Privacy notice.
What this site collects, why, who else sees it, how long it is kept, and how to make it stop. Written to be read, not to be survived.
Who is responsible
The data controller for this site is Perun LTD, a UK-registered company trading as Matt Drankowski. Work is delivered remotely from Kraków, Poland, so personal data submitted here is accessed from Poland as well as the UK.
For anything in this notice, including access, deletion, or a complaint, email [email protected]. It reaches me directly; there is no support queue.
What this site collects
When you submit a form
This site has two submission points: the AI delivery diagnostic, and the resource unlock forms on the assessment, model, and framework pages. Between them they collect your work email, organisation size, the AI adoption, measurement and evidence options you select, and, only if you accept analytics, the campaign tags in the link you arrived on. Every submission also records the IP address it came from, which is included in the notification email as an anti-abuse measure.
Submissions are delivered to me by email through Amazon SES. They are not written to a database. If you complete the diagnostic you also receive a copy of your own answers at the address you gave, sent the same way; that address is kept for an hour afterwards as a one-way hash, so the form cannot be used to mail the same person repeatedly. One exception: if email delivery fails, a resource-unlock submission is appended to a local file on the server as a fallback so the request is not lost. That file holds the same fields, including IP.
When you just read
Optional analytics stays off unless you accept. Google Analytics is off by default and only starts once you press Accept on the cookie banner. If you reject, or ignore the banner, no analytics cookies are set and no requests are sent to Google Analytics. Other services used by this site are listed below. You can change your mind at any time using the button further down this page.
If you accept, analytics records the pages you view, approximate location derived from IP, device type, referrer, and any campaign tags in the link you arrived on. Advertising personalisation remains disabled.
Why, and on what legal basis
- Responding to enquiries and delivering requested material. Legitimate interest, and in most cases steps taken at your request before entering a contract. If you ask me a question, I need your details to answer it.
- Analytics cookies. Consent, given through the banner. Never assumed from continued browsing.
- Anti-abuse (IP logging, rate limiting, spam checks). Legitimate interest in keeping the forms usable.
Who else processes your data
| Processor | What it handles | Where |
|---|---|---|
| Amazon Web Services (SES) | Delivers form submissions to me by email | EU (eu-west-1, Ireland) |
| Cloudflare | Serves and protects the site; sees request metadata and IP | Global edge network |
| Google Analytics | Usage analytics, only after you accept | USA / global |
| Slack | Optional submission alert to a private channel | USA |
| Google Fonts | Serves the site's typefaces; receives your IP | Global |
Your data is never sold, and never shared with anyone else for their own marketing. Transfers to US-based processors rely on the UK International Data Transfer Addendum and those providers' standard contractual clauses.
Cookies and local storage
| Name | Purpose | Consent | Lifetime |
|---|---|---|---|
| PHPSESSID | Rate-limits form submissions | Strictly necessary | Session |
| matt_consent_v1 / matt_consent_v1_ts | Remembers your cookie choice | Strictly necessary | 12 months |
| matt_intake_gate_v2 | Remembers your fit-check answers so you don't retype them | Strictly necessary | 7 days |
| cro_attribution | Holds campaign tags from your arrival link | Requires your consent | Until tab closes |
| cro_first_touch | Remembers the campaign that first brought you here | Requires your consent | 90 days; discarded on next access after expiry |
| _ga, _ga_* | Google Analytics visit measurement | Requires your consent | Up to 2 years |
Rejecting or withdrawing analytics consent clears the campaign attribution stored by this site and its Google Analytics cookies. If analytics was already running, the page reloads to stop it. Your cookie choice remains saved. Withdrawal stops future collection; it does not undo data already sent while consent was valid.
How long it is kept
- Enquiries and fit-check submissions. Kept in my mailbox for up to 24 months, so I can pick up a conversation that resumes a year later. Deleted sooner on request.
- The server-side fallback log. Cleared once the entries have been processed, and in any case within 90 days.
- Analytics. Retained by Google for 14 months.
- Engagement records. Where we go on to work together, contract and billing records are kept for 6 years to meet UK tax and accounting obligations.
Your rights
Under UK GDPR you can ask me for a copy of what I hold about you, ask for it to be corrected or deleted, object to processing based on legitimate interest, ask for processing to be restricted, request your data in a portable format, and withdraw consent at any time without affecting what happened before.
Email [email protected] and I will respond within one month. There is no charge.
If you are unhappy with how I have handled your data, you can complain to the UK Information Commissioner's Office at ico.org.uk or on 0303 123 1113. I would rather you raised it with me first, but that is your call, not a precondition.
Changes
If this notice changes materially, the date at the top changes with it and the previous version is superseded. There is no separate notification list.