Last updated: 14 September 2026
Guitar Step By Step respects your privacy. This policy explains how we handle personal information when you visit our website, enquire about lessons, receive our emails or become a student.
Guitar Step By Step is operated by James Mulligan, trading as "Guitar Step By Step" James Mulligan is the controller responsible for your personal information.
Website: guitarstepbystep.com
Privacy contact: support@guitarstepbystep.com
Depending on how you interact with us, we collect:
-Responding to booking requests and arranging or delivering lessons
-Taking steps at your request before entering a contract, or performing our contract with you
-Answering general enquiries and managing complaints
-Our legitimate interests in running the business and supporting customers
-Providing tuition to a child whose parent or guardian books lessons
-Legal obligation
-Protecting the website and preventing misuse
-Our legitimate interests in maintaining a secure service
-Sending optional marketing emails and using optional website analytics or tracking
-Your consent
-Keeping records of marketing objections
-Our legitimate interests in respecting your preferences
Where we rely on legitimate interests, we consider whether the processing is necessary and how it affects your rights.
We use Mailchimp to manage our mailing list and send guitar tips, lesson updates and promotional emails to people who have opted in.
Submitting a lesson enquiry does not automatically subscribe you to marketing.
You can unsubscribe at any time using the link in a marketing email or by contacting support@guitarstepbystep.com. Unsubscribing does not prevent essential communications about lessons you have booked.
Mailchimp processes subscription preferences and email delivery information. Where we use optional email-open or link-click tracking, we explain this and obtain separate consent before enabling it for you. You can withdraw that consent by contacting us.
We use the following providers where relevant to your interaction with us:
GoDaddy
Website hosting and associated technical services
Microsoft Outlook
Business email and correspondence
Mailchimp
Mailing-list administration and email marketing
Google Analytics
Understanding website use and improving the website
YouTube / Google
Displaying embedded lesson videos
We also share relevant information with banks or payment providers when handling payments, professional advisers where necessary, and authorities where legally required.
Providers acting on our behalf process information under applicable service and data-processing agreements. Where providers use information for their own purposes, their privacy notices explain that processing.
We do not sell your personal information.
Our providers operate internationally, so personal information may be processed outside the UK, including in the United States and the European Economic Area.
Applicable protections include UK adequacy regulations, including the UK Extension to the EU–US Data Privacy Framework where it covers the recipient and transfer. Where appropriate, contractual protections include standard contractual clauses with the UK Addendum or the UK International Data Transfer Agreement. These arrangements are described in the providers’ terms linked above.
Contact support@guitarstepbystep.com to request further details about relevant destinations and safeguards, including copies of applicable contractual protections.
We use cookies and similar technologies to operate the website, understand how visitors use it and display embedded videos.
Google Analytics helps us understand which pages people visit and how they interact with the website. Embedded YouTube videos can involve Google receiving technical information and using cookies or similar technologies.
We request consent before enabling optional analytics and video tracking. You can accept or reject optional technologies and withdraw consent through the website’s cookie controls.
The cookie controls provide information about individual cookies, their purposes, providers and lifetimes. Strictly necessary technologies may operate without consent where permitted by law.
We apply the following retention schedule:
-Enquiries that do not become bookings
-12 months after the last meaningful contact
-Ordinary student administration and teaching records
-During the teaching relationship and for two years after the final lesson
-Marketing subscriber records
-While subscribed, with removal from the active mailing list after 24 months without an affirmative interaction, such as a reply, booking or renewed subscription
-Tax and accounting records
-Normally five years after the relevant 31 January Self Assessment filing deadline, or longer where legally required
-Google Analytics user and event data covered by its retention controls
-14 months, with resetting on new activity disabled; standard aggregated reports may remain longer
The accounting period reflects HMRC’s requirements for self-employed businesses.
After a marketing opt-out, we retain a minimal record of your email address and preference while operating the mailing list so that we do not subscribe you again accidentally.
Security and error logs are retained according to their operational purpose, including diagnosing faults and investigating suspected misuse. Relevant incident records may be kept until the incident and any associated dispute are resolved.
We review records regularly and delete or anonymise information no longer needed. Relevant records may be retained longer where necessary to meet a legal obligation or establish, exercise or defend a legal claim.
We use appropriate technical and organisational measures to protect personal information against loss, misuse and unauthorised access. Access is limited to people and providers who need it for the purposes described in this policy.
We do not make decisions with legal or similarly significant effects on you solely through automated processing.
Depending on the circumstances, you can request access to your information, correction, deletion, restriction of processing or a portable copy.
You can object to processing based on legitimate interests. You can object to direct marketing at any time.
Where processing relies on consent, you can withdraw it without affecting the lawfulness of processing carried out beforehand.
Contact support@guitarstepbystep.com to exercise your rights. We normally respond within one month, subject to any extensions or other provisions permitted by law.
If you have concerns about how we handle your information, contact us so we can investigate and respond.
You also have the right to complain to the Information Commissioner’s Office.
We may update this policy when our services or information practices change. The latest version will appear on this page with an updated date.

Friendly, structured 1-to-1 guitar lessons for beginners.
© 2026 Guitar Step By Step.com All Rights Reserved