Privacy Policy

Gander Brand is a trading name of Liam Daglish, a UK-registered sole trader business. In this policy, "we", "us", and "our" refer to Gander Brand.

Data Controller: Liam Daglish trading as Gander Brand
64 Drayhorse Crescent, Woburn Sands, MK17 8GU
Email: liam@ganderbrand.com
Website: ganderbrand.com

For data protection purposes, Liam Daglish is the data controller responsible for your personal information.

This policy explains how Gander Brand collects, uses, stores, and protects personal information when you:

• Visit ganderbrand.com
• Request a free Signal Snapshot or enquire about The Diagnosis, Monitor, or The Build
• Engage us to deliver services
• Communicate with us by email

From website enquiry forms:

• Your name
• Your corporate email address
• Your company's domain URL
• Geographic markets your company operates in

During service delivery (paid engagements):

• Company name and publicly available company information
• Names and contact details of your nominated point of contact
• Any additional information you choose to share with us

From your use of our website:

• Technical data such as IP address and browser type required to securely load the website infrastructure

We do not collect sensitive personal data (such as health data, financial records, or data about individuals' beliefs or characteristics).

UK GDPR applies to all processing. We only process personal data where we have a valid lawful basis.

If you are based in Australia, we process your data in accordance with the Australian Privacy Principles under the Privacy Act 1988 (Cth). If you are based in New Zealand, we process your data in accordance with the Privacy Act 2020 (NZ). If you are based in Canada, we process your data in accordance with PIPEDA. These frameworks share substantive requirements with UK GDPR, and the standards described in this policy satisfy all applicable obligations.

Gander Brand's services, the Signal Snapshot, The Diagnosis, Monitor, and The Build, involve researching what AI language models (ChatGPT, Gemini, Perplexity, and others) say about your company using publicly available sources. During this process:

• We enter your company name and domain into publicly accessible AI tools using isolated browser sessions
• We do not share confidential information you provide us with those AI tools
• We do not use your data to train any AI model
• Outputs and reports we produce are stored securely and shared only with your nominated contacts
• For Monitor and The Build, scans are run monthly, the same data handling principles apply to every scan cycle

Deliverables produced during your engagement are delivered to you directly via secure, passcode-protected links hosted on ganderbrand.com.

We use a small number of trusted third-party tools to operate our business. Where these tools process personal data on our behalf, they act as subprocessors. We will notify active clients of any material changes to this list.

We do not sell your personal data to third parties. We do not share your data with any marketing platforms.

AI tools used in service delivery (ChatGPT, Gemini, Perplexity): These tools are used to research publicly available information about your company during the scan process. We use them via authenticated, isolated browser sessions. We do not pass confidential client data into these tools. We recommend reviewing each platform's own privacy policies: OpenAI, Google, Perplexity.

Gander Brand is a UK-registered business. Your data may be transferred to and processed across the UK and our US-based subprocessors (Microsoft, Base44, and Resend).

Where we transfer data outside the UK, we rely on:

• The UK-US Data Bridge (for transfers to certified US organisations)
• Standard contractual clauses where applicable

New Zealand has been assessed as providing adequate data protection under UK standards. Transfers to NZ-based contacts are made on this basis.

After the relevant retention period, data is securely deleted or anonymised.

Under UK GDPR, you have the following rights regarding your personal data:

• Right of access, you can request a copy of the personal data we hold about you
• Right to rectification, you can ask us to correct inaccurate data
• Right to erasure, you can ask us to delete your data in certain circumstances
• Right to restrict processing, you can ask us to pause processing of your data
• Right to data portability, you can ask us to provide your data in a portable format
• Right to object, you can object to processing based on legitimate interests

Australian residents have equivalent rights under the Australian Privacy Principles. You may also contact the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.

New Zealand residents have equivalent rights under the Privacy Act 2020 (NZ). You may also contact the New Zealand Privacy Commissioner at privacy.org.nz.

Canadian residents have rights under PIPEDA. You may also contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.

To exercise any of these rights, contact: liam@ganderbrand.com. We will respond within 30 days.

Our website uses essential session cookies required by the Base44 platform infrastructure to function safely and securely. We do not use any third-party tracking, advertising, or marketing cookies, meaning a cookie tracking consent banner is not required.

You can manage cookies through your browser settings at any time.

We take appropriate technical and organisational measures to protect your personal information, including:

• Using secure, HTTPS-encrypted connections on our website
• Delivering scan reports via password-protected video links
• Limiting access to personal data to Liam Daglish only
• Running client scan workflows in isolated, dedicated agent environments to prevent data from one client engagement being accessible in another
• Using reputable, contractually bound third-party services

If you are unhappy with how we have handled your personal data, you have the right to lodge a complaint with the relevant supervisory authority:

• United Kingdom: The Information Commissioner's Office (ICO) at ico.org.uk
• New Zealand: The Office of the Privacy Commissioner at privacy.org.nz
• Australia: The Office of the Australian Information Commissioner (OAIC) at oaic.gov.au
• Canada: The Office of the Privacy Commissioner of Canada at priv.gc.ca

We would appreciate the chance to deal with your concerns before you approach a supervisory authority, so please contact us at liam@ganderbrand.com in the first instance.