Privacy Policy — SAAG Consult OÜ

Who is responsible

This website presents Sander Gansen’s professional work and the services of SAAG Consult OÜ. SAAG Consult OÜ is responsible for personal information received for its own enquiries, business relationships and any newsletter it operates. The company details are shown below. This notice describes the site as configured on 6 November 2026; connected providers and purposes must be reviewed when the configuration changes.

Information we receive

You can read the public pages without an account. This site has no wallet login, shopping cart or direct payment system. When you email, telephone or book a meeting, we receive the contact details and business context you choose to share. Relevant information can include your name, email address, company, role, scheduling details, message and correspondence. Please do not send passwords, sensitive personal information or confidential customer documents through public contact paths. We may request representative business material through a separately agreed appropriate channel.

Why we use information

We use enquiry information to respond, assess fit, arrange meetings and take steps requested before a potential agreement. Business-contact information can be processed on the basis of legitimate interests in communicating with professional contacts, with attention to their rights and reasonable expectations. Information required to deliver an agreement is processed for that agreement or the appropriate business purpose. Accounting, tax and other legally required records are retained to meet the applicable obligations. These purposes do not automatically enrol an enquirer in a marketing list.

Workshop interest by direct email

The late-November 2026 workshop with Sander Gansen and Matis Metsala, “Who does the machine buy from?” / “Can the buyer—or their agent—find your offer?”, is announced with its exact date, venue and price still to be confirmed. If you email me to express interest, we use the name, contact details and message you provide to respond about that event. The link opens your own email app; it is not an automated signup, newsletter subscription, ticket purchase or confirmed registration.

Email subscriptions: preliminary only

Sender.net is the owner-selected email provider, but the automatic signup is not connected yet. The preliminary site controls do not transmit or store an email address. A mailto request opens your own email app and is not an automatic subscription. When a hosted signup is configured, the form must identify the content promise and consent, explain confirmation, and provide a withdrawal route. Subscription is voluntary and separate from service enquiries or workshop registration. Marketing messages will include an unsubscribe option. No fixed sending cadence is promised here.

Calendly, Fienta and external platforms

Booking links open Calendly rather than embedding its widget. Calendly processes information supplied on its service under its own notice and arrangements, and booking information can be shared with the host of the meeting. When a public workshop has confirmed ticketing, it will link to the correct Fienta event; ticket purchase, attendee information and the organiser’s cancellation terms are shown there. An interest-only announcement is not a ticketed event. See the Workshops page for current registration availability. Social links lead to LinkedIn, Facebook, Instagram, Medium and X. These platforms operate under their own notices; their widgets and feeds are not loaded here.

Client material and agreed access

For service work, including OfferSignal, use only the minimum relevant client material needed for the agreed task and an agreed secure working channel. Personal-data roles, access permissions and approved providers are set in the engagement arrangements before material is shared or connected, including through an MCP server. A single source of truth is not a blanket permission to publish private material, upload customer records to an external service or expose every source to an agent. Public information and restricted working material must have separately agreed access.

Necessary storage and optional preferences

When you save a cookie choice, the site stores a versioned consent record in your browser’s localStorage under sg-consent-v1. It records analytics, marketing and preference choices and a timestamp for up to 180 days. This record is used to respect your choice, not to create a marketing profile. If optional preferences are allowed, sg-scroll-positions in sessionStorage remembers reading positions in the current tab. Without that preference, in-memory navigation can still preserve positions during the current application session. Browser search, article filtering and reading progress operate locally; they do not subscribe you or prove that an article was read.

Analytics and marketing consent

Google Tag Manager container GTM-WKBKX9K3 is configured. Its loader runs only after both analytics and marketing permission under this site’s current gate; rejecting either category keeps the container blocked. GA4 and any other analytics or marketing tags are configured inside that container by the owner, not installed as a second direct Google tag on this site. The owner must audit the tags within GTM; the container itself does not certify every tag’s purpose. Hosted platform analytics has been requested off so it does not bypass these choices.

Changing or withdrawing your choice

Use Cookie settings in the footer to reject optional categories, customise them or accept them. Optional categories start off. Rejecting does not block the public content or contact links. Revocation updates Google consent signals, attempts to remove accessible first-party Google cookies and reloads the page so optional scripts are not loaded again without permission. Previously transmitted information cannot be recalled by a browser reload; requests concerning provider-held data are handled through the relevant controller and legal rights.

Hosting, recipients and transfers

Hosting infrastructure can process technical request information such as IP address, request time, browser details and security logs to deliver and protect the site. Operational providers may process contact, booking, email or event information as required for their purpose. We do not sell contact lists. Appropriate provider arrangements and access controls are required when processors are connected. Some providers may process information outside the EEA; the applicable transfer mechanism and service terms must be assessed for the actual provider and account before activation. This notice does not invent a hosting log-retention period or guarantee that every provider uses a particular safeguard.

Retention and security

Keep enquiry and business correspondence only as long as needed for its purpose, follow-up and legitimate record requirements. Retain legally required accounting or contractual records for the applicable statutory period. Newsletter information is kept until withdrawal or removal, subject to minimal suppression information needed to respect opt-outs. The 180-day consent-record period is a browser setting, not the retention period for all business records. Access should be limited to people and providers who need it. Reasonable organisational and technical measures are used; no absolute security, named encryption standard or audit certification is claimed.

Your rights and complaints

Depending on the processing and legal basis, you may request access, correction, erasure, restriction, portability or object to processing. You may withdraw consent without affecting the lawfulness of earlier processing. Some records must be retained under legal obligations, and identity may need to be verified before a request is fulfilled. Contact us using the email link below. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or another competent supervisory authority. A request or complaint does not require newsletter consent.

Updates and contact

We will update this notice when actual processing changes—for example when Sender, analytics or a public event is activated. Review the current notice and the external provider’s notice before submitting information. For data-protection questions or requests, use Email me below to contact Sander and identify the relevant service or communication.

Privacy, by actual purpose.