Privacy Policy

We collect personal data when you provide it through our website. This includes:

• Contact form submissions - your name, email address, and any message you send us
• Discovery call bookings - your name, email address, phone number and chosen appointment time, plus your company name and any note you choose to add
• Email correspondence - any personal data you share when emailing us directly
• Private client areas - a small amount of sign-in information, and any answers you give there. See “Private client areas” below

We do not collect sensitive personal data, financial information, or data from children.

Some pages on this site are private. We open them to a client, or to a named person at a client, with a password, an access code or a personal link. They hold proposals, reports, questionnaires and training materials. This is what those pages collect:

• The password or access code you enter - used only to check that you are allowed in. We do not store what you type
• A sign-in cookie - most private areas set one cookie once you are in, so that you do not have to enter the password on every page. It holds no personal details and expires after 30 days at most. It is an essential cookie, so it does not depend on your cookie banner choice
• Your IP address - where a password or a form is checked on our server, your IP address is used briefly to limit repeated attempts. It is held in memory only and is not saved
• A record that a page was opened - for some proposals and reports we record the date and time the page was unlocked. Depending on the page, the record holds either your browser type and a scrambled form of your IP address that cannot be turned back into the address, or the page address and a random visitor ID that this site keeps in your browser. If we sent you the link personally, or you have filled in a form on this site before, the record may be linked to your name or email address in our customer records
• Answers you give - where a private area contains a questionnaire or feedback form, we collect your answers, together with your name and role where the questionnaire is personal to you. Some questionnaires save your answers as you go, before you press submit

We use this information to keep private material secure, to know whether a document we have sent has been opened, and to carry out the work the client has asked us to do. Our legal basis is our legitimate interest in running these areas securely and delivering that work. Where a questionnaire asks for your consent, we rely on that consent, and you can withdraw it at any time by emailing craig@hartzai.com.

This information is stored with our hosting provider, Vercel, or in KeBe, our own booking and customer records system. Questionnaire and feedback answers are also emailed to us through Resend. Questionnaires say at the top who will see your answers and how long we keep them, and you can ask us to delete yours at any time.

We use the following third-party services that may process data on our behalf:

• Vercel - website hosting and deployment (United States)
• KeBe - our own booking and customer records system, which takes discovery call bookings on this site. It runs on Vercel, with its database hosted by Neon (United Kingdom)
• Zoom - video meetings for discovery calls (United States)
• Resend - delivers the emails that our forms and private client areas send to us, including the details or answers submitted (United States)
• Google - analytics (GA4), tag management (GTM) and advertising (Google Ads), and the calendar invitation and confirmation email for a discovery call (United States)
• Meta Platforms - advertising via Facebook and Instagram (United States)
• LinkedIn (Microsoft) - advertising via LinkedIn Insight Tag (United States)
• Microsoft - advertising via Bing Ads / UET Tag (United States)
• Stape - server-side tag management hosting (EU)

Each of these services has its own privacy policy and data protection measures. We only share the minimum data necessary for these services to function. Analytics and advertising services only receive data when you have given consent via our cookie banner.

Some of the third-party services listed above are based outside the United Kingdom. This means your personal data may be transferred to, stored, or processed in countries outside the UK, including the United States.

Where your data is transferred outside the UK, we ensure that appropriate safeguards are in place to protect it, in accordance with UK GDPR. These safeguards may include:

• Transfers to countries that the UK Secretary of State has determined provide an adequate level of data protection
• Use of Standard Contractual Clauses (SCCs) approved for UK international transfers, also known as the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs
• Reliance on the service provider's binding corporate rules or other approved transfer mechanisms

If you would like more information about the specific safeguards applied to any international transfer of your data, please contact us at craig@hartzai.com.

Under the UK General Data Protection Regulation (UK GDPR), you have the following rights:

• Right of access - you can request a copy of the personal data we hold about you
• Right to rectification - you can ask us to correct any inaccurate data
• Right to erasure - you can request that we delete your personal data
• Right to restrict processing - you can ask us to limit how we use your data
• Right to data portability - you can request your data in a machine-readable format
• Right to object - you can object to our processing of your data
• Right to complain - you have the right to complain to us, and to the Information Commission, if you believe your data protection rights have been breached. See “How to complain” below

To exercise any of these rights, please contact us at craig@hartzai.com. We will respond to your request within 30 days.

If you would like us to delete all personal data we hold about you, please email craig@hartzai.com with the subject line “Data Deletion Request”. We will confirm deletion within 30 days and notify you once the process is complete.

If you have any questions about this privacy policy or how we handle your data, please contact us: