Privacy Policy

Last updated: 1 October 2026. Effective immediately.

This Privacy Policy explains how Michael Morris, trading as Morris Legacy (morris.is), collects, uses, and protects your personal data. This policy applies to all visitors to morris.is, anyone who submits a contact form or booking request, and anyone who engages with Morris Legacy services.

This policy is written in compliance with the General Data Protection Regulation (GDPR) and applicable Israeli data protection law. If you have any questions, contact: contact@morris.is.

1. Who is responsible for your data

Data Controller: Michael Morris
Trading as: Morris Legacy
Website: https://morris.is
Email: contact@morris.is
Location: Israel (UTC+3)

2. What data we collect and why

We collect only the personal data necessary to provide our services and communicate with you.

Data collected	Why we collect it	Legal basis (GDPR)
Name and email address	To respond to contact form submissions and booking requests	Legitimate interest / Contract
Phone number	Optionally provided during booking, used for appointment reminders only	Consent
Business information	Provided voluntarily in booking notes to prepare for discovery calls	Consent
IP address and browser data	Collected automatically by our analytics provider (PostHog) and hosting logs (Railway) for security and to understand how the site is used	Legitimate interest
Booking appointment data	Stored by Microsoft Bookings to manage appointments	Contract
Payment information	Processed by Stripe, we never see or store your card details	Contract

3. How we use your data

• To respond to enquiries submitted via the contact form or email
• To confirm, manage, and follow up on scheduled appointments
• To process payments for services via Stripe
• To send you information about our services where you have requested it or where we have a legitimate interest in doing so
• To improve the performance and security of this website

We do not use your data for automated decision-making or profiling. We do not sell your data. We do not share your data with third parties except as described in section 4.

4. Third parties we share data with

We use the following third-party services, each of which processes data on our behalf under their own privacy policies:

• Microsoft Bookings (Microsoft 365): manages appointment scheduling. Data processed under Microsoft's privacy policy and Data Processing Agreement. Microsoft Privacy Statement
• Stripe: processes payments. Card details are never transmitted to or stored on our servers. Stripe Privacy Policy
• PostHog: website analytics (pages viewed, device and browser type, approximate location). PostHog Privacy Policy
• Railway: hosts this website. Server logs may be retained for security purposes. Railway Privacy Policy
• Microsoft 365: contact form messages are delivered to our Microsoft 365 mailbox. Microsoft Privacy Statement

No data is transferred to third parties for marketing purposes without your explicit consent.

5. International data transfers

Morris Legacy is based in Israel. Israel is recognised by the European Commission as providing adequate data protection. Some third-party processors (Microsoft, Stripe, PostHog, Railway) are based in the United States and operate under standard contractual clauses or equivalent safeguards approved under GDPR Article 46.

6. How long we keep your data

• Contact form submissions: retained for up to 12 months, then deleted unless an ongoing relationship exists
• Booking records: retained for 24 months for record-keeping purposes
• Payment records: retained for 7 years to comply with financial record-keeping obligations
• Website analytics data: aggregated and anonymised, no retention limit

7. Your rights under GDPR

If you are located in the European Economic Area (EEA) or the UK, you have the following rights regarding your personal data:

• Right of access: request a copy of the personal data we hold about you
• Right to rectification: request correction of inaccurate or incomplete data
• Right to erasure: request deletion of your data where there is no compelling reason for its continued processing
• Right to restrict processing: request that we limit how we use your data
• Right to data portability: request your data in a structured, machine-readable format
• Right to object: object to processing based on legitimate interest
• Right to withdraw consent: where processing is based on consent, withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, email contact@morris.is. We will respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with your local supervisory authority. In Israel, this is the Privacy Protection Authority.

8. Cookies

This website uses a small number of cookies. Cookies are small text files placed on your device that help the site function correctly. We use:

• Essential storage: this site has no login and sets no session cookies. The contact form sends only what you type into it.
• Analytics cookies: PostHog sets a first-party cookie to count visits and understand how the site is used. We do not create personal profiles from analytics.

We do not use advertising or tracking cookies. We do not serve third-party ads.

9. Security

We take data security seriously. Morris Legacy applies appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, or destruction. This includes HTTPS encryption on all pages, access controls on administrative systems, and use of GDPR-compliant third-party processors. As a CISSP-certified security professional, the same standards applied to client engagements are applied here.

10. Changes to this policy

We may update this policy from time to time. The date at the top of this page shows when it was last updated. Continued use of morris.is following any changes constitutes acceptance of the updated policy.

11. Contact

For any privacy-related questions, data requests, or complaints:
Michael Morris
Morris Legacy
contact@morris.is
https://morris.is