Privacy policy
How personal information submitted through tomgoldman.us is collected, used, stored and protected, and how to access, correct or delete it.
Last updated: November 13, 2026.
1. Who is responsible for your information
This privacy policy covers tomgoldman.us and every page on it (the Site). The controller of the personal information described here is Tom Goldman, a sole proprietor registered in Poland, who runs the Site and is referred to below as I, me or my. You can reach me through the details on the Contact page.
Because my business is established in the European Union, I process personal information in accordance with the EU General Data Protection Regulation (GDPR). Visitors and clients located in the United States may also have rights under the consumer privacy laws of their state, such as the California Consumer Privacy Act as amended by the California Privacy Rights Act. Many of those laws apply only to businesses that meet certain thresholds. Where a state privacy law applies to my business, I honor the rights it grants, as described in section 8.
I handle privacy matters personally; there is no separate data protection officer. Questions and requests about your information come directly to me.
2. Information I collect
The information I hold about you comes from what you choose to send and from the technical side of visiting a website:
- What you type into forms and briefs: your name, email address, phone number or WhatsApp or Telegram handle, the name and website of your business, the service you are asking about, your message and when you would like a call.
- Consultation bookings: the same details plus the date and time slot you pick.
- Conversations: emails and messages you exchange with me on WhatsApp, Telegram or similar apps, and my notes from calls with you.
- Technical data: your IP address, browser and device type and the pages you open. The hosting infrastructure processes this to deliver the Site and keep it secure. Analytics and advertising tools process it only after you consent, as explained in the cookie policy.
I do not need, and ask you not to send, sensitive information through the Site, for example health details, Social Security numbers or bank and card numbers.
3. Purposes and legal grounds
| What I do with the information | Legal ground under the GDPR |
|---|---|
| Answer your inquiry, prepare a quote or proposal, run a consultation | Pre-contract steps you asked for (Art. 6(1)(b)), or my legitimate interest in replying to people who contact me (Art. 6(1)(f)) |
| Deliver marketing services under a signed agreement | Necessity for the contract (Art. 6(1)(b)) |
| Invoice and keep bookkeeping records | Legal obligations under tax and accounting law (Art. 6(1)(c)) |
| Measure Site traffic and advertising with cookies | Consent you give in the cookie banner (Art. 6(1)(a)) |
| Protect my rights if a dispute arises | Legitimate interest (Art. 6(1)(f)) |
You are not obliged to give me any information, but without contact details I cannot reply or work with you. Consent can be withdrawn whenever you wish, and withdrawal does not make earlier processing unlawful.
Marketing emails from me always identify the sender and include the unsubscribe option and other details the CAN-SPAM Act requires. Marketing text messages are sent only to people who have given the prior express written consent required under the Telephone Consumer Protection Act.
4. No sale of personal information
I do not sell personal information, and I do not disclose it to third parties for money. I do not use personal information to make decisions that produce legal or similarly significant effects about you. Advertising cookies, such as the Meta Pixel, are placed only if you opt in through the cookie banner. If a state law treats such cookies as sharing for cross-context behavioral advertising or as targeted advertising, you can opt out at any time by refusing or withdrawing consent for marketing cookies in the cookie settings linked in the Site footer.
5. Storage and recipients
Inquiries sent through the Site are saved in the customer relationship management (CRM) system I use to manage leads and projects. The Site itself is hosted and served through Cloudflare, which handles technical data such as IP addresses in order to deliver pages and block attacks. Beyond that, information is passed on only where needed, to:
- the services I use for email, messaging and video calls with you;
- my accountant and the provider of my invoicing software;
- Google and Meta for statistics and ad measurement, and only after you have accepted the relevant cookies;
- partners I trust who carry out part of a client project, for example a chatbot, and only to the extent the project requires;
- public authorities, when the law requires it.
These recipients either process information on my behalf under data processing terms, or act as separate controllers under their own privacy policies.
6. International transfers
As my business is based in the European Union and some providers, including Cloudflare, Google and Meta, operate in the United States and other countries, your information may be processed outside the country where you live. Transfers of personal information from the European Economic Area to the United States rely on the EU-US Data Privacy Framework, where the recipient participates in it, or on standard contractual clauses approved by the European Commission. Information processed in another country may be accessible to authorities of that country under its laws.
7. Retention periods
- Leads and inquiries that do not become a project: kept for 12 months after the last exchange with you, then removed from the CRM.
- Client project records: kept while the agreement runs and afterward until the limitation period for related claims expires.
- Invoices and bookkeeping: kept as long as Polish tax law requires, which is generally five years after the end of the tax year concerned.
- Anything based on your consent: kept until you withdraw it.
- Cookies: kept for the lifetimes listed in the cookie policy.
8. Your rights
GDPR rights. You may ask for a copy of the personal information I hold about you, have mistakes corrected, have the information erased, limit or object to how it is used, receive it in a portable format and withdraw any consent you gave.
Under US state privacy laws, if a state law applies to my business, residents of that state may have the right to know what personal information is collected and how it is used, to access it, to correct inaccurate information, to delete it, to obtain a portable copy, to opt out of the sale or sharing of personal information and of targeted advertising, and to limit the use of sensitive personal information. You will not be discriminated against for exercising any of these rights. Where the applicable law provides for it, you may appeal my decision on your request by replying to my response, and if the appeal is denied, you may contact your state attorney general.
To exercise any right, contact me using the details on the Contact page. I may need to verify your identity before acting on a request, using information you have already provided. You may use an authorized agent where state law allows it. I respond without undue delay and in any case within one month, or within the period set by the applicable state law, which may be extended where the law permits and I tell you why.
If you are not satisfied with how your information is handled, you can complain to the Polish supervisory authority (the President of the Personal Data Protection Office) or, if you live in the EU, to the authority in your own country. US residents can turn to their state attorney general or, in California, to the California Privacy Protection Agency. Please give me a chance to put things right first.
9. Keeping information safe
Pages on the Site are delivered over an encrypted HTTPS connection. The CRM and other tools I use require personal logins, use two-factor authentication where it is offered, and are accessible only to people who need them for their work. Even so, no system or transfer over the internet can be guaranteed to be completely secure. Should a breach affect your personal information, you and the relevant authorities will be informed where applicable law requires it.
10. Children's information
The Site is aimed at business owners and managers. It is not intended for children, and I do not knowingly collect personal information from anyone under the age of 16. If you think a child has sent information through the Site, let me know and it will be removed.
11. Other websites
Links on the Site may take you to client websites, social networks, booking tools and other services. Once you leave the Site, the privacy practices of those services apply, not this policy.
12. Updates
This policy is revised when the law, the tools in use or the way the Site works changes. The version published on this page, with the date at the top, is the current one.