Privacy Policy

01Who is responsible

I am the controller for the personal data described here within the meaning of the General Data Protection Regulation. I have not appointed a data protection officer and am not required to.

02When you visit this website

Data

IP address, date and time of access, page requested, referring URL, browser and operating system, volume of data transferred. Recorded by my host in server log files.

Purpose

To deliver the site, keep it secure and stable, and diagnose faults.

Legal basis

Art. 6(1)(f) GDPR. My legitimate interest is operating a functioning, secure website.

Retention

Deleted or anonymised by the host on a rolling short-term basis. Where data is kept longer because of a security incident, it is deleted once that is resolved.

03Cookies

Strictly necessary cookies, those without which the site cannot work, such as session and security cookies, are set on the basis of § 25 (2) TDDDG and Art. 6(1)(f) GDPR.

Anything not strictly necessary is set only after you consent through the banner, on the basis of § 25 (1) TDDDG and Art. 6(1)(a) GDPR. You may withdraw consent at any time with effect for the future, through the cookie settings link in the footer or by clearing cookies in your browser.

04When you apply to work with me

Applications are submitted through a form provided by Tally.

Data

Your name, business email, company name and country, and everything you choose to write in your application.

Purpose

To assess the application and reply to it.

Legal basis

Art. 6(1)(b) GDPR, steps taken at your request before entering a contract.

Retention

If I decline, the application is deleted within twelve months unless you ask me to keep it. If we proceed, retention follows section 5.

05When you become a client

Data

Contact and billing details, the contract and correspondence, payment records, and the publicly available material about your business that I analyse. Some of that material may contain personal data, for example the names of staff shown on your own website.

Purpose

To perform the contract, to invoice, and to comply with German commercial and tax retention law.

Legal basis

Art. 6(1)(b) GDPR for performance of the contract; Art. 6(1)(c) GDPR for statutory retention; Art. 6(1)(f) GDPR for analysing publicly available material about your business, my legitimate interest being delivery of the work you commissioned.

Retention

Accounting documents and invoices for the periods German law requires, currently eight years for accounting vouchers, ten years for books and annual accounts, six years for business correspondence. Working material not subject to a retention obligation is deleted within twelve months of delivery.

06The Dispatch

My monthly letter is sent using Kit.

Data

Your email address, and the date, time and IP address of your subscription and confirmation.

Purpose

To send you the letter, and to be able to prove that you asked for it.

Legal basis

Art. 6(1)(a) GDPR, your consent. Confirmation data is retained under Art. 6(1)(f) GDPR, my legitimate interest being the ability to demonstrate lawful consent.

Double opt-in

After you subscribe you receive an email asking you to confirm. Nothing is sent until you do. If you do not confirm, the address is deleted.

Measurement

Kit records whether messages were opened and which links were followed, so I can tell whether the letter is worth writing. This is part of the consent you give when you subscribe, and it ends when you unsubscribe.

Leaving

Every issue carries a one-click unsubscribe link. Withdrawal takes effect for the future and does not affect the lawfulness of processing before it.

07When you email me

My business email is hosted by Zoho. Your message and contact details are processed to answer you, on the basis of Art. 6(1)(b) GDPR where it concerns a contract or its initiation, and Art. 6(1)(f) GDPR otherwise. Messages are deleted when no longer needed and no retention obligation applies.

Ordinary email is not encrypted end to end. Please do not send anything highly sensitive by unsecured email.

08Service providers

Each provider below is bound by a data processing agreement under Art. 28 GDPR. Where data leaves the EU or EEA the transfer is protected by the European Commission’s Standard Contractual Clauses under Art. 46(2)(c) GDPR, or by an adequacy decision where one applies. You may request a copy of the relevant safeguards from me.

My site links to Instagram, YouTube and Substack. These are plain links, not embedded players or feeds. Following them takes you to those services, where their own privacy policies apply and I have no control over what they process.

09How I use AI in the work

I use AI tools as part of my research, in the same way I use search engines, databases and reference works. They help me read widely and quickly across published material, test my own reasoning, and check that an argument holds before it reaches you. Every finding is verified against a primary source, and every word of every audit is written and signed off by me. Nothing is generated and passed on unread.

What this means for your data, specifically:

• I use business-tier tools whose terms provide that inputs are not used to train the provider’s models.
• I do not enter confidential material you have given me in confidence, personal data about your staff or clients, or anything not already published, into any AI tool.
• Publicly available material about your business may be analysed with these tools, exactly as it may be read with a browser.
• No decision affecting you is made by an automated system. See section 12.

If you would prefer that no AI tool is used at any stage of your engagement, say so in writing before you commission and I will work without them.

10Your rights

Under the GDPR you have the right to:

• Access your data and receive a copy (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Object to processing based on legitimate interests (Art. 21)
• Withdraw consent at any time, with effect for the future (Art. 7(3))

To exercise any of these, email info@truenorthstrategy.co. I will respond within one month. There is no charge.

Right of objection. Where I process your data under Art. 6(1)(f) GDPR you may object at any time on grounds relating to your particular situation. I will then stop unless I can demonstrate compelling legitimate grounds that override your interests, or the processing is needed to establish, exercise or defend legal claims.

Right to complain. You may lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement (Art. 77 GDPR). My competent authority is [SUPERVISORY AUTHORITY].

11Is any of this required?

Providing personal data is not required by law or contract. But I cannot assess an application, enter a contract, or send you the letter without the data described above.

12Automated decisions

I do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. Applications are read and decided by me. Audits are researched, written and signed by me.

13Changes

I update this policy when my processing changes or the law does. The current version always applies.