Privacy notice
Last updated: 27 October 2026
A clear explanation of what happens when you browse this site or send an enquiry.
Who is responsible
Jaco van der Merwe is responsible for the personal information collected through this website and the Headroom AI Readiness Review enquiry service. For privacy questions or requests, email jaco@headroomaudit.com.
What we collect
When you submit an enquiry, we collect your name, business email address, company and message. Depending on the form, you may also provide a telephone number, service interest, team size, operating-spend band, turnover band and preferred timing. Some business-context questions include a “prefer not to say” answer.
We record the submitting site, time, reference number and notice version. If campaign tags are present, the enquiry can include the campaign source, medium, name, content and term, plus the entry-page path. We do not create a cross-site browsing profile, store full referring URLs, or retain your IP address or browser user-agent in the enquiry record. Please do not put personal information into campaign tags.
Our hosting provider also processes technical connection information such as IP addresses and operational logs to deliver and protect the website. A temporary server-side rate limit is used to reduce form abuse.
Please do not include patient records, customer records, passwords, confidential documents or sensitive personal information. If our work requires access to such information, we will agree a suitable process and terms separately before access is given.
Why we use it
- Responding to your enquiry and managing the conversation: our legitimate interests in handling enquiries about our services. Where you personally ask us to take steps towards a contract, those steps may instead rely on that contractual basis.
- Protecting the site and keeping an accurate enquiry record: our legitimate interests in operating a reliable, secure service.
- Understanding which campaigns generate enquiries: our legitimate interests in evaluating our own marketing, using limited tags supplied with an enquiry rather than tracking your browsing.
Sending an enquiry does not subscribe you to a mailing list, confirm a booking, or commit you to a purchase. We do not sell enquiry information or send it to an AI model for training or automated evaluation. There is no automated decision about whether you can use our services.
Where it goes
Enquiries are saved in private Vercel Blob storage configured in London, UK. The website and server functions are provided by Vercel, a US-headquartered provider. Access to stored enquiries is restricted to authorised account access and server-side credentials; no public enquiry-reading API is provided.
These forms currently store enquiries; they do not send an automated acknowledgement email or an email notification. If you email us directly or we reply by email, your email provider and ours will process that correspondence.
London storage does not mean every supporting service is UK-only. Vercel and its subprocessors may process operational or support information internationally. Vercel’s Data Processing Addendum sets out its processing terms and transfer safeguards, including its contractual transfer provisions and UK Addendum where applicable. Contact us if you need more information.
How long we keep it
Website enquiry records are scheduled for deletion after 365 days, with a daily cleanup. If an enquiry becomes paid work, the necessary engagement records may be kept separately for providing that work, accounting and handling legal claims; retention for those records is explained in the engagement terms. You can ask for an earlier deletion where applicable. Operational logs have separate provider retention settings.
Your choices and rights
Depending on the circumstances, you can ask to access, correct or erase information, restrict its use, object to processing based on legitimate interests, or receive portable information where the legal conditions apply. You can object specifically to our use of enquiry campaign tags. You are not obliged to enquire; the required contact fields are needed if you want us to handle your enquiry through the form.
Email jaco@headroomaudit.com to exercise your rights. We normally respond within one month; lawful extensions or identity checks may apply. If we ever rely on consent for a separate purpose, you can withdraw it without affecting earlier lawful use.
You can complain to the Information Commissioner’s Office. You do not have to contact us first, although we welcome the opportunity to resolve a concern.
Cookies and changes
Read the cookie notice for how the site uses browser storage. We will update this notice when the service changes and show the revision date above.