Privacy policy

Who is responsible for your data

GM CORP LTD, a company registered in England and Wales under number 09858142, with its registered office at 167-169 Great Portland Street, Fifth Floor, London, England, W1W 5PF, is the data controller. That means we decide why and how we process the data you leave with us.

For anything to do with your data, write to marcin@gmcorp.uk. We reply within 30 days at the latest.

What we collect

Only what you give us yourself, or what comes out of booking and holding a call:

• your name
• email address
• phone number
• the company you represent
• your answers to the questionnaire you fill in before the call
• booking details: the slot you picked, your time zone, the meeting link, and any reschedule or cancellation
• a recording and transcript of the meeting, if you agree to it

We also count visits to the booking page. For each visit we store the date and time, the campaign tags from the address (utm_source, utm_medium, utm_campaign, utm_content), the page you came from, your browser type, and a hash of your IP address. The hash is salted with a secret key and cannot be turned back into an address — we only need it to filter out bots and to avoid counting one person ten times. The purpose is to know how many people from an ad actually book a call; the basis is our legitimate interest (Art. 6(1)(f)). Visit records that did not lead to a booking are deleted after 90 days; the rest go when your data goes.

We don't buy contact lists and we don't collect anything about you from other sources.

Why we use it, and on what basis

• To answer your enquiry and talk about working together — you came to us, and these are steps before entering a contract (Art. 6(1)(b) UK GDPR / GDPR).
• To book, confirm, remind you about and reschedule meetings — same basis (Art. 6(1)(b)).
• To judge whether we can actually help you, and to keep our own sales notes — our legitimate interest (Art. 6(1)(f)).
• To record and transcribe a meeting — only on your consent (Art. 6(1)(a)).
• To meet accounting and tax obligations if we end up working together — because the law requires it (Art. 6(1)(c)).

We don't use your data for automated decision-making or for profiling that would have legal effects on you.

How long we keep it

• Contact details and questionnaire answers — 24 months from our last contact with you.
• Booking details — 24 months from the date of the meeting.
• Meeting recordings and transcripts — 12 months from the meeting.
• Email correspondence — 24 months from the last message.
• Booking page visit records — 90 days, if no call was booked.
• Accounting records, if we work together — as long as tax law requires.

If you ask us to delete your data sooner, we delete it straight away — except anything we're legally required to keep.

Who we share it with

We don't sell data and we don't hand it to anyone for their own marketing. We use tools that process data only on our instructions:

• Supabase — the CRM database, servers in the European Union.
• Vercel — application hosting and the traffic to this page.
• Google — Calendar and Meet: meeting invitations and the video calls themselves.
• Resend — sending confirmation and reminder emails.

Some of these companies are based outside the European Economic Area. Where that happens, data is transferred under standard contractual clauses approved by the European Commission.

Recording and transcribing meetings

We can record online calls and transcribe them automatically, so we don't have to take notes mid-conversation and don't lose what was agreed.

We always tell you at the start of the meeting and ask for your consent. If you'd rather we didn't — say so, and we don't record. The call goes ahead as normal.

The recording and transcript go into our notes from the call. They are never published or shared outside the company. You can withdraw consent at any time, and we'll delete both.

Your rights

At any time you can:

• find out exactly what data we hold about you, and get a copy
• correct anything out of date or wrong
• ask us to delete your data
• restrict what we do with it
• get your data in a form you can take elsewhere
• object to processing based on our legitimate interest
• withdraw consent — to recording, for example — without affecting what we lawfully did beforehand

To use any of these rights, write to marcin@gmcorp.uk. One sentence is enough — no justification, no forms. We may ask you to confirm your identity, so that we don't send your data to a stranger.

If you think we're handling your data badly, you can complain to a supervisory authority — in the UK that's the Information Commissioner's Office (ico.org.uk), in Poland the President of the Personal Data Protection Office (uodo.gov.pl).

Changes to this policy

If we change how we work with data, we'll update this document and bump the date at the top of the page. The version published here is always the current one.