How your information is handled

Andre Valdes is responsible for this research and for the personal data described here. He runs it in his own name, not through a company.

Andre Valdes
c/o IP-Management #5846
Ludwig-Erhard-Str. 18
20459 Hamburg
Germany

That is a correspondence address held in his name for business post, not an office you can visit.

No data protection officer has been appointed. Questions come to Andre directly.

For anything about this notice, your data, or a request to see or remove what you sent, write to hi@andrevaldes.com.

If you want your data removed, the subject line “Request to remove data” makes it easy to spot. It is only a suggestion. A request written any other way counts exactly the same, and so does asking during a conversation.

When you contribute, you give:

• Your name
• An email address you read, work or otherwise
• Your company and your role or title
• The company’s home market and the market you helped enter or grow
• How you were involved in that expansion
• Your LinkedIn profile URL, if you choose to give it
• Your industry, if you choose to give it
• Anything you write in the optional question on the form, and in the five research questions that follow it
• How you prefer to contribute
• How you came across the research, if you pick one of the four options offered
• Whether you would like to receive the findings
• Whether you are open to being asked about attributing a specific insight publicly

Each response also gets a reference and the time it arrived. The reference links a contribution to any written answers you add afterwards.

If you take a conversation, notes from it are kept as part of the research record.

The site does not read the address of the page you came from, the full address of the page you were on, or any campaign parameters in the link you followed. Comparing outreach methods is done with the optional question on the form instead, because a link can carry a token, an email address, or a private path that has nothing to do with the research.

One honest limit to that: the hosting provider logs the requests it serves, which includes the address requested. If you followed a link with tracking parameters on the end, those parameters are in that provider’s logs even though this site ignores them and never attaches them to your response. Links sent out for this research are kept plain for that reason.

No cookies are set. There are no advertising or analytics scripts, no third-party embeds, no tracking pixels, and no record of what you click. If you follow the booking link, that click is not recorded here, and a click is not treated as a booking.

Nothing, unless you ask for it. Opening this site does not read from or write to your browser’s storage.

The form offers a checkbox to keep your unfinished answers in this browser, so a refresh or a dropped connection does not cost you your work. It is off until you switch it on. What is saved stays on your device and is not sent anywhere until you submit.

A saved copy is discarded 14 days after it was last saved. To be precise about how that works: this site cannot delete anything while it is closed, so an expired copy is removed the next time the page looks at it. Unchecking the box, using the delete control on the form, or sending your response removes the saved copy at once. Those controls only touch this project’s own saved answers, never anything else stored by your browser. Your browser’s own site-data settings can clear it at any time, including while this site is closed.

Written answers you save are tied to the confirmation screen you were on. If you reload the page and lose that screen, the saved copy cannot be brought back into the form, though you can still delete it with the same controls or through your browser.

Each purpose stands on its own footing. The bases below are the ones Andre intends to rely on; they are being confirmed before recruitment opens, and this notice will be updated if any of them changes.

Carrying out the research and following up with you

Reading what you sent, coming back to you with questions, arranging a conversation, and working the contributions into a set of findings. Intended basis: legitimate interests, Article 6(1)(f). The data is ordinary professional information about your working life, it is used only for the research described here, and you can object at any time by writing to the address above. Some participants come to this page themselves and some are invited directly, and either way an objection is acted on: see Your rights and How long it is kept for what removal does and does not reach.

Sending you the findings

Only if you ticked the box asking for them. Intended basis: consent, Article 6(1)(a), which you can withdraw at any time without affecting anything sent before.

Asking whether an insight may be attributed to you

Only if you ticked that box. Intended basis: consent, Article 6(1)(a). Publishing anything attributed to you needs a separate, specific yes at the time, which is a further act of consent and never assumed from this box.

Comparing how people came across the research

Using the optional answer on the form to see which ways of reaching people work. Intended basis: legitimate interests, Article 6(1)(f), with the field left optional so it costs you nothing to skip.

Keeping the form working and not abused

Limiting how often the form can be submitted from one connection, and the hosting provider’s own operational logs. Intended basis: legitimate interests, Article 6(1)(f).

Saving your unfinished answers in your browser

Only when you switch it on. That switch is your consent to storing something on your device, and turning it off withdraws it and deletes the copy.

No special-category data is asked for, so please leave out anything sensitive about yourself or anyone else. Nothing here is treated as exempt from the usual rules because it is research: no such exemption is being claimed.

This is independent research, not a sales process. What Andre learns from it may shape consulting services he develops later, and it is fair that you know that before you take part.

Taking part does not put you on a mailing list, does not make you a sales prospect, and does not mean you will be pitched. The two checkboxes on the form are the only contact you agree to beyond the research follow-up itself. If a genuinely different use of your data came up later, it would need its own basis and its own notice before anything happened.

Andre reads the contributions himself. Nothing is sold, and nothing is shared for marketing.

This site is hosted by Vercel, which necessarily handles the connection: your IP address and request details reach it, and it keeps its own operational logs. The plan, the agreement covering it, the region the site runs in, and which logging is switched on are still being confirmed.

There is no research database. Your contribution is emailed straight to Andre over an encrypted connection and lives in his mailbox. Two providers are involved in that, and both hold a copy or a record of it:

• STRATO sends the message, from a mailbox at research.andrevaldes.com. Sending providers keep delivery logs of their own.
• Google hosts the mailbox that receives it.
• The email client Andre uses to read and manage that mailbox connects to it as a service, so it can process the contents of what you sent too. Google is not the only company able to see a contribution.

So an email is rarely a single copy. The plans, the agreements covering them, the regions they run in and the access settings on each are still being confirmed.

No booking service is connected at the moment. If you say you are open to a conversation, Andre emails you to arrange a time.

Vercel and Google are United States companies, and the connected email client is provided from the United States as well, so your data may be processed outside the European Economic Area. Which transfers actually happen and the safeguards relied on for them are still being confirmed. Mail being sent from a European provider does not by itself mean it stays in Europe.

Conversations are not recorded, and a recording would only ever happen if you agreed to it at the time.

On AI, the honest answer is narrower than a flat no. Nothing you send is put through an AI service to analyse it, and no automated system decides anything about your contribution. But the mailbox and note-taking tools Andre works in have AI features of their own, so material you send may pass through them in the ordinary course of him reading and organising it. Which of those features are switched on, and what each does with the content, are still being confirmed. Nothing you send is used to train anyone’s model as far as Andre has arranged it, and that too is part of what is being checked.

There is no automated decision-making and no profiling. A person reads everything.

Identifiable research material, meaning your notes, your written contributions and the contact details attached to them, is kept for up to twelve months after your most recent substantive contribution: as long as it is genuinely needed to analyse the research, check findings against what you said, do any follow-up you agreed to, and prepare the report.

Anything no longer needed for those purposes is deleted, or properly anonymised, before that point. At twelve months it is deleted or anonymised. Keeping something longer takes a specific documented reason, a lawful basis for it, and a date to look at it again.

Ordinary back-and-forth, an acknowledgement or a scheduling email, does not restart the clock, and a later contribution does not extend the life of older unrelated material.

If a conversation is ever recorded with your agreement, the recording is deleted once checked notes or a transcript make it unnecessary, and in any case within 90 days of the conversation.

Properly anonymised findings may be kept indefinitely and used in the published report and in later work. Removing a name is not by itself anonymisation: material counts as anonymous only when the combination of details could not identify you or your company.

Your details are used only for what is described here and for the choices you recorded. Different places hold different copies, and each has its own handling:

• Mailbox copies. Messages, replies and anything in trash or an archive are deleted as part of the same request.
• Provider logs and backups. Vercel, STRATO, Google and the connected email client keep their own logs and backups on their own cycles. Those are asked for or left to expire, and cannot honestly be described as instantly deletable.
• Bookings. A booking made through an external calendar lives in that service and in the calendar entry, and is removed there.
• Outreach records. The list of who was invited and who replied is kept separately from contributions, holds the minimum needed, and follows the same twelve-month rule.
• Preferences and withdrawals. A record that you asked not to be contacted, or withdrew consent, is kept for as long as needed to honour it. That record is the point: deleting it would risk contacting you again.
• Attribution permissions. Where you gave permission for a specific attributed insight, that permission is kept alongside the published material as the evidence for it.
• Your browser. Drafts on your device follow the 14-day rule described above. That rule has nothing to do with how long a submitted response is kept, and clearing your browser does not delete anything already sent.

This site’s code cannot reach into a mailbox, a calendar or a hosting provider and delete things there. Those are done by hand, which is why a request goes to the address above rather than to a button.

Nothing you share will be publicly attributed to you or your company without your explicit permission. Ticking the attribution box on the form only means Andre may ask. It is not permission to publish, and permission given for one quotation does not carry over to anything else.

You can ask for a copy of your data, ask for it to be corrected or deleted, ask for its use to be restricted, object to it being used, and ask for it in a portable form. Where something rests on your consent, you can withdraw that consent at any time, and doing so does not make what happened before unlawful.

Which of these apply depends on the purpose and the basis it rests on, so they are not all unconditional. If a request cannot be met in full, you will be told plainly what was done, what was kept, and why.

Write to hi@andrevaldes.com. You will get a response within one month. If a request is complicated enough to need longer, you will hear that inside the same month, with the reason.

Identity is checked in proportion to what is being asked for, usually by replying from the address the contribution came from. Identity documents are not asked for as a matter of course.

You can also complain to a supervisory authority. Given the correspondence address above, that is expected to be the Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, which is still being confirmed. You can equally complain to the authority where you live or work.

This notice is updated as the project settles the points marked as still being confirmed, and whenever the way data is handled changes. The date at the top always shows when the wording last changed.