Privacy Policy

1. Introduction

Kestrel ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website www.kestrelconsulting.services (the "Site").

Please read this Privacy Policy carefully.

2. Data Controller

The primary Data Controller responsible for your personal information under this policy is Kestrel Systems Pty Ltd, a proprietary limited company registered in South Africa.

2.1 EU Representative (GDPR Article 27)

As our operations are managed within the European Economic Area, our designated representative in the European Union is Lee Fowler, located in Stockholm, Sweden. For all queries regarding European data processing, please contact lee@kestreldb.com.

2.2 South Africa Information Officer (POPIA)

The designated Information Officer for South African compliance is Lee Fowler (lee@kestreldb.com). South African data subjects may lodge inquiries or complaints regarding our handling of personal information with the South African Information Regulator (complaints.IR@inforegulator.org.za).

2.3 GDPR Compliance Statement

We are committed to complying with the General Data Protection Regulation (GDPR) and applicable data protection laws. We process personal data lawfully, fairly, and transparently. We implement appropriate technical and organizational measures to ensure data security, minimize data collection, and respect your rights as a data subject.

We maintain a strict 30-day data retention policy for all customer and lead data. Personal data is deleted no later than 30 days after its last use or upon your request, whichever comes first.

3. Information We Collect

We may collect information about you in a variety of ways, including:

3.1 Personal Data

Personally identifiable information, such as your name, email address, phone number, and any other information you voluntarily provide to us when you:

• Submit a contact form
• Request early access to our product
• Sign up for our newsletter
• Communicate with us via email

3.2 Usage Data

Information our servers automatically collect when you access the Site, including:

• IP address
• Browser type and version
• Operating system
• Pages visited and time spent
• Referring website
• Device information

3.3 Data Sourced from Third Parties and Business Enrichment

For our business-to-business (B2B) lead generation, data mining, and sales outreach activities, we may collect professional personal data about you from third-party sources rather than directly from you.

Sources of Data: Publicly accessible corporate websites, professional networking platforms (e.g., LinkedIn), registry data, corporate directories, and third-party commercial data brokers or business intelligence platforms.

Categories of Data Collected: Professional identity data (first name, last name, job title, department), professional contact data (corporate email address, business telephone number, office address), and company data (company name, industry, company size, public corporate postings).

Data Enrichment and AI: We may use automated systems, software integrations, or artificial intelligence algorithms to cross-reference and enrich this data to ensure accuracy, infer professional interests, and evaluate whether your organization might benefit from our services. We do not engage in any automated profiling that produces legal or similarly significant effects on you.

3.4 AI Qualification Calls (Currently Dormant)

Note: AI-powered voice qualification calls are currently not in active use on this website. The primary lead capture method is the qualification form described in Section 3.5 below. When and if reactivated, this process would involve:

• Voice processing: Your voice is transmitted via LiveKit's real-time communication platform to our AI systems
• Speech-to-Text: Deepgram Inc. converts your speech to text for processing
• AI processing: Google LLC (Gemma) processes the conversation to understand your requirements and respond appropriately
• Text-to-Speech: Cartesia AI generates natural voice responses
• Call recordings: Calls may be recorded for quality assurance and training purposes
• SMS communications: Twilio Ireland Limited may send booking links and follow-up messages

Legal basis: Consent (GDPR Article 6(1)(a)) or Legitimate Interests (GDPR Article 6(1)(f)) for business prospects.

You may opt out of AI calls at any time by stating "I want to speak to a human" or by contacting us directly.

3.5 Lead Form Submissions (Active)

When you fill out the qualification form on our website, we collect:

• Your name, email address, and phone number
• Your stated timeline for building your revenue engine
• Your current monthly marketing spend estimate
• Consent timestamp and IP address

This data is stored in Google Sheets via a secure Google Apps Script integration. Google LLC acts as a data processor for this service. We collect this information to assess whether our services are a fit for your needs and to contact you accordingly.

Legal basis: Consent (GDPR Article 6(1)(a)) — you explicitly consent by checking the required consent checkbox before submission.

3.6 Online Appointment Scheduling

When you book an appointment through our scheduling system, we collect:

• Your name and email address
• Selected date and time
• Meeting topic or notes

This data is processed through Google Calendar to create the appointment. Google LLC acts as a data processor for this service.

4. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to track activity on our Site and store certain information. Tracking technologies used include:

4.1 Essential Cookies

These cookies are necessary for the website to function and cannot be switched off. They are usually set in response to actions made by you, such as setting your privacy preferences.

4.2 Analytics Cookies

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us know which pages are the most and least popular.

4.3 Marketing Cookies

These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites.

5. Legal Basis for Processing

We process your personal data on the following legal bases:

• Consent: For analytics and marketing cookies, and marketing communications
• Legitimate Interests: For essential website cookies, IT security, fraud prevention, and conducting business-to-business (B2B) marketing, lead enrichment, data validation, and direct sales outreach where our commercial interests are balanced against your privacy rights
• Contractual Necessity: When processing is necessary for the performance of a contract
• Legal Obligation: When required to comply with legal requirements

6. Use of Your Information

We may use the information we collect about you to:

• Provide, operate, and maintain our website
• Improve, personalize, and expand our website
• Understand and analyze how you use our website
• Develop new products, services, features, and functionality
• Communicate with you about our services
• Send you marketing and promotional communications (with your consent)
• Prevent fraud and ensure security
• Conduct qualification calls to assess service fit (currently dormant)
• Process lead form submissions and follow-up communications
• Schedule and manage appointments

6.1 Sensitive Data Warning

7. Disclosure of Your Information

We may share information we have collected about you in certain situations:

• By Law or to Protect Rights: If we believe disclosure is necessary to comply with legal obligations
• Third-Party Service Providers: We may share your information with third parties that perform services for us
• Business Transfers: In connection with any merger, sale of company assets, or acquisition

7.1 Data Processors

We engage the following processors to handle your personal data:

7.2 Data Processing Agreements

We have entered into Data Processing Agreements (DPAs) with all processors that handle your personal data. These agreements ensure that processors only process data according to our instructions and maintain appropriate security measures.

8. Data Retention

We maintain a strict data retention policy to minimize data storage and comply with GDPR principles of storage limitation:

• Lead and Customer Data: All personal data collected through lead forms, email communications, or any other means is retained for a maximum of 30 days after the date of last use or interaction.
• Upon Request: We will delete your data immediately upon your request (see Section 9 for your rights).
• Earlier Deletion: Data may be deleted earlier if it is no longer needed for the original purpose.

"Last use" means the most recent of:

• Your last interaction with our website
• Your last communication with us (email, call, or otherwise)
• The last date you opened our marketing emails
• The last date you engaged with our services

After 30 days, all personally identifiable information is permanently deleted from our active systems. Aggregated, anonymized statistics may be retained for business analytics purposes.

9. Your Data Protection Rights

Under the GDPR, you have the following rights:

To exercise any of these rights, please contact us at lee@kestreldb.com. We will respond to your request within 30 days.

GDPR Compliance: All personal data we collect is available to you upon request. We do not withhold any information and will provide complete copies of your data in a machine-readable format.

10. US State Privacy Rights (including California CPRA)

If you are a resident of California or other US states with comprehensive privacy laws, you have the right to request access to, correction of, or deletion of your personal data. You also have the right to opt-out of the “sale” or “sharing” of your personal information (including for targeted advertising).

We do not “sell” your personal information for money, but our use of the Meta Pixel may qualify as “sharing” for cross-context behavioral advertising. To exercise your right to opt-out, please use our cookie banner to decline marketing cookies or email us at lee@kestreldb.com.

We do not knowingly collect or share data from minors under 16.

11. Security of Your Information

We use administrative, technical, and physical security measures to protect your personal information. However, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure.

12. Children's Privacy

Our Site is not intended for children under 16 years of age. We do not knowingly collect personal information from children under 16.

13. International Data Transfers

Your information may be transferred to — and maintained on — computers located outside of your state, province, country, or other governmental jurisdiction where data protection laws may differ.

Specifically, your data may be transferred to:

• United States: LiveKit Inc., Deepgram Inc., Cartesia AI, Google LLC, PostHog Inc., Vercel Inc., and Meta Platforms, Inc.
• Ireland: Twilio Ireland Limited (EU-based)

When you consent to marketing cookies, data is transferred to Meta Platforms, Inc. in the United States.

We rely on EU Standard Contractual Clauses (SCCs) and/or the EU-US Data Privacy Framework to ensure adequate protection for personal data transferred to the United States. All processors are certified under the EU-US Data Privacy Framework or have signed Standard Contractual Clauses with us.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date at the top of this page.

15. Contact Us

If you have any questions about this Privacy Policy, please contact us:

You also have the right to lodge a complaint with a supervisory authority. In the EU, you can contact your local data protection authority.

16. Legal Notice (Impressum)