Privacy policy

Who is responsible for your information

The Cattalyst, operated by Oliver Catt, is responsible for personal information collected through thecattalyst.com and decides why and how it is used. In data protection language, The Cattalyst is the controller of this information. For some client projects we may instead process information on a client's instructions; that work is covered by the relevant service agreement and data-processing terms.

Privacy questions and requests can be sent to oliver@thecattalyst.com.

What this policy covers

This policy covers visits to thecattalyst.com, enquiries sent through its contact form, cookie choices, and newsletter details if newsletter sign-up is enabled. A discovery-call link opens a booking service operated by HighLevel/LeadConnector; information entered there is also subject to that provider's notices and is made available to The Cattalyst to arrange the meeting.

Information we collect

• Contact details: first and last name, email address, optional telephone number, preferred contact method, and the record that you agreed we may respond to the enquiry.
• Booking details: information you choose to provide when arranging a call through the linked booking service.
• Newsletter details: your email address and subscription status if newsletter sign-up is enabled and you opt in.
• Technical and security data: limited request information that our hosting provider may process automatically, such as IP address, browser or device information, requested page, timestamps and diagnostic or security logs.
• Consent preference: your analytics choice, stored in your browser's local storage. See our Cookie Policy.

Please do not submit passwords, payment-card information, health information or other sensitive or confidential material through the general contact form. The website is not intended to collect that information.

Why we use it and our legal basis

Available legal bases differ between countries. We rely on each basis below only where it is recognised by the law that applies to the particular processing.

• Responding to you: to handle an enquiry, arrange a requested call and take steps you ask us to take before a possible engagement. We rely on those requested pre-contract steps and our legitimate interest in answering genuine business enquiries.
• Managing relationships: to maintain a useful record of discussions, proposals and agreed follow-up. We rely on our legitimate business interests and, once engaged, performance of the relevant contract.
• Operating and protecting the site: to deliver pages, diagnose problems, prevent abuse and maintain security. We rely on legitimate interests in operating a safe, reliable website and on legal obligations where they apply.
• Optional updates and analytics: where required, we rely on your consent. You can withdraw that consent at any time. The contact-form permission allows us to respond to that enquiry; it is not a general marketing opt-in.
• Legal and business protection: to keep appropriate records, comply with law, and establish, exercise or defend legal rights where necessary.

You do not have to submit a website enquiry, but we need your name and email address to respond through the form. The telephone field is optional.

Automated decisions

We do not use information submitted through this website to make decisions about you based solely on automated processing that produce legal or similarly significant effects. Enquiries are reviewed and handled by people.

Where the information goes

The website is hosted on Vercel. A contact-form submission is processed by a server-side route over HTTPS and forwarded to The Cattalyst's restricted-access HighLevel/LeadConnector customer relationship management system (CRM). The webhook address and account credentials are kept on the server and are not exposed in the public website code. The CRM stores the enquiry so the authorised team can respond and manage follow-up.

We may also use providers for booking, email delivery, security, professional advice and website support. They receive only the information reasonably needed for their role and process it under their own terms and, where applicable, contractual data-protection commitments. Current core providers publish further information in the Vercel Privacy Notice and the HighLevel Privacy Policy.

We do not sell personal information. We may disclose it if required by law, to protect legal rights or safety, or as part of a genuine business reorganisation subject to appropriate confidentiality and data-protection steps.

International processing

The Cattalyst works internationally, and Vercel, HighLevel/LeadConnector and their subprocessors may process information in the United States and other countries. Those countries may have different privacy laws from your own. Where applicable law requires a transfer safeguard, we use or rely on appropriate provider terms and recognised contractual mechanisms, such as standard contractual clauses or an applicable data-transfer addendum.

How we protect information

We use proportionate technical and organisational safeguards. These include HTTPS encryption in transit, server-side handling of the CRM webhook, authenticated provider accounts, access restricted to people who need the information, minimising the fields collected, and provider security and backup controls. Enquiry data is not placed in public pages or public source files.

No internet service can promise absolute security. If we become aware of a personal data incident, we will investigate, contain it and notify affected people or regulators when applicable law requires us to do so.

How long we keep it

• Enquiries that do not become an active client relationship are normally reviewed and deleted or anonymised no later than 24 months after the last meaningful contact.
• Client, transaction and contract records are kept for the engagement and any additional period reasonably needed for accounting, tax, insurance, dispute and other legal obligations.
• Newsletter information is kept until you unsubscribe. We may retain a minimal suppression record so that we can honour an opt-out.
• Technical and security logs are retained for the limited periods set by our providers or reasonably required to investigate reliability, abuse or security.

We may retain a record longer if required by law or reasonably necessary for a live claim, dispute, fraud investigation or security incident. We then delete or anonymise it when that reason ends.

Your choices and rights

Depending on the law that applies where you live, you may have rights to access a copy of your information; correct it; ask for deletion or restricted use; object to processing based on legitimate interests; receive portable information; and withdraw consent without affecting earlier lawful processing. You always have the right to object to direct marketing and can unsubscribe from it at any time.

Email oliver@thecattalyst.com to exercise a right. We may ask for enough information to verify your identity and will respond within the period required by applicable law. Some rights are not absolute; if an exception applies, we will explain it.

You may also complain to the privacy or data-protection regulator where you live. UK visitors can contact the Information Commissioner's Office. We would appreciate the opportunity to address the concern first.

Children

This business website is not directed at children under 16 and we do not knowingly collect their personal information. If you believe a child has submitted information, contact us so we can investigate and delete it where appropriate.

Changes and contact

We may update this policy when the website, our providers or applicable law changes. Material changes will be highlighted where appropriate, and the latest revision date will always appear above. Questions can be sent to oliver@thecattalyst.com.