Privacy Policy
Effective date: 1 November 2026 (version 1.1)
1. Introduction
GTMBound is a trade name of David Baele, a sole trader (eenmanszaak) providing GTM engineering, paid media and content services to B2B companies. This policy explains how we collect, use and protect personal data when you visit our website, contact us, or work with us as a client, prospect, partner or vendor.
This policy does not cover data we process on behalf of our clients under a services agreement. That data is governed by our client contracts and the client’s own privacy policy (see Section 4).
Controller: David Baele, trading as GTMBound, Grimbergen 28, 9700 Oudenaarde, Belgium, enterprise number BE 1044.152.243
Privacy contact: david@gtmbound.com
2. Information We Collect
We collect business contact and usage information, mostly from people acting in a professional capacity.
Information you give us
• Contact details: name, job title, company, business email, phone number.
• Communications: emails, form submissions, meeting notes and messages in shared channels.
• Booking details: name, email address and the answers you give when you pick a time for a call.
• Client onboarding details: billing contacts, platform access, brand assets and campaign inputs.
Information we collect automatically
• Technical logs: IP address, browser type, pages viewed, referring URL and time of each request.
• Visit statistics from our analytics tool (see Section 5).
Information from third parties
• Public professional information, such as company websites and professional profiles, when you contact us or when we prepare for a conversation with you.
3. How We Use Information
We use personal data to:
• Respond to enquiries, send proposals and manage client relationships.
• Deliver, report on and improve our services.
• Keep our website secure and analyse its traffic.
• Record and transcribe calls, so we can listen instead of taking notes. We say so at the start of the call, and you can ask us not to record.
• Use AI and automation tools to summarise meetings and draft content, subject to the safeguards in Sections 6 and 7.
• Invoice, collect payment and manage vendor relationships.
• Comply with legal obligations.
Legal bases under the GDPR: performing a contract (or steps before entering one), our legitimate interest in running a secure B2B business, your consent where we ask for it, and legal obligations.
We do not sell personal data. We do not use client data to train AI models without the client’s written permission.
4. Client Data
When we run campaigns or build GTM systems for a client, we act as a processor on that client’s behalf. The client remains the controller and is responsible for the data and its lawful collection.
Client data may include CRM records, audience and contact lists, ad account data, conversion and analytics data, enrichment results and content assets. We access it only to perform the services, under the client’s instructions and our services agreement.
We will not use client data for our own marketing, combine it across clients, or disclose it except as the client directs or the law requires. A Data Processing Agreement is available on request.
If you received a message or saw an ad from one of our clients, the client is your first point of contact. You can also write to us, and we pass your request on.
5. Cookies and Tracking Technologies
Our website is hosted by Framer. Like any web server, it keeps short technical logs of each request, including your IP address, to deliver the pages and keep the service secure. We rely on our legitimate interest in running a secure website.
We count visits with Framer Analytics. It sets no cookies and stores nothing on your device, so we see pages and where visitors came from, not who they are. Our pages set no cookies, which is why there is no cookie banner.
Website analytics
We use Framer Analytics to understand how our website is used. It does not use tracking cookies and does not assign persistent visitor identifiers. Visitor data is anonymised: IP addresses and browser information are hashed with a key that rotates every day, so a visitor cannot be recognised across days or linked back to a person. We use this data only in aggregate, to improve the website.
We do not use advertising or retargeting cookies on our own website. The buttons to pick a time open Calendly. From then on, Calendly’s own privacy and cookie terms apply.
6. How We Share Information
We share personal data only as needed to run our business, with providers that each do one job:
• Framer: hosting this website and counting visits (Framer Analytics).
• Google Workspace: email, calendar and documents.
• Calendly: picking a time for a call.
• Fathom: call recordings and transcripts.
• Notion, Microsoft OneNote and Slack: internal notes, contact details and team chat.
• Enrichment, automation and advertising tools: used on client campaigns only, under the client’s instructions (see Section 4). A list of sub-processors is available on request.
• Anthropic and OpenAI: summarising and drafting. Business-grade services that do not train on our inputs by default.
We also share data with subcontractors bound by confidentiality, professional advisors such as accountants, and authorities where the law requires it, or with your consent.
7. Data Retention and Security
We keep personal data only as long as needed for the purposes above, our contracts and legal requirements.
• Website logs: 30 days, then deleted.
• Visit statistics: no individual visitor is kept.
• Emails, call notes and bookings: while we are in touch, then as long as they help a possible next conversation, or until you ask us to delete them.
• Client data: returned or deleted within 90 days after an engagement ends, unless the client asks otherwise or the law requires us to keep it.
• Invoices and accounting records: as long as Belgian law requires.
We protect data with access controls, multi-factor authentication, encrypted storage and transfer where available, vetted vendors and confidentiality agreements. No method of transmission or storage is completely secure. We will notify affected parties and the Belgian Data Protection Authority of a data breach as required by law.
8. Your Rights and Choices
Under the GDPR you have the right to:
• Access the personal data we hold about you and get a copy.
• Correct inaccurate data.
• Delete your data.
• Restrict or object to certain processing, including processing based on our legitimate interest, and withdraw consent at any time.
• Port your data to another provider.
• Complain to a supervisory authority.
To make a request, email david@gtmbound.com. We may ask you to confirm who you are before we act, and we answer within one month.
Supervisory authority: Gegevensbeschermingsautoriteit (Belgian Data Protection Authority, Autorité de protection des données), Drukpersstraat 35, 1000 Brussels, contact@apd-gba.be, dataprotectionauthority.be.
9. International Transfers
Some of our providers are based in the United States or elsewhere outside the European Economic Area. When data leaves the EEA, we rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission’s Standard Contractual Clauses in the provider’s data processing terms.
10. Children’s Privacy
Our website and services are for businesses and are not directed at children under 13. We do not knowingly collect their personal data. If you believe we have, contact us and we will delete it.
11. Changes to This Policy
We may update this policy from time to time. We will post the new version here with a new version number and effective date, and notify clients of material changes.
12. Contact Us
GTMBound (David Baele)
Email: david@gtmbound.com