Privacy Statement

1. Introduction

Global Treasury Diagnostic ("GTD", "we", "our", or "us") is committed to protecting your privacy and ensuring the security of any personal data you share with us. This Privacy Statement explains how we collect, use, store, and protect your information in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

GTD provides treasury diagnostic and advisory services to corporate clients. We have designed our systems and processes with privacy as a core principle—minimising data collection, separating systems, and offering anonymous assessment options.

2. Data Controller

The data controller responsible for your personal data is:

For any privacy-related enquiries or to exercise your data protection rights, please contact us at the email address above.

3. Our Privacy Architecture

Our privacy architecture distinguishes initial website enquiries from diagnostic assessment responses. Contact details submitted through the enquiry form are stored in our protected EU-hosted website database and sent to Matthias as an email alert. Subsequent scoping and client correspondence continue through our separate IONOS email service in Frankfurt. Enquiry records are separate from diagnostic responses; they are not held exclusively in email.

Why this matters: Enquiry handling and diagnostic assessment serve different purposes and use separate records and workflows. This does not mean that they use physically separate website infrastructure or that GTD cannot identify a client through correspondence. Assessment data is isolated at the database level so that each client's data is inaccessible to other clients.

4. What Data We Collect

4.1 Website

When you submit an enquiry, we collect your name and email address, and any company, role, annual revenue range and message you choose to provide. We also record the originating page and submission time. The enquiry is saved in our protected EU-hosted website database, and its details are sent to Matthias as an email alert through our managed transactional email service. Technical request information, including IP addresses, may be processed for rate limiting, security and abuse prevention. We use this information to respond and arrange next steps, not for marketing. Please do not include confidential treasury figures or assessment data in the enquiry form. You can instead email matt@gtd-treasury.com directly from your own email client.

4.2 Email Communications

When you email us, we receive and store:

• • Your email address
• • Your name (if provided)
• • Your organisation (if provided)
• • The content of your correspondence

This information is necessary to respond to your enquiry and, if you become a client, to deliver our services.

4.3 Assessment Platform

If you engage our diagnostic services, we collect:

• • Login credentials (username and password)
• • Your responses to assessment questions
• • Company profile information (industry sector, revenue range, geographic scope)
• • Treasury operational data as disclosed in your assessment responses, which may include:
  • – Cash management practices and bank account structures
  • – Payment processing volumes and methods
  • – Working capital metrics (DSO, DPO, cash conversion cycle)
  • – FX exposure and hedging practices
  • – Banking relationship information
  • – Technology systems in use
• • Any documents or data you upload for analysis

For clients using Stealth Mode, the diagnostic uses a pseudonymous client reference rather than their name or company identity (see Section 7).

4.4 Invoicing and Payments

To process payments, we collect:

• • Company name and registered address
• • VAT number (where applicable)
• • Billing contact name and email
• • Payment details as necessary for transaction processing

5. Legal Basis for Processing

We process your personal data under the following legal bases as defined by GDPR Article 6:

• Contract performance: Processing necessary to deliver services you have engaged us to provide
• Legitimate interests: Processing necessary for our legitimate business interests, such as responding to enquiries and improving our services, where these interests do not override your fundamental rights
• Legal obligation: Processing required to comply with applicable laws, such as tax and accounting requirements

We do not process personal data based on consent as our primary legal basis, as we do not engage in marketing activities or collect data beyond what is necessary for service delivery.

6. How We Use Your Data

We use the personal data we collect for the following purposes:

• • Responding to your enquiries
• • Delivering treasury diagnostic services
• • Generating assessment reports and recommendations
• • Processing invoices and payments
• • Complying with legal and regulatory obligations
• • Improving our services and methodology (using aggregated, anonymised data only)
• • Developing industry benchmarks based on anonymised, aggregated assessment data

We do not sell, rent, or share your personal data with third parties for marketing purposes. We do not engage in automated decision-making or profiling that produces legal or similarly significant effects.

7. Stealth Mode: Pseudonymous Assessment Option

For clients preferring not to include their name or company identity in diagnostic responses and outputs, we offer Stealth Mode:

Stealth Mode is not complete anonymity. We still know who you are through correspondence and invoicing, which are necessary for service delivery and payment processing. Any contact details already submitted through the website remain in the enquiry record; selecting Stealth Mode later does not anonymise or delete that record. It concerns the subsequent diagnostic, not the initial enquiry.

To request Stealth Mode, mention it in your enquiry message or during personal email follow-up. If you prefer not to submit contact details through the website, email matt@gtd-treasury.com directly.

8. AI-Assisted Report Generation

GTD diagnostic reports are generated using AI-assisted technology to ensure consistency, analytical rigour, and rapid delivery. We are transparent about how this works:

What AI does:

• • Processes your structured assessment responses to generate narrative analysis
• • Ensures consistent application of our scoring methodology
• • Produces benchmark comparisons against industry data
• • Drafts recommendations based on identified gaps and opportunities
• • Researches current industry-specific context to enhance report relevance

What AI does not do:

• • Make autonomous decisions about your treasury strategy
• • Access data beyond what you provide in your assessment
• • Retain your data after report generation is complete
• • Share your data with other clients or use it to train AI models

Human oversight:

All AI-generated content is grounded in our proprietary assessment methodology developed by experienced treasury professionals. The treasury expertise behind the analysis is human—AI tools enhance report quality and delivery speed.

Data handling:

Assessment data is processed via secure API calls to our AI service providers (see Section 12). No assessment data is retained by AI providers beyond the duration of the API session. Data is encrypted in transit and processed in accordance with each provider's enterprise data handling policies, which prohibit use of customer data for model training.

EU AI Act classification:

As assessed under the provisions of the EU AI Act applicable as of March 2026, GTD's use of AI constitutes a limited-risk AI system. The diagnostic platform does not perform autonomous decision-making, creditworthiness assessment, or profiling that produces legal effects. AI is used as an analytical tool to process structured client inputs against GTD's proprietary methodology — all outputs are reviewed and contextualised by experienced treasury professionals before delivery. In accordance with transparency obligations, all AI-generated content is clearly identified as AI-assisted in our reports and deliverables.

9. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• • Website enquiries: Retained only as needed to handle the enquiry and any resulting engagement; you may request deletion, subject to applicable legal obligations
• • Email correspondence: Retained for the duration of our business relationship plus 3 years
• • Assessment data: Retained for 12 months after report delivery, unless you request earlier deletion
• • Invoicing records: Retained for 7 years as required by Dutch tax law
• • Anonymised benchmark data: Retained indefinitely in aggregated form that cannot identify individual organisations

Upon expiry of the retention period, or upon your valid deletion request, we securely delete or anonymise your personal data.

10. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These measures include:

• • Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• • Access controls limiting data access to authorised personnel only
• • Secure, EU-based hosting infrastructure
• • Regular security reviews and updates
• • Separation of systems to limit exposure in the event of a breach
• • Secure authentication for assessment platform access

11. International Data Transfers

Your personal data is stored and processed within the European Union. We do not transfer personal data outside the EU/EEA except where necessary to use service providers with appropriate safeguards in place.

Where we use service providers that may process data outside the EU (such as AI service providers), we ensure:

• • Standard Contractual Clauses approved by the European Commission are in place
• • The provider maintains appropriate technical and organisational security measures
• • Data processing is limited to the minimum necessary for service delivery
• • No data is retained beyond the processing session

Our website hosting and primary assessment platform infrastructure are EU-based.

DocRaptor, used for PDF report generation, is a US-based service provider. Data transmitted to DocRaptor for document generation is limited to the minimum necessary for report creation, encrypted in transit, and not retained following document generation. Standard Contractual Clauses are in place governing this transfer. Vercel, used for frontend application hosting, is deployed in EU regions to ensure data remains within the European Economic Area.

12. Third-Party Service Providers

We use a limited number of third-party service providers to operate our business:

Website and Application Hosting

• • Vercel (frontend hosting)
• • Supabase (database and authentication) — EU region

Note: Vercel is deployed in EU regions. Supabase database infrastructure is hosted in the EU region.

Email Services

• • IONOS — Frankfurt, Germany. EU-hosted and GDPR-compliant. Used exclusively for client communications and business correspondence.
• • Lovable managed transactional email service — sends website enquiry alerts to our business mailbox. Alert content includes the submitted contact details and message; this delivery is separate from the subsequent IONOS correspondence.

Payment Processing

• • Stripe — PCI-DSS Level 1 compliant payment processor. Stripe processes payment transaction data under its own privacy policy and data processing agreement. GTD does not store payment card details.

AI Processing Services

• • Anthropic (Claude API) — for report narrative generation
• • Perplexity — for industry research and benchmarking data

Document Generation

• • DocRaptor — for PDF report creation

Each provider is bound by data processing agreements ensuring GDPR compliance. We do not share more data than necessary for each provider to perform their specific function.

We do not use third-party analytics, advertising networks, or social media tracking on our website.

13. Cookies and Tracking

Our website does not use cookies for tracking, analytics, or advertising purposes. We do not use any technology that tracks your behaviour across websites or builds profiles of your interests.

Our assessment platform uses essential cookies only for:

• • Session management (keeping you logged in during your assessment)
• • Security (preventing cross-site request forgery)

These essential cookies do not track your behaviour and are deleted when you close your browser or log out.

If we implement any additional cookies in the future, we will update this Privacy Statement and, where required, obtain your consent.

14. Your Rights Under GDPR

Under the General Data Protection Regulation, you have the following rights regarding your personal data:

• Right of access: You may request a copy of the personal data we hold about you
• Right to rectification: You may request correction of inaccurate or incomplete data
• Right to erasure: You may request deletion of your personal data where there is no compelling reason for continued processing
• Right to restrict processing: You may request we limit how we use your data in certain circumstances
• Right to data portability: You may request your data in a structured, commonly used, machine-readable format
• Right to object: Where GTD processes your personal data based on legitimate interests, you have the right to object at any time. GTD will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, or where processing is necessary for the establishment, exercise, or defence of legal claims.

To exercise any of these rights, please contact us at matt@gtd-treasury.com. We will respond to your request within 30 days. There is no fee for making a request unless your request is clearly unfounded or excessive.

Enterprise clients requiring a formal Data Processing Agreement may request one by contacting us at matt@gtd-treasury.com.

15. Complaints

If you are not satisfied with how we handle your personal data or respond to your requests, you have the right to lodge a complaint with a supervisory authority.

In the Netherlands, this is:

We would appreciate the opportunity to address your concerns before you contact the supervisory authority. Please reach out to us first at matt@gtd-treasury.com.

16. Business Transfers

In the event that GTD ceases operations, is transferred to a successor, or substantially changes its business structure, personal data held about clients may be transferred to the successor entity. In such circumstances:

• • We will notify affected clients before any transfer occurs
• • The successor entity will be bound by this Privacy Statement until a new statement is communicated
• • You will have the opportunity to request deletion of your data before transfer

17. Children's Privacy

Our services are designed for business professionals and corporate clients. We do not knowingly collect personal data from individuals under the age of 18. If you believe we have inadvertently collected such data, please contact us immediately.

18. Changes to This Privacy Statement

We may update this Privacy Statement from time to time to reflect changes in our practices or applicable law. Any changes will be posted on our website with an updated "Last updated" date. We encourage you to review this statement periodically.

For material changes that significantly affect how we process your personal data, we will notify existing clients directly via email before the changes take effect.

19. Contact Us

If you have any questions about this Privacy Statement, our privacy practices, or wish to exercise your data protection rights, please contact us:

We aim to respond to all privacy-related enquiries within 5 business days.