Privacy Policy

01Who is responsible

I am the controller for the personal data described here within the meaning of the General Data Protection Regulation. I have not appointed a data protection officer and am not required to.

02When you visit this website

Data

IP address, date and time of access, page requested, referring URL, browser and operating system, volume of data transferred. Recorded by my host in server log files.

Purpose

To deliver the site, keep it secure and stable, and diagnose faults.

Legal basis

Art. 6(1)(f) GDPR. My legitimate interest is operating a functioning, secure website.

Retention

Kept for a limited period set by Squarespace and then deleted or anonymised. Where data is kept longer because of a security incident, it is deleted once that is resolved.

Squarespace also processes some of this data as an independent controller for its own security and service purposes; its privacy policy applies to that processing.

The fonts on this site are stored on my own Squarespace account and load from there. No request is sent to Google or any other font service.

03Cookies

Strictly necessary cookies, those without which the site cannot work, such as session and security cookies, are set on the basis of § 25 (2) TDDDG and Art. 6(1)(f) GDPR.

With your consent I use Squarespace Analytics to see aggregated visitor statistics: pages viewed, referring site, device type and approximate location. Provider: Squarespace Ireland Ltd.; Squarespace, Inc. (USA) may receive data (see section 8). These cookies are set only after you accept them in the banner, on the basis of § 25 (1) TDDDG and Art. 6(1)(a) GDPR. If you decline, none are set.

You can withdraw or change your consent at any time, with effect for the future, through the “Cookie Preferences” link shown on every page, or by clearing cookies in your browser.

04When you apply to work with me

Applications are submitted through a form provided by Tally.

Data

Your name, business email, company name, country and website, your company's VAT ID or business registration number, your confirmation that you act for a business and accept my terms (with the date and time of submission), and everything you choose to write in your application.

Purpose

To assess the application and reply to it, to verify that you are a business, and to document which terms you accepted.

Legal basis

Art. 6(1)(b) GDPR, steps taken at your request before entering a contract. Where you apply on behalf of a company, Art. 6(1)(f) GDPR; my legitimate interest is communicating and contracting with the business you represent.

Retention

If I decline, I keep the application for six months to deal with follow-up questions (Art. 6(1)(f) GDPR), then delete it, unless you ask me to keep it. If we proceed, retention follows section 5.

05When you become a client

Data

Contact and billing details, the contract and correspondence, payment records, your answers in the request form and any figures you choose to share, and the publicly available material about your business that I analyse. Some of that material may contain personal data, for example the names of staff shown on your own website.

Purpose

To perform the contract, to invoice, and to comply with German tax retention law.

Legal basis

Art. 6(1)(b) GDPR for performance of the contract; where you act on behalf of a company, Art. 6(1)(f) GDPR, my legitimate interest being communicating and contracting with the business you represent; Art. 6(1)(c) GDPR for statutory retention; Art. 6(1)(f) GDPR for analysing publicly available material about your business, my legitimate interest being delivery of the work you commissioned.

Retention

As required by German tax law (§ 147 AO, § 14b UStG): eight years for invoices and accounting vouchers, ten years for books and records, six years for business letters, each counted from the end of the calendar year. Working material not subject to a retention obligation is deleted 90 days after delivery, unless you ask me to keep it longer.

Test enquiries. If you consent in the request form, I send up to three realistic enquiries to your business during the first week of the engagement, to see how quickly and how well it replies. I record the time of each reply, who replied and what they wrote. Nothing is booked, and I tell your team afterwards. Legal basis: Art. 6(1)(f) GDPR; my legitimate interest, and yours, is measuring the service you commissioned me to assess. The records are deleted with the working material, 90 days after delivery.

Public information about businesses. For audits and published analyses I review material that businesses have published themselves, such as websites, social profiles and press coverage. This may include names, roles and images of their staff. Legal basis: Art. 6(1)(f) GDPR; my legitimate interest is analysing a business’s public presence. I take only what the analysis needs, do not contact the individuals, and remove or blur personal data from anything I publish. Because informing each person individually would be impossible or involve disproportionate effort, I provide this information here (Art. 14(5)(b) GDPR). Working material is deleted 90 days after delivery. You may object under Art. 21 GDPR.

06The Dispatch

My monthly letter is sent using Kit.

Data

Your email address, and the date, time and IP address of your subscription and confirmation.

Purpose

To send you the letter, and to be able to prove that you asked for it.

Legal basis

Art. 6(1)(a) GDPR, your consent. Confirmation data is retained under Art. 6(1)(f) GDPR, my legitimate interest being the ability to demonstrate lawful consent.

Double opt-in

After you subscribe you receive an email asking you to confirm. Nothing is sent until you do. If you do not confirm within 30 days, the address is deleted.

Measurement

Kit records whether messages were opened and which links were followed, so I can tell whether the letter is worth writing. You are told about this at the signup field; it is part of the consent you give when you subscribe (§ 25(1) TDDDG, Art. 6(1)(a) GDPR), and it ends when you unsubscribe. Kit (USA) acts as my processor; see section 8.

Leaving

Every issue carries a one-click unsubscribe link. Withdrawal takes effect for the future and does not affect the lawfulness of processing before it.

Retention

After you unsubscribe I delete your address, except for a suppression entry that stops you being re-added by mistake. I keep proof of your consent for three years from the end of the year in which you unsubscribe (Art. 6(1)(f) GDPR; limitation period, § 195 BGB).

07When you email me

My business email is hosted by Zoho. Your message and contact details are processed to answer you, on the basis of Art. 6(1)(b) GDPR where it concerns a contract or its initiation, and Art. 6(1)(f) GDPR otherwise. Messages are deleted when no longer needed and no retention obligation applies.

The same applies if you write to me through the contact form on my contact page. The form is part of my website on Squarespace (see section 8): your name, email address and message are stored in my Squarespace account and sent on to my business email, and I handle them exactly as I would an email.

Ordinary email is not encrypted end to end. Please do not send anything highly sensitive by unsecured email.

08Service providers

These providers process personal data on my behalf under a data processing agreement (Art. 28 GDPR). Squarespace and Stripe also process some data as independent controllers for their own purposes, such as security, fraud prevention and legal compliance; their privacy policies apply to that processing. Transfers to the USA are based on the EU–U.S. Data Privacy Framework adequacy decision (Art. 45 GDPR; Decision (EU) 2023/1795) where the recipient is certified, and otherwise on the European Commission’s Standard Contractual Clauses (Art. 46(2)(c) GDPR). You may request a copy of the relevant safeguards from me.

Other recipients. My tax adviser, my bank, and tax authorities where the law requires it. They act as independent controllers.

My site links to Instagram, YouTube and Substack. These are plain links, not embedded players or feeds. Following them takes you to those services, where their own privacy policies apply and I have no control over what they process.

09How I use AI in the work

I use AI tools as part of my research, analysis and drafting, in the same way I use search engines, databases and reference works. They help me read widely and quickly across published material, check arithmetic, test my own reasoning, and prepare first drafts. Every finding is verified against a primary source, and every audit is reviewed, edited and signed off by me. Nothing is generated and passed on unread.

What this means for your data, specifically:

• I use paid plans on which my inputs are not used to train the provider’s models.
• I may use these tools with the business information you give me for the engagement, such as your form answers and figures, under the provider’s business terms.
• I remove personal data of identifiable individuals before entering any material, except names your business has already published.
• Publicly available material about your business may be analysed with these tools, exactly as it may be read with a browser.
• No decision affecting you is made by an automated system. See section 12.

If you would prefer that no AI tool is used at any stage of your engagement, say so in writing before you commission and I will work without them.

10Your rights

Under the GDPR you have the right to:

• Access your data and receive a copy (Art. 15)
• Rectification of inaccurate data (Art. 16)
• Erasure (Art. 17)
• Restriction of processing (Art. 18)
• Data portability (Art. 20)
• Object to processing based on legitimate interests (Art. 21)
• Withdraw consent at any time, with effect for the future (Art. 7(3))

To exercise any of these, email info@truenorthstrategy.co. I will respond within one month. There is no charge.

Right of objection. Where I process your data under Art. 6(1)(f) GDPR you may object at any time on grounds relating to your particular situation. I will then stop unless I can demonstrate compelling legitimate grounds that override your interests, or the processing is needed to establish, exercise or defend legal claims.

Right to complain. You may lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or the place of the alleged infringement (Art. 77 GDPR). My competent authority is: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, www.baden-wuerttemberg.datenschutz.de.

11Is any of this required?

Providing personal data is not required by law or contract, with one exception: once a contract is concluded, tax law requires your billing name and address on the invoice. Without the data described above I cannot assess an application, enter a contract, or send you the letter.

12Automated decisions

I do not use automated decision-making or profiling within the meaning of Art. 22 GDPR. Applications are read and decided by me. Audits are researched, reviewed and signed off by me.

13Changes

I update this policy when my processing changes or the law does. The current version always applies.