Privacy policy

Who is responsible

The controller for the processing of your personal data on this website, in bookings and in our outreach emails (Art. 4(7) GDPR) is:

For any privacy question, write to the email address above.

Hosting and delivery

This website is hosted and delivered by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Every time you open a page, your browser sends technical data that is needed to deliver it.

Data

IP address, date and time of the request, the page or file requested, the referring website, browser type and version, operating system, amount of data transferred. If a page fails to load, your browser may also send a short error report to Cloudflare (Network Error Logging).

Purpose

Delivering the website, keeping it fast and available, and protecting it against attacks and abuse.

Legal basis

Art. 6(1)(f) GDPR. Our legitimate interest is a secure and reliable website.

Required?

You are not legally or contractually obliged to provide this data, but your browser has to send it to load the website. Without it, the site cannot be displayed.

Processor

Cloudflare processes this data on our behalf under a data processing agreement (Art. 28 GDPR).

Outside the EU

Cloudflare may process data in the USA. Cloudflare is certified under the EU-U.S. Data Privacy Framework, which is covered by an adequacy decision of the European Commission (Art. 45 GDPR). Its data processing agreement also includes the EU standard contractual clauses (Art. 46(2)(c) GDPR). You can request a copy of the standard contractual clauses from us.

Storage

We do not keep server logs ourselves and only see aggregated statistics, such as the number of requests. Cloudflare keeps connection data only as long as needed to deliver the website and to detect and fend off attacks, as set out in its data processing agreement, and then deletes it.

More: Cloudflare privacy policy.

Cookies, tracking and fonts

We do not use analytics, tracking pixels, advertising networks or social media plugins, and we set no cookies or local storage ourselves. That is why there is no cookie banner: nothing is stored on or read from your device that would need your consent.

Cloudflare’s network can add two strictly necessary exceptions. If Cloudflare shows you a security check, for example because of unusual traffic from your network, it sets a cookie (cf_clearance) that records that you passed it. If bot protection is switched on, Cloudflare may also set __cf_bm, which expires after 30 minutes of inactivity. In addition, Cloudflare asks your browser to remember for up to seven days that failed page loads may be reported (Network Error Logging, see section 02). These are allowed without consent under § 25(2) No. 2 TDDDG. The legal basis for the related processing is Art. 6(1)(f) GDPR.

The typefaces on this website (Archivo and Martian Mono) are served from our own domain. Your browser does not connect to Google Fonts or any other external font service.

Booking an intro call

Our “Book a free intro call” buttons take you to our booking page at TidyCal, a scheduling service provided by Sumo Group Inc. (d/b/a “TidyCal”), 1305 E. 6th St #3, Austin, TX 78702, USA. Nothing is sent to TidyCal before you click.

Data

What you enter when booking: your name, email address, your answers to our questions (for example your company website and what you sell) and the time you choose. TidyCal also processes technical data such as your IP address.

On TidyCal’s page

TidyCal’s booking page itself uses Google services, such as Google Tag Manager, Google Analytics and Google reCAPTCHA (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, with possible transfer to Google LLC in the USA). They connect your browser to Google and may store information on your device. TidyCal decides on their use as its own controller; see the TidyCal privacy policy.

Purpose

Scheduling the call, sending you a confirmation and reminders, and preparing for the conversation.

Legal basis

Art. 6(1)(b) GDPR (steps taken at your request before a possible contract) and Art. 6(1)(f) GDPR (our legitimate interest in organising and preparing meetings).

Required?

You are not legally or contractually obliged to give us these details. Without your name, email address and a time slot, we cannot schedule the call.

Processor

TidyCal processes your booking on our behalf under its data processing agreement (Art. 28 GDPR). TidyCal’s own privacy policy states that it also processes data as a controller for its own purposes, for example server and security logs, which it keeps for 15 days.

Outside the EU

Your booking is processed in the USA. The transfer is based on the EU standard contractual clauses (Art. 46(2)(c) GDPR). You can request a copy from us.

Storage

We delete the booking from our TidyCal account once we no longer need it, at the latest six months after the call, unless we start working together or statutory retention periods apply. TidyCal keeps its own records according to its privacy policy.

Calendar and the call itself

When you book, the appointment is added to our Google Calendar, and the call takes place by phone or via Google Meet. Both are part of Google Workspace, provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, which processes your name, email address and, during a video call, your IP address, audio and video on our behalf (Art. 28 GDPR). Data may be transferred to Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR).

If we decide to work together, we process the data needed to perform the contract (Art. 6(1)(b) GDPR) and keep business records for as long as tax law requires (§ 147 AO, § 14b UStG), usually six to ten years.

Contacting us

If you email or call us, we process your name, contact details and message to answer you. The legal basis is Art. 6(1)(b) GDPR if your message relates to a contract or to steps before one, and otherwise Art. 6(1)(f) GDPR, our legitimate interest in answering enquiries. You are not obliged to give us your details, but without them we cannot answer you.

Emails to our support address are received and forwarded by Cloudflare (see section 02). Our email is hosted by Google Workspace (Google Ireland Limited, see section 04), which processes it on our behalf (Art. 28 GDPR); transfers to the USA rely on the EU-U.S. Data Privacy Framework (Art. 45 GDPR). We delete your message once your enquiry is fully dealt with, unless statutory retention periods apply.

Our outreach emails

We find new clients the same way we work for them: with short, individual emails to people at businesses we think our service can help. If you received such an email from us, this section applies to you (Art. 14 GDPR). Every email we send names Clevewood Consulting as the sender, links to this section and tells you how to object.

Data

Your name, business email address, job title, the company you work for, publicly available information about that company, and the history of our emails and your replies.

Source

Publicly available business sources, such as company websites and professional networks, and the business contact databases of Apollo.io (ZenLeads, Inc., 440 N Barranca Ave #4750, Covina, CA 91723, USA) and Instantly (Foo Monk, LLC dba Instantly.ai, 30 N. Gould St., Ste. R, Sheridan, WY 82801, USA). On request we tell you the exact source of your details (Art. 15(1)(g) GDPR).

Purpose

Offering our services to businesses that may benefit from them.

Legal basis

Art. 6(1)(f) GDPR. Our legitimate interest is offering our services to businesses (Recital 47 GDPR). We only contact people in their professional role, about their business, and only in countries whose law allows such business emails without prior consent. We do not send unsolicited marketing emails to recipients in Germany.

Tracking

Our emails contain no tracking pixels and no tracked links. We do not record whether or when you open them.

Recipients

Google Workspace (Google Ireland Limited) hosts our mailboxes, and our outreach software Instantly (Foo Monk, LLC dba Instantly.ai, USA) sends the emails and stores replies. Both act as our processors (Art. 28 GDPR). Apollo.io and Instantly’s lead database are sources of your data (see “Source”), not recipients. Transfers to the USA rely on the EU-U.S. Data Privacy Framework (Art. 45 GDPR) for Google, and on the EU standard contractual clauses (Art. 46(2)(c) GDPR) for Instantly. You can request a copy of the standard contractual clauses from us.

Storage

If you do not reply, we delete your details at the latest 12 months after our last email. If you reply, we keep the conversation for as long as our business contact needs it, and business letters for up to six years where tax law requires it (§ 147 AO). If you object, we keep only your email address on a block list so that we never contact you again (Art. 6(1)(f) GDPR).

Outreach for our clients

When we run email outreach for a client, the emails carry the client’s company name. The client defines which companies and roles are contacted and why, and we build the contact list to that brief from the sources named in section 06. For this work the client is the controller, and we process the data only on the client’s documented instructions, as its processor (Art. 28 GDPR). We keep our own block list of people who asked not to be contacted, so that nobody who objected is emailed again; for that list we are a controller ourselves (Art. 6(1)(f) GDPR). To exercise your rights, contact the company named in the email or us.

Your rights

You have the following rights regarding your personal data:

• Access to the data we hold about you, including where it came from (Art. 15 GDPR)
• Correction of inaccurate data (Art. 16 GDPR)
• Deletion of your data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability: receiving your data in a common, machine-readable format (Art. 20 GDPR)
• Withdrawal of consent with effect for the future, where processing is based on consent (Art. 7(3) GDPR)
• Complaint to a data protection supervisory authority, in particular in the EU member state where you live or work, or where the alleged infringement took place (Art. 77 GDPR)

To use any of these rights, email support@clevewood.com. We answer within one month (Art. 12(3) GDPR).

Security

This website is only available over an encrypted connection (HTTPS/TLS), which you can recognise by the padlock in your browser’s address bar. We use technical and organisational measures to protect the data we process (Art. 32 GDPR). We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR).

Changes to this policy

We update this policy when our website or services change, or when the law requires it. The current version is always on this page.

Last updated: 29 October 2026