, and publication results such as post IDs, public links, timestamps and errors. Meta may provide basic profile information during an authorisation flow; the publishing worker uses a business-issued Page credential.

The requested permissions are pages_show_list to identify available Pages, pages_read_engagement to verify Page content and publication, and pages_manage_posts to publish approved posts. This publishing service does not request access to personal timelines, private messages or advertising accounts.

Purpose, access and storage

Page data is used to deliver the agreed publishing service, verify the destination and publication result, and prevent duplicate posts. It is not sold, rented or used for advertising profiles. When processing Page content on a client’s instructions, Josh Willett Consultancy acts as the client’s service provider; the client remains responsible for its Page and the content it approves.

Only authorised operators and the providers needed to deliver the service have access. These include Meta for Facebook publishing, Google Workspace for the approval calendar, Google Cloud for protected credentials, and the hosting provider for the publishing server. The international-transfer information above also applies to these providers.

Access credentials are kept in protected secret storage while the connection is authorised. Approved copy and publication records follow the client-record retention period stated above. A valid deletion request is assessed separately from routine retention; any information that must be retained for a legal obligation or a legal claim is identified in the response and restricted to that purpose.

Disconnecting JWC Social Publisher and deleting data

To stop future publishing, remove the service’s business or system-user access to your Page in Meta’s business settings, or contact Josh Willett Consultancy to disable the connection. Disconnecting does not automatically remove posts already published on Facebook.

To request access, correction or deletion of information held by this service, email [email protected] with the subject “JWC Social Publisher data request”. Include your Page URL, the email address used for the service and what you want removed. Never send your Facebook password or an access token.

We verify that the request comes from the person concerned or an authorised Page representative, stop any affected publishing, and review the credentials, calendar entries and publication records covered by the request. We explain what has been removed, what remains and why. We respond within one month; if a lawful extension is needed, we explain it within that period. Published Facebook content remains under the Page manager’s control and Meta’s own data practices. The rights and complaint routes above remain available.

Changes to this policy

This policy may be updated when the website, the providers or the legal requirements change. The date of the last revision is shown at the top of the page.

Details of the publisher and the host are in the legal notice.