Privacy notice

Last updated October 2026

1. Who we are

Marginstead is a trading name of Marie Gurtina, who is the controller of the personal data described in this notice. Contact: marie@marginstead.co.

This notice covers marginstead.co, our email outreach, booking calls with us, and work we do for clients.

2. What we collect

Business contacts and prospects

Name, job title, work email address, company name and website, and publicly available information about the company, such as its services, team size and recent work.

When you book a call or contact us

The details you give us: name, email, company, website and any notes you add.

Clients

Contact and billing details, plus the business and financial records you give us access to (see section 4).

Website visitors

Our hosting provider (Cloudflare) processes technical data such as IP address, browser and device type to deliver and protect the site. We do not use advertising or tracking cookies. Our booking page is provided by Calendly, which may set its own cookies.

3. How we use it and our lawful basis

• Contacting businesses about our services: our legitimate interest in offering relevant business-to-business services. You can object at any time and we will stop.
• Arranging and holding calls, and replying to enquiries: taking steps at your request before entering a contract.
• Delivering services to clients: performance of our contract with you.
• Invoicing and record-keeping: compliance with legal obligations.
• Running and securing the website: our legitimate interest in a working, secure site.

4. Client financial data

• Access: read-only access to accounting and project systems. We never request payment, banking or editing permissions. You can revoke access at any time.
• Storage: exports and working files are stored only in Marginstead's Google Workspace.
• Use: solely to prepare your reports and dashboards. Never used for any other client or purpose.
• Confidentiality: treated as confidential. We will sign a mutual confidentiality agreement on request.
• End of engagement: access is removed and your data deleted within 30 days, except invoices and contract records we must keep by law.

5. Use of AI tools

• Prospect research and outreach: we use AI tools to summarise publicly available company information and to help draft outreach emails. Every email is reviewed by a person before it is sent.
• Client data: AI tools are used on client financial data only with the client's written consent, and only within approved tools. Every reported number is checked by a person against the source system.

6. Who we share it with

We do not sell personal data. We share it only with service providers who process it on our behalf under confidentiality and data-protection terms:

• Google Workspace (email, file storage)
• Calendly (call booking)
• Instantly (outreach email sending)
• Cloudflare (website hosting and security)
• AI providers used for the purposes in section 5

We may also disclose information where required by law, or to a successor if the business is sold or transferred, in which case we will tell you.

7. International transfers

Our service providers may process data outside the UK and your country, including in the United States. Where this happens, we rely on the providers' standard data-protection safeguards, such as standard contractual clauses or equivalent mechanisms.

8. How long we keep it

• Prospects with no conversation: deleted after 12 months.
• Opt-outs: kept on a suppression list indefinitely, so we never contact you again.
• Client financial data: deleted within 30 days of the engagement ending.
• Contracts and invoices: kept for as long as tax and company law require.

9. Security

We use access controls, read-only permissions and a single managed workspace to protect data. No system is completely secure, but we work to keep risk low and will tell affected clients promptly if a breach affects their data.

10. Your rights

Depending on where you are, you can ask us to:

• give you a copy of your data, or transfer it to another provider
• correct or delete it
• restrict or object to how we use it, including stopping all marketing contact
• withdraw consent you have given

Email marie@marginstead.co. We may need to verify your identity and will respond within one month. If you are in the UK and unhappy with our response, you can complain to the Information Commissioner's Office (ico.org.uk) or your local data-protection authority.

11. Other websites and children

Links to other sites, such as our booking page, are governed by their own privacy notices. Our services are for businesses and are not directed at children.

12. Changes and contact

We may update this notice. The date at the top shows the latest version. Questions or requests: marie@marginstead.co.