Privacy notice.
What this site collects, why, who else sees it, how long it is kept, and how to make it stop. Written to be read, not to be survived.
Who is responsible
The data controller for this site is Perun LTD, a UK-registered company trading as Matt Drankowski. Work is delivered remotely from Kraków, Poland, so personal data submitted here is accessed from Poland as well as the UK.
For anything in this notice — access, deletion, or a complaint — email [email protected]. It reaches me directly; there is no support queue.
What this site collects
When you submit a form
This site has two submission points: the fit check that runs before booking a call, and the resource unlock forms on the assessment, model, and framework pages. Between them they collect your work email, organisation size, the bottleneck and timeline options you select, and your decision timeframe. Every submission also records the IP address it came from, which is included in the notification email as an anti-abuse measure.
Submissions are delivered to me by email through Amazon SES. They are not written to a database. One exception: if email delivery fails, a resource-unlock submission is appended to a local file on the server as a fallback so the request is not lost. That file holds the same fields, including IP.
When you just read
Nothing identifying, unless you accept analytics. Google Analytics is off by default and only starts once you press Accept on the cookie banner. If you reject, or ignore the banner, no analytics cookies are set and Google receives no identifiers from your visit. You can change your mind at any time using the button further down this page.
If you accept, analytics records the pages you view, approximate location derived from IP, device type, referrer, and any campaign tags in the link you arrived on. IP anonymisation is enabled.
When you book a call
Booking runs through Calendly. What you enter into the booking form goes to Calendly and to me. Calendly sets its own cookies and applies its own privacy notice.
Why, and on what legal basis
- Responding to enquiries and delivering requested material — legitimate interest, and in most cases steps taken at your request before entering a contract. If you ask me a question, I need your details to answer it.
- Analytics cookies — consent, given through the banner. Never assumed from continued browsing.
- Anti-abuse (IP logging, rate limiting, spam checks) — legitimate interest in keeping the forms usable.
Who else processes your data
| Processor | What it handles | Where |
|---|---|---|
| Amazon Web Services (SES) | Delivers form submissions to me by email | EU (eu-west-1, Ireland) |
| Cloudflare | Serves and protects the site; sees request metadata and IP | Global edge network |
| Google Analytics | Usage analytics — only after you accept | USA / global |
| Calendly | Call booking, if you choose to book | USA |
| Slack | Optional submission alert to a private channel | USA |
| Google Fonts | Serves the site's typefaces; receives your IP | Global |
Your data is never sold, and never shared with anyone else for their own marketing. Transfers to US-based processors rely on the UK International Data Transfer Addendum and those providers' standard contractual clauses.
Cookies and local storage
| Name | Purpose | Consent | Lifetime |
|---|---|---|---|
| PHPSESSID | Rate-limits form submissions | Strictly necessary | Session |
| matt_consent_v1 | Remembers your cookie choice | Strictly necessary | 12 months |
| matt_intake_gate_v2 | Remembers your fit-check answers so you don't retype them | Strictly necessary | 7 days |
| cro_attribution | Holds campaign tags from your arrival link | Strictly necessary | Until tab closes |
| _ga, _ga_* | Google Analytics visit measurement | Requires your consent | Up to 2 years |
| Calendly cookies | Set by Calendly if you open the booking widget | Set by Calendly | See Calendly |
Rejecting analytics deletes any Google Analytics cookies already set.
How long it is kept
- Enquiries and fit-check submissions — kept in my mailbox for up to 24 months, so I can pick up a conversation that resumes a year later. Deleted sooner on request.
- The server-side fallback log — cleared once the entries have been processed, and in any case within 90 days.
- Analytics — retained by Google for 14 months.
- Engagement records — where we go on to work together, contract and billing records are kept for 6 years to meet UK tax and accounting obligations.
Your rights
Under UK GDPR you can ask me for a copy of what I hold about you, ask for it to be corrected or deleted, object to processing based on legitimate interest, ask for processing to be restricted, request your data in a portable format, and withdraw consent at any time without affecting what happened before.
Email [email protected] and I will respond within one month. There is no charge.
If you are unhappy with how I have handled your data, you can complain to the UK Information Commissioner's Office at ico.org.uk or on 0303 123 1113. I would rather you raised it with me first, but that is your call, not a precondition.
Changes
If this notice changes materially, the date at the top changes with it and the previous version is superseded. There is no separate notification list.