02 / OUR SIX PRINCIPLES
Six commitments.
Every engagement, every day.
Our data-protection program is built on six concrete, auditable commitments aligned with Article 5 of the GDPR. We do not treat privacy as a legal checkbox — it is a structural design decision for every form, workflow, and service we ship.
01 / LAWFUL BASIS
Lawful, fair, and transparent
We only process personal data when we have a lawful basis to do so — typically your explicit consent, the performance of a contract with you, or a legitimate business interest that does not override your rights. Every processing activity is documented, logged, and reviewed on a regular schedule.
02 / DATA INTEGRITY
Minimality and purpose limitation
We collect only what is necessary. Name, email, company, and your message — nothing more. Data collected for consultation purposes is never repurposed for unrelated marketing, sold to third parties, or combined with shadow profiles from external data brokers.
03 / STORAGE
Secure storage and retention
Submissions and correspondence are retained only as long as required to respond to your inquiry, satisfy legal record-keeping obligations, or defend against potential claims. All at-rest data is encrypted; in-transit data uses TLS 1.3; access logs are retained and reviewed monthly.
04 / SHARING
Limited sharing, strict contracts
Consultation submissions flow through Formspree (our form processor) under a signed data-processing agreement. No other third parties receive your personal information unless you explicitly request it, or we are legally compelled by a valid court order or warrant.
05 / TRANSFERS
International transfers
Marathon Consulting operates globally. Your data may be processed in countries outside your jurisdiction — including the United States, the European Economic Area, and Singapore. Where required by applicable law, transfers rely on Standard Contractual Clauses approved by the European Commission.
06 / YOUR RIGHTS
Access, correction, erasure, portability
Under GDPR, UK GDPR, CCPA, PIPEDA, and equivalent legislation you have the right to access the personal data we hold about you, request its correction or erasure, restrict processing, obtain a machine-readable copy, and withdraw consent at any time. All requests are responded to within 30 calendar days.