Growth-stage B2B SaaS

Robbie Maltby

One operator, whole engine

Privacy policy

Last updated

This site sets no cookies, and the only personal data I collect is what you choose to type into two forms. I never sell it, and I never share it for advertising.

Who I am

I'm Robbie Maltby. I run this site and the marketing practice behind it as an individual (one operator, working remotely, currently from Montenegro). I'm the data controller for anything collected here, and the person to ask about it: hello@robbiemaltby.com.

I work with clients in the EU and the UK, so I hold this site to EU and UK GDPR standards, and apply them to everyone, wherever you're reading from.

What I collect

Personal data enters this site in exactly two places, both forms on the homepage that you fill in yourself.

The newsletter

If you subscribe, I collect your email address and nothing else. It goes to EmailOctopus, the service that stores the list and sends the letters, and you're only added once you confirm by email (double opt-in). The lawful basis is your consent, and every letter carries an unsubscribe link that withdraws it in a click.

One side-effect is worth naming: when you join, a one-off notification containing your address is emailed to my inbox, relayed by Forward Email.

The enquiry form

If you leave a note about working together, I collect your name, work email, company website if you give one, and your message. It's stored in a private database (Cloudflare D1), and a copy is emailed to my inbox (relayed by Forward Email, read in HEY). The lawful basis is taking steps prior to a contract, and my legitimate interest in replying to you.

Neither form stores your IP address or any browser data, and nothing you submit is written to server logs. There are no accounts, no payments, no tracking pixels, no profiling or automated decision-making, and no cookies (the cookie policy is short).

Hosting and security

The site is served through Cloudflare's network, which processes visitor IP addresses and request metadata in transit to deliver pages and block abuse: the ordinary working of any modern host, resting on legitimate interest. I never see or store that data myself.

Where it goes

Four services process data on my behalf, each doing one job:

That's the full list. Nothing is sold, and nothing is shared for advertising.

International transfers

Those processors sit in the UK and the US. EmailOctopus is a UK company, so newsletter data stays under UK GDPR, which the EU recognises as adequate. Cloudflare is certified under the EU–US Data Privacy Framework, including its UK extension. 37signals and Forward Email handle EU and UK data under the standard contractual clauses in their data processing agreements.

How long I keep it

Your newsletter address stays on the list until you unsubscribe or ask me to delete you. After unsubscribing, EmailOctopus keeps a suppression record so you can't be accidentally re-added.

Enquiries are deleted 24 months after submission, on a quarterly purge, along with the notification copies in my mailbox.

Analytics

I use Cloudflare Web Analytics to see aggregate page loads and performance. It's cookieless, does no cross-site tracking, and builds no advertising profiles; for visitors in the EU it doesn't run at all. Like the hosting above, it rests on legitimate interest.

Your rights

You can ask for a copy of your data, have it corrected or deleted, restrict or object to how it's used, or take it elsewhere in a portable format. If you gave consent, you can withdraw it at any time. Email hello@robbiemaltby.com and I'll respond within a month.

Complaints

If you think I've handled your data badly, email me first and I'll put it right. You can also complain to your local supervisory authority: in the UK, the ICO; in the EU, your national data protection authority.

Changes

If anything about how I handle data changes, this page changes with it, and the date at the top moves.