Privacy Policy

1. Data controller and contact details

Philip Kerr is the data controller for the activities described in this notice.

Postal address: Philip Kerr, Myraveien 3, 3132 Husøysund, Norway.

For privacy questions, withdrawal of consent or requests about your information, contact hello@philip-kerr.com.

2. Personal information collected

The MailerLite course form requires your first name and email address. It also offers a separate optional marketing choice. The form sends these fields to MailerLite. The consent timestamps, preference history, delivery records and other technical information retained by MailerLite have not been confirmed.

Email engagement information may include opens and clicks where tracking is enabled. Actual settings and subscriber-level records require account verification, as explained in section 6. Website analytics include page addresses, referring pages and campaign parameters, as described in section 7. Page addresses and query parameters can contain personal information; analytics without cookies can still involve personal data.

3. Purposes and legal bases

Your request for the course is the basis for using your name and email address to register you, personalise and deliver the five lessons, and manage that subscription. The intended legal basis for this requested email series is your consent under GDPR Article 6(1)(a). Future marketing requires a separate, freely given and specific choice. GDPR Article 7 requires that consent can be withdrawn and that it can be demonstrated; backend consent records have not been verified.

Optional website analytics are configured to depend on a separate analytics choice and are intended to help understand website visits and navigation. The website has consent controls, but their operation has not been verified in the browser. The basis and any separate consent required for individually attributable email tracking remain unresolved. Legitimate interests have not been adopted as a substitute for missing tracking consent or an uncompleted assessment.

Norwegian Marketing Control Act section 15 generally requires prior consent for electronic marketing to natural persons. Joining a free course is not automatically an existing-customer exception. Norwegian ekomloven section 3-15 requires consent for non-essential storage or access on a visitor’s device; a strictly necessary exception needs justification. The application to individual email pixels and click technologies requires assessment of the actual technology, not a blanket assumption.

GDPR Articles 12–14 require clear information about how personal data is used. Purpose limitation, data minimisation and storage limitation under Article 5 also require the outstanding implementation and retention decisions described below to be resolved.

4. Free email courses

“The New Rules of Sales Performance” is a free five-day course delivered through MailerLite. Registration is intended to trigger five automated lessons and support subscriber management, delivery, preferences and unsubscribe requests. The account’s automation settings and actual lesson delivery have not been verified.

The optional marketing checkbox is unchecked and is not required by the form or its submission script. The form is configured to let you request the course without selecting optional marketing. Registration and the account’s separation of course-only participants from marketing subscribers have not been verified end to end.

Course signup is not consent to future marketing or personal open and click tracking. You can ask to stop the course by contacting hello@philip-kerr.com. MailerLite emails are intended to provide an unsubscribe link, but delivered emails and that link’s operation have not been verified.

5. Optional marketing communications

The separate optional checkbox says: “I'd also like to receive occasional insights and updates on sales performance and leadership.” Leaving it unchecked must not prevent course registration or authorise ongoing marketing.

When selected, the form sends this choice to MailerLite as a GDPR preference field. How MailerLite records proof of consent, maps this choice to the correct preference and excludes course-only participants from marketing campaigns has not been verified. These controls remain to be confirmed.

Optional marketing is intended to use your separate consent under GDPR Article 6(1)(a) and Norwegian Marketing Control Act section 15. You may withdraw it through an unsubscribe link in a marketing email or by contacting hello@philip-kerr.com; the email route exists, while provider unsubscribe and preference behaviour still need testing. Withdrawal does not affect earlier lawful processing. Selecting marketing does not by itself authorise personal email engagement tracking. This notice does not authorise lead scoring or behavioural sales outreach.

6. Email engagement tracking

Email open tracking uses a small invisible image, often called a tracking pixel. Loading that image can report an open associated with a subscriber. Individually attributable click tracking uses tracking links to associate link activity with a recipient. Where enabled and lawful, the purpose described here is to evaluate engagement with the educational content, not to score leads or initiate behavioural sales outreach.

Open tracking for campaigns and automations has been reported as enabled, but has not been independently verified. The account’s pixels, click tracking settings, collected fields and tracking controls remain unconfirmed because account settings and delivered lesson emails have not been checked.

Philip has confirmed that MailerLite’s Google Analytics tracking option is enabled for UTM attribution. UTM parameters label a link’s campaign source, medium or campaign; they are distinct from an open pixel or recipient-specific click tracking. Enabling that option does not establish that Google Analytics 4 is installed on this website. The website’s source contains no GA4 script or measurement configuration.

The course form and website code contain no separate consent control or enforcement for email tracking. Any account-side controls remain unverified. Consent to receive lessons or optional marketing does not automatically authorise personal open or click tracking. The applicable GDPR basis and any terminal-access consent requirement need a technology-specific legal assessment. Tracking cannot be described here as verified, compliant or operating on demonstrated tracking consent.

For provider explanations, see MailerLite’s tracking guide and Privacy Policy. These documents do not verify this account’s configuration.

7. Website analytics and cookies

The website is configured to use Supabase visit collection and Vercel Web Analytics when you accept analytics. The descriptions below explain their configured behaviour. Actual browser requests, receipt by providers and server processing have not been verified.

The Supabase visit script sends the site identifier, page path including its full query string, referrer, and utm_source, utm_medium and utm_campaign to its visit-ingestion endpoint. It sends an initial visible-page visit and subsequent path or query changes using a beacon or fetch request. It skips specified Dagny editor iframes and automated browsers. That script contains no cookie, local-storage or session-storage writes. How the server handles IP addresses, user agents and additional metadata, and how long it retains data, has not been confirmed.

Vercel Web Analytics is mounted only after acceptance. Its software requests a debug script in development and the website’s analytics script in production. The production script is configured to send page URLs, route information, SDK/version metadata and an external referrer for relevant views. It supports optional events and identity attribution, but the website code does not invoke custom event, identify, group or enableCookie functions. Its conditional attribution storage uses the local-storage key __va_attribution if identity features are invoked; no expiry is set in that code. This is not proof that such a key or an analytics cookie is created during ordinary visits.

The consent code starts with no accepted choice, reads saved preferences, and loads these two integrations only for a valid acceptance. It guards their fetch and beacon destinations at send time; Vercel also has an event filter. Decline, withdrawal or expiry is configured to block further optional events, including events from scripts already loaded. Vercel live-feedback is blocked. These controls have not been verified in the browser during initial loading, navigation, changes in other tabs or preference expiry. Their configuration alone does not confirm that they work in every environment.

Use “Cookie settings” in the footer to reopen the existing controls, then “Decline / withdraw consent” to withdraw site analytics consent. This is separate from email preferences. Withdrawal does not delete data already sent or affect earlier lawful processing.

The preference cookie pk_optional_tracking lasts 180 days from the last explicit choice, with Path=/, SameSite=Lax and Secure on HTTPS. A temporary pk_optional_tracking_test cookie tests writes and is immediately deleted when writes succeed. The fallback key pk_optional_tracking_fallback stores the choice and a 180-day expiry in local storage and session storage when available. Expired fallback entries are removed when read; session storage also ends when the tab closes. If durable storage fails, the choice is held for the tab or current page. These are preference controls, not analytics identifiers; whether this storage qualifies as strictly necessary has not yet been established.

Elsewhere on the site, performance-currency stores a selected calculator currency in local storage without a configured expiry or analytics-consent gate. Its functional necessity and storage period have not yet been established. A strictly necessary storage exemption has not been confirmed.

The course page loads MailerLite’s form script and makes a form-related “takel” request on mount without waiting for site analytics consent. The served provider script can generate and retain ml_guid in local storage and append it to a serialised submission; no expiry is configured in that script. It also contains a conditional form-view image request requiring a data-id attribute that this form does not have. Whether these conditional features run, the purpose of “takel”, and any additional provider cookies or storage lifetimes have not been verified in a browser. Essential form operation and any optional measurement or identifier use must be distinguished and assessed separately; the site’s analytics buttons do not gate this integration.

8. Third-party service providers

MailerLite receives the course form fields directly. It is used for subscriber management and the intended automated lessons, acting as a processor for that activity on Philip Kerr’s behalf. The actual account agreement, automation, marketing preference mapping and tracking configuration remain unverified. See its Data Processing Agreement and Privacy Policy.

Dagny hosts and manages this website with Vercel deployment infrastructure. Supabase provides the external visit script and collection endpoint; Vercel provides the invoked Web Analytics integration. Their exact contractual roles, configured regions, subprocessors and server-side data handling require confirmation. See Supabase’s Privacy Policy and Vercel’s Privacy Policy.

The site also embeds ScoreApp on the assessment page and links to Calendly for booking. Neither is identified here as a global website analytics provider. Their separate processing, and other enquiry or client systems, are outside the scope of this notice. This notice should not be taken as a description of how those services handle your information.

9. International data transfers and safeguards

Use of these providers may involve processing outside Norway or the European Economic Area. The locations where subscriber data, visits, hosting logs and backups are stored or accessed have not been confirmed. Provider descriptions of EU storage do not prove that all processing remains in the EU.

Applicable arrangements must be established for each provider: actual regions and subprocessors, any transfers, a valid adequacy decision or other GDPR Chapter V safeguard, and any required transfer assessment and supplementary measures. Standard contractual clauses may be an appropriate mechanism, but executed clauses, applicable adequacy coverage and completed transfer-risk assessments have not been verified. No international transfer safeguards are confirmed by this notice.

10. Data retention

Course-only participants: the deletion or anonymisation schedule for subscriber and delivery records has not yet been confirmed. A previously stated period of up to 12 months after the course has not been verified as an implemented limit. The website code contains no corresponding cleanup process or enforced lifetime, and MailerLite’s deletion settings have not been verified. You should not rely on that period as a deletion promise.

Optional marketing subscribers: a separate retention schedule, periodic review and deletion process must be confirmed. Retention until unsubscribe has not been established as the policy and should not be understood to authorise indefinite retention.

Consent and unsubscribe suppression records: only records needed to demonstrate consent, honour withdrawal or meet applicable duties should be retained. Their actual fields, basis and deletion periods have not been verified. Unsubscribing stops the relevant messages; it does not prove deletion of subscriber, consent, engagement or backup data.

Analytics: the server-side deletion schedules and enforced retention periods for Supabase visits and Vercel analytics have not been confirmed. MailerLite engagement retention and hosting-log retention are also unconfirmed. Provider account termination is not equivalent to deletion after course completion or unsubscribe.

Browser preferences: the established configured lifetime is 180 days for the site analytics preference and its fallback expiry, subject to the tab/page limits described above. The website and provider scripts show no configured expiry for performance-currency, conditional ml_guid or conditional __va_attribution storage. Browser preference expiry is not a server analytics deletion period. Contact hello@philip-kerr.com to request deletion or details of retention while these schedules are being established.

11. Your GDPR rights

Under GDPR Articles 15–22, as applicable, you may request access, correction, erasure, restriction and data portability, and object to processing. You may object to direct marketing at any time, including profiling related to that marketing. Rights can have legal conditions and exceptions. This notice does not authorise automated decision-making or lead scoring.

You may withdraw consent at any time without affecting earlier lawful processing. Contact hello@philip-kerr.com for email preferences and rights requests, use the unsubscribe link in received emails where provided, or use the footer’s “Cookie settings” for website analytics. The operation of provider unsubscribe links has not been verified.

You may complain to the Norwegian supervisory authority, Datatilsynet, or another competent data protection authority. Requests should receive a response without undue delay and normally within one month, subject to the GDPR’s permitted extensions and requirements.

12. Data security

The website integrations are configured to use HTTPS addresses. The site includes restrictions on script sources and consent-related controls on requests. These measures do not provide an assurance that all processing is secure.

Provider account permissions, encryption at rest, access controls, backups, incident procedures and server security have not been verified. No guarantee of absolute security or unverified provider controls is made. Appropriate measures must be confirmed for the information and risks involved.

13. Policy updates and contact

This policy will be updated as outstanding provider settings, retention schedules, transfer safeguards and consent requirements are confirmed or changed. The date above identifies the latest revision.

For questions about this notice or your information, contact hello@philip-kerr.com.