Privacy notice
Last updated: 6 September 2026
This notice explains how I collect, use, store and share personal information when you visit this website, make an enquiry, book a service or ask me to carry out military-history research.
1. Who is responsible for your information?
Graeme MacPherson, trading as So, What happened?, is the data controller responsible for the personal information described in this notice.
Email: info@sowhathappened.co.uk
Business location: West Sussex, United Kingdom. Please use this email address for questions about this notice or to exercise your data-protection rights.
2. What information do I collect?
The information collected depends on how you interact with the business.
Enquiries and service bookings
When you make an enquiry or arrange a history talk, private walk, military-research project or battlefield visit, I may collect:
Your name and contact details.
The organisation or group you represent.
Your preferred dates, venue or destination.
Information about the service you require.
Correspondence, quotations, agreements and booking details.
Billing and transaction information.
Your communication and marketing preferences.
Feedback, complaints or information relating to a claim.
Public-walk bookings
When you book a public walk, I may collect:
The lead customer’s name, email address and telephone number.
The number of places booked.
Names of other participants, where requested.
Payment and transaction information.
Relevant accessibility or mobility requirements.
Emergency information that you choose to provide.
Please do not provide detailed medical information unless it is genuinely necessary for your safe participation. If you are unsure, contact me before submitting it.
Military-research enquiries and projects
To assess or undertake military research, I may collect:
Your name, contact details and relationship to the person being researched.
Information about the research question and what you hope to discover.
Names, dates, service numbers, units and other historical information.
Photographs, letters, military records and other documents you provide.Information obtained from archives, record offices and publicly available sources.
Information about living relatives or other living people where it is relevant to the agreed research. UK data-protection law applies to identifiable living people.
Information relating solely to a deceased person is not personal data under the UK GDPR. However, historical documents can also contain information about living people, and I will handle that information carefully.
You should only provide personal information about a living person where you have an appropriate reason or authority to do so. Do not upload identity documents or unnecessary sensitive information about living people without discussing this with me first.
Website information
When you visit the website, Squarespace may process technical information including:
Your IP address.
Browser, device and operating-system information.
Pages visited and links used.
Referring websites.
Dates and times of visits.
Cookie choices and similar technical information.
This information is used to operate, secure and, where you have consented to analytics cookies, improve the website.
Payment information
Payments are processed through Squarespace Commerce and the connected payment service.I receive confirmation of the transaction and information needed to administer your purchase. I do not receive or store your complete payment-card number or card security code.
Photographs and publicity
I will not use an identifiable photograph of you for promotional purposes without an appropriate lawful basis and, where required, your permission. Where photography is planned during a walk, talk or visit, participants will be informed and given an appropriate opportunity to decline.
3. Why do I use personal information?
I use personal information to:
Respond to enquiries and assess whether I can provide a service.
Prepare quotations, proposals and booking confirmations.
Deliver talks, walks, research and battlefield-planning or guiding services.Process public-walk purchases and manage attendance.
Produce agreed military-research reports.
Communicate with customers before, during and after a service.
Make reasonable accessibility arrangements and support participant safety.
Maintain financial and business records.
Prevent fraud, misuse and security incidents.
Deal with complaints, disputes and legal claims.
Improve the website and services.
Send marketing communications where you have agreed to receive them.
I do not use personal information for solely automated decision-making that produces legal or similarly significant effects.
4. Lawful bases
I rely on the following lawful bases:
Contract
I use information where it is necessary to take steps at your request before entering into a contract or to perform an agreed contract. This includes assessing enquiries, preparing quotations, administering bookings, taking payment and delivering services.
Legal obligation
I retain and use certain information where necessary to meet tax, accounting, consumer-protection or other legal obligations.
Legitimate interests
I may use information where necessary for the legitimate interests of operating and protecting a small business, provided that those interests are not overridden by your rights. These interests include:
Responding to genuine business enquiries.
Maintaining appropriate customer and project records.
Securing the website and preventing fraud.
Establishing, exercising or defending legal claims.
Improving services and customer experience.
Conducting agreed military research using relevant archival and publicly available sources.
When research involves information about a living person, I will consider the necessity of using the information, its source, its sensitivity and the likely effect on that person. I will not publish that information as part of a public family tree or public profile.
Consent
I rely on consent for:
Optional email marketing where consent is required.
Non-essential analytics or performance cookies.
Promotional use of photographs where consent is appropriate.
Health or accessibility information requiring explicit consent.
You can withdraw your consent at any time by contacting me. Withdrawal will not affect processing that took place before consent was withdrawn.
5. Information about health, accessibility and safety
Information about a living person’s health may be special-category personal data and requires additional protection. I will only request limited information that is relevant to accessibility, reasonable adjustments or the safe delivery of a walk or visit. Where explicit consent is required, this will be requested separately. You do not need to provide a diagnosis. Please describe only the practical adjustment or assistance that may be needed.
6. Where does the information come from?
I normally receive personal information:
Directly from you.
From another person making a booking on your behalf.
From organisations arranging a talk, walk or visit.
Through the website, email, telephone or social-media enquiries.
From military archives, record offices, libraries and museums.From official records and other publicly available historical sources.
From service providers involved in bookings, payments or website operation.
Where someone books on behalf of a group, they are responsible for sharing relevant booking and privacy information with the other participants.
7. Who is information shared with?
I do not sell personal information. Where necessary, information may be shared with:
Squarespace, which provides website hosting, forms, customer records, commerce, analytics and email-campaign services.
Squarespace Payments and its payment-processing partners.
Email, file-storage and communications providers.
Accounting, banking and bookkeeping service providers.
Archives, record offices or specialist researchers where this is necessary for agreed research.
Venues, guides or relevant service suppliers where necessary to deliver an agreed service.
Professional advisers, insurers or legal representatives.
Emergency services where this is necessary to protect someone’s vital interests.
Public authorities where disclosure is required by law. Only information necessary for the relevant purpose will be shared.
Customer or research information will not be published on the website, social media or promotional material without an appropriate lawful basis and, where required, permission.
Third-party websites and social-media platforms have their own privacy notices and may act as separate data controllers.
8. International processing
Some service providers, including website, payment, email or cloud-storage providers, may process information outside the United Kingdom. Where this happens, I rely on the safeguards used by the relevant provider, such as UK adequacy regulations or approved contractual protections. Further information can be requested using the contact details above.
9. How long is information retained?
I keep information only for as long as it is reasonably needed for the purpose for which it was collected. My normal retention periods are:
Unsuccessful or preliminary enquiries: up to 12 months after the last meaningful contact.
Customer contracts, bookings and service correspondence: normally up to six years after the service ends, where needed for business administration or possible legal claims.
Financial and transaction records: for the period required by tax and accounting law.
Military-research working files and customer-supplied documents: normally for the project and up to 12 months after delivery, unless a different period is agreed or continued retention is necessary.
Final research reports, agreements and related business records: normally up to six years after completion.
Ordinary walk attendance, emergency and accessibility information: normally deleted within three months after the event.
Accident, complaint or claim records: retained for as long as reasonably necessary to resolve the matter and meet legal or insurance requirements.
Marketing records: until you unsubscribe, withdraw consent or the information is no longer required. Marketing lists will be reviewed periodically.
Cookie and website analytics information: according to the website settings and the retention arrangements of the relevant provider.Information may be deleted earlier where it is no longer needed.
In limited circumstances, it may be retained for longer where required by law, insurance conditions or an unresolved complaint or claim.
10. Marketing
I will send marketing emails to individuals only where:
They have given valid consent; or
The limited existing-customer exception known as the “soft opt-in” lawfully applies.
Marketing consent is optional and is separate from agreeing to a booking or service. Marketing boxes will not be pre-ticked. Every marketing email will provide an unsubscribe method. You can also ask me to stop marketing at any time by emailing info@sowhathappened.co.uk.I may retain a minimal suppression record where necessary to ensure that someone who has unsubscribed is not contacted again accidentally.
11. Cookies and analytics
Squarespace uses essential cookies to operate and secure this website. These cookies cannot normally be switched off through the website. Analytics and performance cookies will be used only in accordance with the choices offered through the cookie banner. You can use the website’s Cookie Preferences control to review or change your choices. More information about Squarespace’s processing is available in the Squarespace Privacy Policy.
12. Security
I take reasonable measures to protect personal information from loss, misuse, unauthorised access or disclosure.These measures include using reputable service providers, password-protected accounts, access controls, appropriate device security and limiting the information collected and retained.No internet or electronic-storage system can be guaranteed to be completely secure. If a personal-data breach creates a risk requiring notification, I will follow the applicable legal requirements.
13. Children
Bookings must be made by an adult. I do not knowingly invite children to submit personal information directly through the website.Where a child participates in a walk, only the limited information needed to administer the booking and support safe participation should be supplied by the responsible adult.
14. Your data-protection rights
Depending on the circumstances and lawful basis, you may have the right to:
Ask for access to your personal information.
Ask for inaccurate or incomplete information to be corrected.
Ask for personal information to be erased.
Ask for the use of your information to be restricted.
Object to certain uses of your information.
Receive information you provided in a portable format.
Withdraw consent at any time.
Object at any time to the use of your information for direct marketing.
Some rights are subject to legal conditions and exemptions. For example, information may need to be retained to comply with tax law or deal with a legal claim.
To exercise a right, email info@sowhathappened.co.uk. I may need to request information to confirm your identity. I will normally respond within one month.
15. Complaints
Please contact me first if you have concerns about how your information has been handled:
Email:info@sowhathappened.co.uk
You also have the right to complain to the Information Commissioner’s Office:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AFTelephone: 0303 123 1113
Website:www.ico.org.uk/make-a-complaint
16. Changes to this notice
I may update this notice to reflect changes to the website, services, suppliers or legal requirements. The date at the top will show when it was last updated.If a change materially affects how existing customer information is used, I will take reasonable steps to bring it to the attention of those affected.