Privacy & cookies.

When you visit the site: page visited, referrer, country, device type, and aggregate behaviour (button clicks, form interactions). Used to understand which content actually helps senior leaders find what they need.

If you book a discovery call: calendar booking is handled by Cal.com. I receive your name, email, and any context you share.

If you email me: your email address and the contents of your message.

If you become a coaching client: contracting details, session notes (kept private to me), invoice records.

Legitimate interest for site analytics (with your explicit consent for non-essential cookies, see below).

Performance of a contract for active coaching engagements (Article 6(1)(b)).

Consent for cookies and marketing email (Article 6(1)(a)).

Strictly necessary: a cookie that stores your consent choice so the banner doesn't reappear.

Analytics (only if you accept): PostHog for product analytics and Vercel Analytics for visitor counts. Both are privacy-first, no advertising networks involved. Decline and they don't run. You can change your choice any time by clearing site data in your browser.

No third-party advertising cookies. No retargeting pixels. No social tracking.

You have the right to:

• Access the personal data I hold on you (Art. 15)
• Rectify inaccurate data (Art. 16)
• Erase your data (Art. 17, "right to be forgotten")
• Restrict how I use it (Art. 18)
• Receive a portable copy of the data you gave me (Art. 20)
• Object to processing based on legitimate interest (Art. 21)
• Withdraw consent at any time, where consent is the basis

To exercise any right, email hello@martongaspar.com. I'll respond within 30 days, free of charge.

If you're unhappy with how I handle your request, you can complain to the UK Information Commissioner's Office at ico.org.uk.

I rely on a small number of trusted third parties ("sub-processors") to run the site and the practice. Each one only processes what's necessary for their function. Their own privacy notices live behind the links below.

• Vercel Inc. — site hosting and edge analytics. US, with UK/EU edge nodes. Privacy notice.
• PostHog Inc. — product analytics. Data stored in the EU region (eu.posthog.com). Privacy notice.
• Cal.com Inc. — discovery-call booking. US-based. Privacy notice.
• Mailgun Technologies Inc. — email delivery for @martongaspar.com addresses. US-based. Privacy notice.
• GoDaddy Operating Company LLC — domain registrar and DNS. US-based. Privacy notice.

I review this list quarterly. If a new sub-processor is added, this notice will be updated and the date at the top will change.

Some of my sub-processors are based in the United States. Personal data transferred to them is protected by the UK International Data Transfer Addendum (IDTA) or Standard Contractual Clauses (SCCs), in line with UK GDPR. Each provider above maintains current SCCs in their published Data Processing Addendum.

Site analytics: 12 months in PostHog, then auto-deleted.

Booking records (Cal.com): 24 months from the call, unless you become a client (in which case retained for the life of the engagement).

Active coaching engagements: contract and invoicing records kept for 7 years to meet UK tax and accounting law (HMRC).

Email correspondence: kept for 24 months from last contact, then deleted.

I don't sell your data. I don't share email addresses with third parties beyond the sub-processors above. I don't run advertising on this site. I don't use AI to read your emails or session notes.

If I make a material change, I'll update the date at the top and, if you are an active coaching client, I'll email you. The current version always lives at this URL.

Marton Gaspar (data controller). hello@martongaspar.com. London, United Kingdom.