Privacy policy

GMP Consultant provides independent GMP advisory services to life-science manufacturers in the Netherlands. For the purposes of the General Data Protection Regulation (GDPR) we are the data controller for the personal data described in this policy. You can reach us at info@truex-consultancy.com.

GMP Consultant is the trading name of the practice operating this website. Our registered company details and Chamber of Commerce (KvK) number are available on request, and will be published on this page.

Information you give us

Enquiry details.

Name, work email, company, role, sector, the nature of your enquiry and anything else you write to us.

Booking details.

The name, email and any notes you provide when booking a call. Bookings are handled by Calendly, a third-party scheduling provider, and are subject to the Calendly privacy terms in addition to this policy.

Subscription details.

The email address you give for the monthly regulatory note.

Engagement information.

During an engagement we may process business information about your site. This is governed by the confidentiality agreement signed before the engagement, not by this website policy.

Information collected automatically

Server logs.

Our hosting provider records standard technical information such as IP address, browser type and pages requested, for security and availability purposes.

Fonts.

Pages load typefaces from Google Fonts, which means your browser makes a request to Google servers and your IP address is visible to them. If you would rather this did not happen, the fonts can be self-hosted; tell us and we will do it.

What the tools on this site do not collect

The GMP Readiness Score and the Cost of Inaction Model run entirely in your browser. Your answers and figures are not transmitted to us, not stored, and not visible to anyone else. Nothing you enter into either tool reaches us unless you separately choose to send it.

To answer your enquiry or hold a booked call.

Legal basis: steps taken at your request prior to entering a contract, and our legitimate interest in responding to business enquiries.

To provide services under an engagement.

Legal basis: performance of a contract.

To send the monthly regulatory note.

Legal basis: your consent, withdrawable at any time via the unsubscribe link in every message.

To keep the site secure and available.

Legal basis: our legitimate interest in operating the site safely.

To meet legal and tax obligations.

Legal basis: compliance with a legal obligation.

We do not use your data for automated decision-making or profiling, and we do not sell it.

We share personal data only with providers who process it on our behalf, under a data processing agreement: our hosting provider, our email provider, the scheduling provider used for bookings, and any mailing tool used for the regulatory note. We also disclose data where we are legally required to do so. Where a provider processes data outside the European Economic Area, we rely on an appropriate transfer mechanism such as the European Commission standard contractual clauses.

Enquiries that do not lead to work:

up to 24 months, then deleted.

Client records:

for the duration of the engagement and afterwards for the period required by Dutch statutory retention obligations.

Subscription data:

until you unsubscribe.

Server logs:

a short rolling period set by the hosting provider.

Under the GDPR you have the right to access the personal data we hold about you, to have it corrected or erased, to restrict or object to its processing, to receive it in a portable format, and to withdraw consent at any time where consent is the basis we rely on. Write to info@truex-consultancy.com and we will respond within one month.

If you believe we have handled your data improperly you can complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens, though we would rather you raised it with us first so we can put it right.

We apply appropriate technical and organisational measures to protect personal data, including encrypted transport, access control and confidentiality agreements covering everyone working on an engagement. No system is perfectly secure, and we will notify you and the supervisory authority as required if a breach occurs that is likely to affect your rights.

When this policy changes we update the date at the top of the page. Material changes affecting how we use data you have already given us will be notified directly where we hold a contact address for you.