How your information is handled

This practice exists because people tell it things they are not ready to put in a board pack. That only works if it is clear, in advance, where those things go.

Written to be read before you send anything, and to answer the questions your procurement and IT teams will ask without you having to chase me for them.

What this practice is

One person, and no sub-contractors

Ground Truth Advisory is Helen Vernon working directly. There is no associate network, no offshore research team and nobody else reading your material. When work is delivered, it has been done by the person you engaged.

That is a constraint as much as a promise: it limits how much work runs at once, and I will tell you if a timeline is not realistic rather than quietly resourcing it out.

Data protection

Controller, register and lawful basis

Data controllerGround Truth Advisory, Stamford, United Kingdom
ICO registrationREGISTRATION NUMBER
Contact for data questionshelen@groundtruthadvisory.co.uk
Lawful basis, enquiriesLegitimate interest — responding to someone who contacted me
Lawful basis, engagementsPerformance of a contract

Under UK GDPR you can ask what I hold about you, ask for it to be corrected, ask for it to be deleted, or object to my holding it. Email the address above. I will answer within thirty days and usually within two working days, because there is not much to look through.

This website

What the site collects

The diagnostic on The GapScored in your browser. Nothing leaves the page unless you ask for the note by email.
The note by emailYour address and your result. Used to send that one note, and to tell me it happened. No list, no sequence, no sharing. Deleted after ninety days unless you reply.
The site assistantYour messages are sent to Anthropic's API to generate a reply. Not used to train models. Retained in server logs for thirty days for debugging, then gone. Do not paste anything confidential into it — it is a signpost, not a confidential channel.
Booking a callHandled by Calendly. Name, email and whatever you write in the box go to them under their terms.
AnalyticsAggregate page counts only. No cookies set by this site, no advertising pixels, no cross-site tracking, nothing sold to anyone.

If a subject is sensitive enough that you would not put it in an email, do not put it in the assistant either. Book a call and say it out loud.

Sub-processors

Who else touches it

NetlifyHosting and serverless functions · USA and EU · Standard Contractual Clauses
AnthropicThe site assistant only · USA · not used for model training
CalendlyBooking · USA · only what you type into a booking form
ResendSending the field note · EU/USA
Microsoft 365Email and documents · UK/EU tenancy

This list is the whole of it. If it changes, this page changes with it and the date at the top moves. Clients on an active engagement are told in advance.

Engagements

What confidentiality means here

The reason this practice works is that people at site level will say things to me they will not say upwards. Protecting that is the product, not a policy attached to it.

AttributionFindings are reported without names, sites or anything that identifies a source by inference. If a finding cannot be reported safely without naming someone, I raise the problem rather than the name.
Your materialHeld for the engagement and six years afterwards where professional records require it, then destroyed. Returned or deleted sooner on request.
Your NDASigned as standard. I do not require you to sign mine.
ConflictsDeclared before an engagement starts, including where I have worked with a competitor, an OEM in the same network, or a supplier to you. If a conflict emerges mid-engagement, you hear it that week.
ReferencesNo client is named publicly without written permission. Silence about who I work for is the default, not a concession.
AI in deliveryUsed for drafting and structuring my own writing. Client-identifying material is not pasted into consumer AI tools. Where a tool is used on your material, it is named in the engagement letter first.

Commercial

Insurance and terms

Professional indemnityINSURER · LIMIT · RENEWAL
Public liabilityINSURER · LIMIT
Company detailsREGISTERED NAME · NUMBER · VAT STATUS
Payment termse.g. 30 days from invoice

Certificates are available on request and are usually what procurement actually wants. If your onboarding pack needs a supplier questionnaire completing, send it over — I would rather do that once, properly, than hold up a start date.

If something goes wrong

Breach and complaints

If information is lost or exposed, affected clients are told within seventy-two hours of my becoming aware, with what happened, what was involved and what I am doing about it — before I have a complete picture rather than after.

Complaints go to the same address. If you are not satisfied with how a data matter is handled, you can raise it with the Information Commissioner's Office at ico.org.uk.