Legal · version 3.0 · last updated 19 August 2026
The data controller is Lanex Group, LLC, a limited liability company incorporated in the State of Delaware, United States, trading as First Person Marketing. This policy explains exactly what we collect through this website, the audit, the subscription signup and the checkout, the lawful basis for each category, how long we keep it, who processes it on our behalf, where it goes, and how you exercise every right you hold. We do not sell personal information and we do not share it for cross-context behavioural advertising.
Each row states the category, the purpose, the lawful basis under GDPR Article 6, and the retention period. Nothing outside these categories is collected through this website.
We do not sell personal information, share it for cross-context behavioural advertising, disclose it to data brokers, or use your audit answers to build advertising audiences. If you decline a report at the end of the audit, we stop: no follow-up sequence, no call, no list. We do not use special category data, and we do not knowingly collect data from anyone we understand to be a child.
The audit uses conditional logic to decide which questions to show and to draft an indicative recommendation, but every recommendation, decline and price is reviewed and issued by a person. No decision with legal or similarly significant effect is made solely by automated means, and no profiling is used for advertising.
We use a small, documented set of processors, each bound by a data processing agreement with confidentiality, security and deletion obligations.
Our infrastructure is located in the United States, so data you submit is processed there. Where personal data originates in the European Economic Area, the United Kingdom or Switzerland, transfers are made under the European Commission's Standard Contractual Clauses with the UK International Data Transfer Addendum where applicable, supported by a transfer risk assessment. A copy of the relevant mechanism is available on request.
Data is encrypted in transit with TLS and at rest by the storage provider. Access to submission and order records is limited to personnel who need it for a defined purpose, protected by unique credentials and multi-factor authentication, and logged. Row-level access controls prevent one record being read from another. We never ask for, and never store, your platform passwords or card details, and we require delegated access rather than shared credentials. Suspected personal data breaches are assessed immediately and notified to affected individuals and regulators where the law requires, normally within 72 hours of becoming aware.
Wherever you live, we honour the following rights.
Email privacy@firstpersonmarketing.com quoting your 10 digit reference if you have one. We verify identity proportionately, act, and confirm completion in writing, normally within 5 Working Days and always within 30 calendar days (extendable once by a further 30 days for complex requests, with notice). There is no charge for a reasonable request.
We do not run an unsolicited marketing list. You receive email from us only where it relates to a report or scope you asked for, or an order you placed. Every non-transactional email carries a one-click unsubscribe, honoured immediately, and unsubscribing never affects service delivery.
Raise it with privacy@firstpersonmarketing.com first and a director will respond. You also have the right to complain to your local supervisory authority, including any EEA data protection authority, the UK Information Commissioner's Office, or your state attorney general in the United States. We will cooperate fully with any such enquiry.
The version and date at the top of this page change with every revision. Where a change materially affects how your data is used, we notify affected individuals by email at least 30 days before it takes effect and, where the law requires it, ask for fresh consent.
Email privacy@firstpersonmarketing.com with your 10 digit reference. We delete it and confirm in writing, normally the same week. No questions, no retention argument, no exit survey.
Controller: Lanex Group, LLC, State of Delaware, United States, trading as First Person Marketing. See also the cookie policy for on-device storage and the service terms for our role as processor of client data.