Privacy policy

1. Overview

I collect very little and only what I need to run the business. I never sell your information and I never will. If you want to know what I hold about you, or want it deleted, email me and I will sort it out.

2. Controller

No Data Protection Officer is appointed. The business is too small to need one and there is nobody between you and me.

3. Data collection on this website

Hosting and visitor statistics

This site is hosted by Automattic, Inc. (WordPress.com), which records your IP address, the pages you viewed, where you arrived from and your browser and device type. I see this only as anonymous totals and cannot identify you from it. Art. 6(1)(f) GDPR, legitimate interest in running and improving the site.

Cookies and the booking calendar

The site sets no cookies of its own. The Contact page embeds a Google Calendar booking window, which is served by Google and does set cookies. A notice appears at the bottom of the screen on your first visit: accept and the calendar and statistics load, decline and they stay switched off. Declining is one click, the same as accepting, and you can change your mind at any time. Art. 6(1)(a) GDPR, consent.

Booking a call

Booking through the calendar means giving Google your name, email address and anything else you type in. It lands in my Google Calendar and I use it to prepare for our conversation and send you the joining link. Art. 6(1)(b) GDPR, steps taken at your request before entering a contract.

4. Calls

I record every call I run, as a video recording and a written transcript, using Google Meet and Sana Labs AB (Sana AI). That includes the free discovery call. I do it so I can be present in the conversation rather than taking notes, and so what you tell me is captured accurately. A summary is then generated from the transcript using AI tools, including, but not limited to, Anthropic’s Claude and Google’s Gemini.

You can say no. Tell me before we start or at any point during the call and I will turn it off, and the conversation goes ahead exactly the same way. I will always say that recording is running before it starts. Art. 6(1)(a) GDPR, consent, which you can withdraw afterwards by email.

5. Working together

An Audit or a Training Programme involves confidential 1:1 conversations with people inside your business. I hold names, roles and what people told me about their work. I report themes and findings back to you, never who said what, unless that person has agreed. Art. 6(1)(b) and (f) GDPR.

Invoicing means holding billing details and a record of what was charged. As I am a resident of, and operate mainly from, Bulgaria, I am required to follow Bulgarian accountancy and tax laws. This means holding billing details and a record of what was charged on all invoices. These invoices need to be kept on record for a period of 10 years, so this information is the one thing I cannot delete on request. Art. 6(1)(c) GDPR, legal obligation.

6. Who else processes your data

• Automattic, Inc. (WordPress.com), including its built-in Titan email service – website hosting, visitor statistics and business email, United States
• Google Ireland Ltd / Google LLC (Gmail, Calendar, Meet, Sheets, Slides, Docs and Gemini) – email, calendar, video calls, file storage and AI summarising, EU and United States
• Sana Labs AB (Sana AI), Swedish company registration number 559060-6579 – call recording and transcription. Sana has confirmed this workspace’s data, including meeting recordings and transcripts, is stored and processed in the EU by default, in secure EU data centres run on Google Cloud Platform
• Anthropic, PBC (Claude) – used to help process material such as call transcripts and notes, United States
• Notion Labs, Inc. – client relationship management records, United States
• Guy’s accountant – billing and accounting records, Bulgaria

Transfers to the United States are covered by the European Commission’s standard contractual clauses or the EU-US Data Privacy Framework. Beyond the above, I share data only where the law requires it and with no one else.

7. How long I keep things

• Enquiries that did not become work – deleted after 12 months
• Everything connected to a client relationship, including call recordings, transcripts and notes – kept for as long as we are working together, plus 12 months afterwards
• Invoices and accounting records – 10 years, as required by Bulgarian law

8. Your rights

Under GDPR you have the right to:

• Access your personal data (Art. 15 GDPR)
• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Object to processing (Art. 21 GDPR)
• Withdraw consent at any time, including consent to record a call (Art. 7(3) GDPR)

Email hello@craftingyourintelligence.com and I will reply within 30 days, usually much sooner. There is no charge.

9. Complaints

Tell me first, because most things are solved by a conversation. If that does not resolve it, you can complain to the Bulgarian Commission for Personal Data Protection, 2 Prof. Tsvetan Lazarov Blvd, Sofia 1592, kzld@cpdp.bg, cpdp.bg. If you are in the UK you may prefer the Information Commissioner’s Office at ico.org.uk, and elsewhere in the EU you can go to your own national authority.

10. Changes to this policy

I may update this page from time to time. The current version is always the one published here. If a change is significant and I have your email address, I will tell you rather than quietly editing the page.