Privacy Policy

Last updated: 28 September 2026

1. Who we are

This website (duncanhendy.com) is operated by Duncan Hendy, trading as Duncan Hendy AI Mentoring, based in Brno, Czech Republic. For all privacy enquiries, contact info@duncanhendy.com.

For the purposes of GDPR, Duncan Hendy is the data controller for personal data collected through this website.

2. What data we collect

We only collect data you actively provide, plus minimal technical data needed to run the site.

Data you give us directly

• Call bookings (Cal.com): your name, email address, and anything you choose to add when you book a call.
• Contact emails: anything you send to info@duncanhendy.com.
• AI Readiness Assessment: the assessment runs in your browser and we do not store your answers. If you have accepted analytics cookies, your overall score and stage are recorded in Google Analytics, with nothing that identifies you.

Data collected automatically (only with your consent)

• Analytics cookies via Google Analytics 4: page views, session duration, referral source, anonymised IP, device type, and which links and buttons you click (for example, the book link or a booking button). Loaded only after you accept cookies in our consent banner.
• Functional cookies: a single cookie that remembers your consent choice so we do not ask you again on every page.

If you decline cookies, no analytics scripts load. The site works fully without them.

The booking calendar comes from Cal.com and loads only when you click a booking button. Nothing from Cal.com loads before that.

3. Why we collect it (legal basis)

• Consent (GDPR Article 6(1)(a)): for analytics cookies.
• Legitimate interest (GDPR Article 6(1)(f)): for responding to enquiries you initiate, and for basic security and fraud prevention.
• Contract (GDPR Article 6(1)(b)): to arrange a call you have booked, and, if you become a client, to deliver the services you have engaged us for.
• Legal obligation (GDPR Article 6(1)(c)): for tax, accounting, and regulatory record-keeping where applicable.

4. Who we share it with

We do not sell, rent, or trade your personal data. We use the following processors to operate the website. Each is bound by data processing agreements aligned with GDPR.

• Vercel Inc. (United States, hosting and edge delivery).
• Cal.com, Inc. (United States, call booking and video calls).
• Google LLC (United States and Ireland, Google Analytics 4, only when you consent).
• Google Workspace (United States and Ireland, business email and calendar).

Where data is transferred outside the European Economic Area, transfers rely on the European Commission's Standard Contractual Clauses or other GDPR-recognised safeguards.

Links to the book take you to Amazon. Anything you do there is covered by Amazon's own privacy policy, and Amazon shares no personal data about you with us.

5. How long we keep it

• Discovery call records: 24 months after the last interaction, unless you become a client.
• Client records: as required for the engagement, plus 7 years for tax and accounting compliance.
• Analytics data: aggregated and anonymised at 14 months by default in Google Analytics 4.
• Email correspondence: typically 24 months unless retention is required for an active matter.

6. Your rights under GDPR

As a data subject, you have the right to:

• Access (Article 15): request a copy of the personal data we hold about you.
• Rectification (Article 16): ask us to correct inaccurate or incomplete data.
• Erasure (Article 17): ask us to delete your data, subject to legal retention obligations.
• Restriction (Article 18): ask us to pause processing while you contest data accuracy or object to a use.
• Portability (Article 20): receive your data in a structured, commonly used format.
• Objection (Article 21): object to processing based on legitimate interest, including direct marketing.
• Withdraw consent at any time, where processing relies on consent.
• Lodge a complaint with the Czech Data Protection Authority (Úřad pro ochranu osobních údajů) or the supervisory authority in your country of residence.

To exercise any of these rights, email info@duncanhendy.com. We respond within 30 days.

7. Cookies in detail

When you first visit the site, a consent banner asks whether you accept analytics cookies. If you accept, we load Google Analytics 4. If you decline, no analytics scripts run. The only cookie we set in either case is a single functional cookie storing your consent choice (so we do not re-prompt on every page).

If you open the booking calendar, Cal.com may set cookies of its own inside the calendar window. Cal.com's privacy policy covers those.

You can change your choice at any time by clearing your browser cookies for this site, which will trigger the consent banner again on your next visit.

8. Children's privacy

This website is intended for B2B audiences and is not directed at children under 16. We do not knowingly collect personal data from children. If you believe a child has provided data, contact us and we will delete it.

9. Security

We use HTTPS across the whole site, restrict administrative access, rely on reputable processors, and apply security best practices for any data we store. No system is perfectly secure, but we take this seriously and review controls regularly.

10. Changes to this policy

We may update this policy as the site, services, or applicable law changes. The "Last updated" date at the top of this page reflects the most recent revision. Material changes will be noted on this page.

11. Contact

For any privacy question, request, or complaint, email info@duncanhendy.com.

Return to home