Privacy notice

Resonance Limited is established in Jersey, so the Data Protection (Jersey) Law 2018 applies to what we do. Our visitors are mainly in South Africa and the United Kingdom, so the Protection of Personal Information Act 4 of 2013 (POPIA) and the UK GDPR are also relevant, and this notice is written to satisfy all three rather than to pick one. Where a right or a time limit differs between them, we apply the one most favourable to you.

Our information officer for POPIA purposes, and the person to contact about anything in this notice, is David Joshua, at david@resonance.global.

Nothing on this site collects anything about you until you fill something in. There is no login, no advertising network, no tracking pixel and no cookie banner, because there is nothing to consent to.

The enquiry form. Every “Talk to David” button, the “Book a value-at-stake session” button and the /talk page open the same form. It asks for your name, your role, your organisation, your work email, a short description of the problem you are grappling with, and – optionally – how you heard about Resonance Leadership Advisory. It also records, without asking you, which button you used, which page you sent it from, and any campaign tags in the address you arrived on, so we know how you found us.

The guest form. “Come on the show” asks for your name, your role, your organisation, your work email, your LinkedIn address, the topic you would choose, and one line on your story. “Suggest a guest” asks for your name, your email, who we should talk to with their role, and why in a line.

The episode email. The sign-up asks for your email address and nothing else. It is a double opt-in: you are only added once you confirm from the email we send you, and every send carries a one-click unsubscribe.

Audience measurement. We use Vercel Web Analytics, which counts page views without cookies and without building a profile of you. It does not follow you between websites and we cannot use it to identify you.

The podcast player and the video. Episode audio is served by Riverside, our podcast host, which receives your IP address when you press play, as any server does when it sends you a file. The YouTube video on an episode page loads nothing at all until you click it: no script, no cookie, no request to Google. Our content security policy enforces that, rather than our simply intending it.

• To answer you. If you send an enquiry or apply to be a guest, we use what you wrote to reply and to have the conversation. Our basis is the legitimate interest of responding to somebody who asked us to, and under POPIA your submission is the consent.
• To send the episode email. Our basis is your consent, given by confirming the address, and you can withdraw it from any email or by writing to us.
• To understand which pages are read. Our basis is our legitimate interest in knowing what is useful, weighed against a measurement that is cookie-free and cannot identify you.
• To keep our own records. Where we have to keep something to show what was agreed or to meet a legal duty, our basis is that duty.

We use a small number of service providers, all outside South Africa. Each one is listed below with what it does and where it operates. We do not sell personal information, we do not share it for anyone else's marketing, and nobody in this list is permitted to use it for their own purposes.

Because every processor sits outside South Africa, a POPIA section 72 transfer applies to every one of them. Each is covered by a written agreement with us that binds them to the same standard, and each operates under a legal regime providing comparable protection or under standard contractual clauses.

• An enquiry or a guest application: for as long as we are in conversation, and for two years afterwards, so we can pick up a thread you started.
• A newsletter subscription: until you unsubscribe. After that we keep only your email address, on a suppression list, so we do not add you again by accident.
• Client engagement records: as set out in the engagement letter, which governs them.
• Audience measurement: aggregated by our analytics provider, with no record we can trace to a person.
• Anything we must keep for a legal or accounting reason: for as long as that reason lasts, and no longer.

Under all three of the laws above you can ask us for a copy of what we hold about you, to correct it if it is wrong, to delete it, to stop using it for a particular purpose, or to hand it to you in a portable form. You can also object to our using it on the basis of legitimate interest. Write to david@resonance.global and we will answer within four weeks. If your request is complex, or you send us several, we may take up to eight further weeks; if we do, we will tell you so, and why, before the first four weeks are up.

We do not make any automated decision about you, and we do not profile you.

Please tell us first – it is usually the fastest fix. You also have the right to complain to a regulator: the Jersey Office of the Information Commissioner, the Information Commissioner's Office in the United Kingdom, or the Information Regulator (South Africa), depending on where you are.

The site is served only over HTTPS, with a strict content security policy, and it stores nothing itself: what you send goes straight to the services listed above. We hold no database of visitors. Access to the mailbox and the newsletter account is limited to the people who need it and is protected by two-factor authentication.

If we change what we collect or who handles it, we will change this page and the date on it. Where the change is significant, we will say so on the page rather than expecting you to notice.