Last updated: September 2026

​

Kristina Harbord ("I", "me" or "my") is committed to protecting and respecting your privacy.

This Privacy Policy explains how I collect, use, store and protect personal information in connection with my business and the virtual assistant and executive support services I provide.

I process personal data in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.

​

1. Who I Am

Kristina Harbord is a sole trader providing virtual assistant, executive support and associated business support services.

For personal information collected and used for the purposes of operating my own business, Kristina Harbord is the data controller.

In some circumstances, I may process personal information on behalf of my clients as part of the services I provide. Where this is the case, the client will generally be the data controller and I will act as a data processor, processing the information only as necessary to provide the agreed services and in accordance with the client's instructions and applicable contractual obligations.

For any questions about this Privacy Policy or how your personal information is handled, please contact:

Kristina Harbord
Email: info@kristinaharbord.co.uk
Website: www.kristinaharbord.co.uk

​

2. Personal Information I Collect

The personal information I collect will depend on the nature of my relationship with you and the services being provided.

This may include:

• Name;

• Company or organisation;

• Job title;

• Business and/or personal email address;

• Telephone number;

• Billing or business address;

• Information provided through my website contact form;

• Details of enquiries and business requirements;

• Meeting notes and correspondence;

• Contracts and other commercial documentation;

• Invoice and payment information;

• Records relating to the services I provide; and

• Other information that you choose to provide to me.

I only seek to collect personal information that is reasonably necessary for the relevant purpose.
 

3. Information Processed as Part of Client Work

As a virtual assistant, I may be given access to personal or confidential information held by my clients in order to perform agreed services.

Depending on the assignment, this may include access to:

• Email accounts and inboxes;

• Calendars and scheduling information;

• Customer relationship management (CRM) systems;

• Employee and candidate information;

• Customer and prospect databases;

• Supplier and contractor information;

• Financial and accounting information;

• Business documents and records;

• SharePoint sites and other document-management systems;

• Internal company information;

• Client systems and software; and

• Login credentials or access information required to perform the services.

Where I process personal data solely on behalf of a client, I will normally act as a data processor and the client remains responsible for determining the purposes and means of processing that information.

I will process such information only as necessary to provide the agreed services, in accordance with the client's instructions and subject to any applicable contractual, confidentiality and data-processing obligations.

Where access credentials are provided, I will take reasonable steps to keep them secure and will not intentionally disclose them to unauthorised parties.
 

4. Special Category and Sensitive Personal Information

The nature of certain client assignments may mean that I occasionally have access to information that is particularly sensitive or is classed as special category personal data under data protection legislation.

This may include, for example, health information or other sensitive employee, candidate or customer information.

I do not routinely seek to collect this information for the operation of my own business.

Where such information is processed on behalf of a client, I will only access and process it where necessary to perform the agreed services and in accordance with the client's instructions and applicable data protection requirements.
 

5. How I Collect Personal Information

I may collect personal information:

• Directly from you when you contact me by email;

• Through the contact form on my website;

• During telephone, video or in-person meetings;

• During the client onboarding process;

• Through contracts, invoices and other business correspondence;

• From clients where information is required for me to perform services on their behalf;

• From publicly available professional sources, such as company websites and LinkedIn;

• Through online searches for legitimate business-development purposes; and

• Through referrals and professional introductions.

I do not purchase personal information or marketing databases for business-development purposes.
 

6. How I Use Personal Information

I may use personal information to:

• Respond to enquiries;

• Discuss and assess potential assignments;

• Provide virtual assistant and executive support services;

• Communicate with clients and prospective clients;

• Manage client relationships;

• Arrange meetings and appointments;

• Prepare proposals, contracts and other business documents;

• Manage projects and assignments;

• Raise invoices and maintain financial records;

• Process and reconcile payments;

• Maintain appropriate business and accounting records;

• Meet my tax, legal and regulatory obligations;

• Manage and improve my business;

• Maintain the security of my systems and information;

• Establish, exercise or defend legal claims; and

• Conduct appropriate business-development activity.

I will not use personal information for purposes that are incompatible with the reason it was originally collected unless permitted or required by law.
 

7. Lawful Bases for Processing

Under UK data protection law, I must have a lawful basis for processing personal information.

Depending on the circumstances, I may rely on:

Contract – where processing is necessary to enter into or perform a contract with you.

Legitimate interests – where processing is reasonably necessary for the operation and development of my business, including managing client relationships, responding to business enquiries, maintaining appropriate business records and carrying out proportionate business-to-business development activity.

When relying on legitimate interests, I consider whether my interests are outweighed by the rights and interests of the individual concerned.

Legal obligation – where I need to process or retain information to comply with a legal, regulatory, accounting or tax requirement.

Consent – where consent is the appropriate lawful basis and has been obtained. Where processing is based on consent, you may withdraw your consent at any time.

Where special category personal data is processed, an additional condition for processing will be required under applicable data protection legislation. Where I process this information solely on behalf of a client, responsibility for determining the appropriate lawful basis and special-category condition will generally rest with that client as data controller.
 

8. Business Development and Direct Marketing

I may contact individuals in a professional capacity to introduce my services where I reasonably believe those services may be relevant to their business or organisation.

For this purpose, I may use professional contact information obtained from publicly available sources, including LinkedIn, company websites and publicly available online business information.

I do not purchase marketing databases.

Where applicable, I rely on legitimate interests to process personal information for business-development purposes and will take into account applicable electronic marketing and data protection requirements.

You have the right to object to the use of your personal information for direct marketing at any time.

If you receive a business-development communication from me and do not wish to receive further communications, you can reply to the email or contact info@kristinaharbord.co.uk. I will respect your request and may retain limited information on a suppression record where necessary to ensure that you are not contacted again.

I do not currently operate a general marketing newsletter.
 

9. Sharing Personal Information

I do not sell personal information.

I may share or provide access to personal information where reasonably necessary for the operation of my business, including with service providers that support my business.

These may include providers of:

• Email and productivity software;

• Cloud storage and document-management services;

• Website hosting and website-management services;

• Domain and email hosting;

• Video conferencing and communication services;

• CRM systems;

• Accounting and bookkeeping software;

• Payment-processing and banking services;

• Password-management and cybersecurity services; and

• Professional advisers, including my accountant.

Services currently used within my business include Microsoft 365, OneDrive, Microsoft Teams, Wix, GoDaddy, Canva and Zoom, together with other software and systems appropriate to particular assignments.

Where I engage third-party providers to process personal information on my behalf, I take reasonable steps to use reputable providers and appropriate contractual and security arrangements where required.

I may also disclose personal information where required by law, a court, a regulatory authority or where reasonably necessary to establish, exercise or defend legal rights.
 

10. Artificial Intelligence

I may use artificial intelligence tools to support general business activities.

I do not intentionally input client personal information, confidential client information or personal information processed on behalf of clients into publicly available generative AI tools such as ChatGPT as part of providing my services.

If my use of artificial intelligence changes in the future in a way that materially affects how personal information is processed, I will review and update my practices and this Privacy Policy as appropriate.
 

11. International Transfers

Some of the technology and service providers I use may process or store information outside the United Kingdom.

Where personal information is transferred internationally, I will take reasonable steps to ensure that an appropriate mechanism or safeguard is in place where required by applicable data protection law. This may include transfers to countries recognised as providing an adequate level of protection or the use of approved contractual safeguards.

Where I process information on behalf of a client, international transfers will also be subject to the relevant client's instructions and contractual arrangements where applicable.

I currently provide my services from within the United Kingdom.
 

12. How I Protect Personal Information

I take reasonable technical and organisational measures to protect personal and confidential information from unauthorised access, loss, misuse, alteration or disclosure.

These measures include, where appropriate:

• Password-protected devices and accounts;

• Two-factor or multi-factor authentication;

• Controlled access to business systems;

• Use of established cloud-storage and software providers;

• Password-management tools;

• Limiting access to information to what is reasonably required for the assignment; and

• Maintaining appropriate confidentiality when handling client information.

While I take reasonable precautions to protect information, no electronic storage or transmission system can be guaranteed to be completely secure.
 

13. Data Retention

I retain personal information only for as long as reasonably necessary for the purpose for which it was collected, including to meet legal, accounting, tax, contractual and reporting requirements.

The appropriate retention period will depend on the nature of the information and why it is held.

In general:

• Enquiry and prospective-client information will be retained only for as long as it remains reasonably relevant to the enquiry or potential business relationship;

• Business-development contact information will be reviewed periodically and removed where it is no longer relevant or appropriate, subject to retaining suppression information where someone has opted out;

• Client correspondence, contracts and records may be retained for a reasonable period following the end of the client relationship where required for business, contractual or legal purposes;

• Invoices, payment records and information required for tax or accounting purposes will be retained for the period required under applicable UK law; and

• Personal information processed solely on behalf of a client will be retained, returned or deleted in accordance with the client's instructions, the applicable agreement and legal requirements.

Where information is no longer required, I will take reasonable steps to securely delete, anonymise or otherwise dispose of it.
 

14. Website and Cookies

My website is hosted using Wix.

The website may use cookies and similar technologies that are necessary for the operation, security and functionality of the website. Wix and other website services may also use cookies or similar technologies depending on the features enabled on the website.

Where cookies or similar technologies require consent under applicable UK law, they should not be placed on your device unless the appropriate consent has been obtained.

You can also control or delete cookies through your browser settings.

Where appropriate, further information about the cookies used on the website may be provided through the website's cookie banner or cookie settings.
 

15. Website Contact Form

If you submit an enquiry through the contact form on my website, I will use the information you provide to respond to your enquiry, communicate with you about your requirements and, where appropriate, take steps towards entering into a business relationship with you.

Information submitted through the website may be processed through Wix and associated website services before being received by me.

Please do not submit unnecessary sensitive personal information through the website contact form.
 

16. Children's Personal Information

My services are intended for businesses and adult professionals and are not directed towards children.

I do not knowingly collect personal information relating to children for the purposes of operating or marketing my own business.

I may only process information relating to children where it is provided by a client as part of a legitimate client assignment and where the processing is necessary to provide the agreed services. In those circumstances, I will process the information on the client's instructions and in accordance with applicable data protection requirements.
 

17. Your Data Protection Rights

Depending on the circumstances, UK data protection law may give you rights in relation to your personal information, including the right to:

• Request access to personal information held about you;

• Request correction of inaccurate or incomplete information;

• Request deletion of your personal information in certain circumstances;

• Request restriction of processing in certain circumstances;

• Object to certain processing, including direct marketing;

• Request transfer of your information in certain circumstances;

• Withdraw consent where consent is relied upon as the lawful basis for processing; and

• Raise a concern about how your personal information has been handled.

These rights are not absolute and may be subject to exemptions or other legal requirements.

If you wish to exercise any of your rights, please contact info@kristinaharbord.co.uk.

I may need to verify your identity before responding to certain requests.

There is normally no fee for exercising your data protection rights. I will respond within the timeframe required by applicable data protection legislation.

Where I process your information solely on behalf of one of my clients, I may need to refer your request to the relevant client as the data controller.
 

18. Complaints

If you have concerns about how I handle your personal information, please contact me in the first instance at:

info@kristinaharbord.co.uk

I will endeavour to address your concerns promptly and appropriately.

You also have the right to raise a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator.

Further information is available from the ICO at www.ico.org.uk.
 

19. Third-Party Websites

My website may contain links to third-party websites or services.

I am not responsible for the privacy practices of third-party websites. If you follow a link to another website, you should review that organisation's privacy information to understand how it processes your personal information.
 

20. Changes to This Privacy Policy

I may update this Privacy Policy periodically to reflect changes to my business, services, technology or legal and regulatory requirements.
The latest version will be published on my website and the "Last updated" date at the top of this policy will be amended accordingly.