Privacy & Cookie Policy

Last updated: 22 June 2026

This policy explains what data GTMiQ collects, why, who processes it, and how you can access or delete it. Plain language, no dark patterns. If anything is unclear, email david@ascendia.ceo.

Who runs this site

GTMiQ is a service of Ascendia, operated by David Mustač, based in Zagreb, Croatia. Ascendia is the data controller for the personal data described below.
Contact: david@ascendia.ceo

1. What I collect

Pipeline Readiness Scorecard: if you complete the scorecard, I collect your email address, optional company name, and your answers to the 10 questions — only after you tick the consent box.
Direct contact: if you email or book a call, I keep what you send so I can reply and follow up.
Analytics: aggregate, anonymous usage data (pages viewed, country, referrer) via Plausible — no cookies, no personal identifiers, no cross-site tracking.

I do not collect special-category data, and I don't buy or scrape your data from third parties through this website.

2. Why I use it (legal basis)

Consent (GDPR Art. 6(1)(a)) — for the scorecard email and follow-up. You opt in with the checkbox and can withdraw any time.
Legitimate interest (Art. 6(1)(f)) — for B2B follow-up relevant to your stated interest, and for aggregate analytics to improve the site. You can object at any time.

3. Who processes it (sub-processors)

I keep the stack lean. These providers process data on my behalf:

Provider	Purpose	Region
Vercel	Website hosting & delivery	EU / US
Plausible Analytics	Cookieless, aggregate analytics	EU (Germany)
Notion	Storing scorecard submissions / CRM	US
FormSubmit	Delivering form submissions by email	US
Apollo	Optional B2B enrichment of submitted email	US
lemlist / lemwarm	Email infrastructure & deliverability	EU / US

Where a provider is outside the EU/EEA, transfers rely on Standard Contractual Clauses or an equivalent safeguard.

4. Cookies

This site sets no tracking or advertising cookies. Analytics run on Plausible, which is cookieless by design and stores no personal identifiers. Because no non-essential cookies are set, no cookie-consent banner is required under the ePrivacy Directive — this is a deliberate, documented choice, not an oversight. Any strictly necessary cookies set by the host (Vercel) are essential to serving the page and exempt from consent.

5. How long I keep it

Scorecard and contact data is kept only as long as it's relevant to our conversation, and deleted on request. Aggregate analytics contain no personal data and are retained indefinitely in anonymous form.

6. Your rights

Under the GDPR you can ask me to:

Access the data I hold about you
Correct anything inaccurate
Delete your data ("right to be forgotten")
Object to or restrict processing, or withdraw consent
Port your data to another provider

How to make a request (DSAR)

Email david@ascendia.ceo with what you'd like to do. I'll respond within 30 days, free of charge. You also have the right to complain to the Croatian data-protection authority, AZOP.

This policy may be updated as the service evolves; the "last updated" date above reflects the current version.