Privacy policy

Last updated: 6 November 2026

Guy Gotta Change LTD ("Guy Gotta Change", "we", "us", or "our") operates this store and website at [www.guygottachange.com](https://www.guygottachange.com), and our digital apps, including all related information, content, features, tools, products and services, in order to provide you, the customer, with a curated shopping and planning experience (together, the "Services"). Our store is powered by Shopify, which enables us to provide the Services to you.

This Privacy Policy describes how we collect, use and disclose your personal information when you visit, use, or make a purchase or other transaction using the Services, when you use one of our digital apps (for example The Money System, The Deep Work System and the Academic Planner), or when you otherwise communicate with us. Where a section applies only to the apps, we say so.

If there is a conflict between our Terms of Service and this Privacy Policy, this Privacy Policy controls with respect to the collection, processing and disclosure of your personal information.

Please read this Privacy Policy carefully. By using and accessing any of the Services, you acknowledge that you have read this Privacy Policy and understand the collection, use and disclosure of your information as described in it.

## 1. Personal information we collect or process

When we use the term "personal information", we mean information that identifies or can reasonably be linked to you or another person. It does not include information that is collected anonymously or has been de-identified so that it cannot identify or be reasonably linked to you. Depending on how you interact with the Services, where you live, and as permitted or required by applicable law, we may collect or process the following categories of personal information, including inferences drawn from it:

* Contact details, including your name, address, billing address, shipping address, phone number and email address.
* Payment information, including credit card, debit card and financial account numbers, payment card information, transaction details, form of payment, payment confirmation and other payment details. Card payments are handled by our payment providers, and we do not store your full card number.
* Account information, including your username, password, preferences and settings. Passwords are stored only in a secure, hashed form, so we never see your actual password.
* Transaction information, including the items you view, put in your cart, add to your wishlist, or purchase, return, exchange or cancel, and your past transactions.
* Content that you choose to enter into one of our apps. See Sections 2 to 7.
* Communications with us, including the information you include when you contact us, for example a customer support enquiry.
* Device information, including information about your device, browser or network connection, your IP address and other unique identifiers.
* Usage information, including how and when you interact with or navigate the Services.

Some of our apps ask you to record habits to do with training, sleep and food, and let you keep notes, a journal and a weekly review. We do not ask you for medical information, and our apps do not connect to any health app, wearable or fitness tracker. Section 6 explains this in full. Anything you record stays in your own private account and is protected in the same way as the rest of your content.

## 2. Our apps: your data

Our apps are used in your browser or added to your device's home screen. This section explains, in plain terms, what happens to the information you put into them.

**What you store.** An app holds the information you add to organise your money, your work or your life, for example your budget, your income and outgoings, your goals, your habits, your focus sessions, your notes, your journal entries and your weekly reviews. You decide what to add, and you are never required to enter anything sensitive.

**Where your data lives.** When you are signed in, your content is saved to your private account so it stays in sync across your devices and is not lost if you change device. This is provided by Supabase, a well established cloud database and sign in platform. A copy is also kept on your own device so the app is fast and works offline.

**If you are not signed in.** Some of our apps can be used without an account. In that case your content is held only in your own browser's storage on that device. We never receive it, we cannot see it, and we cannot recover it for you. Clearing your browser data, or switching browser or device, will remove it, which is why the apps let you export your own backup file.

**Who can see it.** Your content is private to your account. We use per account access controls (row level security), so each account can only read and write its own data, and one user cannot access another user's. Our team does not read your content in the normal course of business. We may only access account data where it is strictly necessary, for example to investigate a technical fault you have reported or a genuine security or legal issue, and only to the minimum extent needed.

**How it is protected.** Data is encrypted in transit using TLS, the same kind of secure connection used for online banking and shopping, and is encrypted at rest by our infrastructure providers. Sign in is handled by Supabase Authentication, and your password is stored only as a secure cryptographic hash. The app uses a public, restricted access key, and all privileged keys are kept secret and server side.

**Separate products, separate doors.** Each app has its own tables and its own sign in. An order for one product opens that product and nothing else, and the data you keep in one app is not visible to another.

**Your control.** You can edit or delete individual items at any time inside the app, and download your own copy of your data from its settings. You can also ask us to delete your account and the data associated with it (see Section 16).

**No selling, no ads inside the apps.** We do not sell your content, there are no adverts inside our apps, and we do not use what you write in them to target advertising to you.

## 3. The Money System: your financial information

The Money System holds the budget you build: your income, your fixed and variable outgoings, your debts, your savings goals, your sinking funds, any investments you choose to record, and what you actually spent against your plan.

**It is not connected to your bank.** The Money System has no open banking connection, no card link and no feed from any financial institution. Nothing is imported automatically. Every figure in it is one you typed in yourself, and we never see your bank login, your account number or your card details.

**It is a budgeting tool, not financial advice.** We do not provide regulated financial advice, and nothing in the app is a personal recommendation.

**How it is treated.** Your budget is personal information and is protected exactly as described in Section 2: private to your account, access controlled per account, encrypted in transit and at rest, and never sold, shared for advertising or used to profile you.

## 4. The Deep Work System: your journal and your trading notes

The Deep Work System holds your goals and the reasons behind them, your daily priorities, your habits, your focus sessions and what distracted you, your journal entries and your weekly reviews. Some of this is reflective and personal. It stays private to your account and we do not read it in the normal course of business.

**The trading journal.** The Deep Work System includes an optional manual trading journal, where you can record trades you have made, the rules you set yourself and whether you kept to them.

* It is a written record you keep for yourself. It is not connected to any broker, exchange or trading account.
* It has no live prices and no market data feed. Nothing is imported.
* It cannot place, change or cancel a trade, and we never see your broker or exchange credentials.
* It is a discipline tool, not financial, investment or trading advice, and nothing in it is a personal recommendation.
* You can hide the trading section entirely when you set the app up, or leave it empty.

Anything you write there is personal information and is protected in the same way as the rest of your content.

## 5. How we protect sensitive information

Some of what our apps hold is more sensitive than the rest: what you write in a journal, what you record about your training, your sleep, your weight and your food, your trading notes, and the events we read from a Google Calendar you choose to connect. Every one of those is protected by the measures below, and each section that follows repeats the ones specific to it.

* **Encryption in transit.** All data moves over TLS encrypted connections between your device, any third party involved, and our servers.
* **Encryption at rest.** Stored data is held by our database provider (Supabase) and encrypted at rest.
* **Per account access controls.** Row level security means each account can only read and write its own rows. One customer cannot reach another customer's data.
* **Secrets stay on the server.** Privileged database keys and any third party access tokens are held server side only and are never placed in the app on your device or exposed to the browser.
* **Protected sign in.** Supabase Authentication handles sign in; passwords are stored only as secure cryptographic hashes.
* **Least privilege.** Where we connect to a third party service we request the narrowest permission that makes the feature work, and read only wherever reading is enough.
* **Limited internal access.** Our team does not read your content in the normal course of business, and only accesses account data where strictly necessary to investigate a fault you have reported or a genuine security or legal issue.
* **No selling, no advertising, no profiling.** None of this information is sold, shared for others' purposes, used for advertising or used to build a profile of you.
* **Deletion on your terms.** You can delete individual entries in the app, export your own copy, disconnect a connected service, and ask us to delete your account and its data (Section 16).

## 6. Health, fitness and food information

Some of our apps ask about your training, your sleep, what you eat and how you are feeling, because that is part of what the products are for. This section explains what we do and do not collect.

**What the apps ask for.**

* The Deep Work System has a Body and Training section where you can log your workouts and how they felt, your sleep, your steps, your water, your weight, and the meals you eat with their calories and macronutrients. You can also set daily targets for calories, protein, carbohydrate and fat.
* The Deep Work System asks you to set daily non-negotiables, and the ones it suggests to begin with include training, food and a bedtime. You can rename or delete every one of them, or set your own.
* The Academic Planner has a wellness section where you can log your mood, your sleep, your water and your steps.
* Other apps may ask you to record habits of the same kind.

**Every one of these is optional.** Nothing in this list is required to use the app. Leave a field blank and the app simply stops counting it. You can switch the Training section off entirely in the app's settings, which removes it from the menu, and nothing you had logged is deleted.

**What we do not collect.**

* We do not ask for medical information. No diagnoses, conditions, symptoms, medication, treatment or test results.
* Our apps do not connect to Apple Health, Google Fit, a smart watch, a fitness tracker, a smart scale or any other health app or device. Nothing is imported automatically, and every entry is one you typed in yourself.
* We do not ask for body measurements, body fat percentages or any clinical figure beyond the simple weight box described above.

**How we protect this information.** Training, sleep, weight and food entries are treated as sensitive data and protected by the following measures, which apply to everything described in this section:

* **Encryption in transit.** Everything you enter moves between your device and our servers over secure, encrypted connections using TLS, the same kind of secure connection used for online banking.
* **Encryption at rest.** Your entries are stored by our database provider (Supabase) and are encrypted at rest.
* **Per account access controls.** Your entries sit in your own private area of our database, protected by row level security, so each account can only read and write its own data and no other user can reach it. All privileged database keys are kept secret and server side; the app on your device holds only a public, restricted access key.
* **Protected sign in.** Access to your account is protected by Supabase Authentication, and your password is stored only as a secure cryptographic hash, never as text we could read.
* **Limited internal access.** Our team does not read your health, training or food entries in the normal course of business. We may only access account data where it is strictly necessary, for example to investigate a technical fault you have reported or a genuine security or legal issue, and only to the minimum extent needed.
* **No sharing and no advertising.** We do not sell this information, we do not share it with insurers, employers, advertisers or anyone else for their own purposes, and we do not use it to build a profile of you or to target advertising.
* **Separation from other data.** This information is never combined with anything read from your Google Calendar. The calendar connection is read only and one way, and calendar data is never used to infer anything about your health.
* **Deletion.** You can delete any individual entry inside the app at any time, export your own copy of everything, and ask us to delete your account and the data associated with it (see Section 16). Deleting an entry removes it from your account.

**If you choose to write something health related.** The notes, journals and free text boxes in our apps are yours to use as you see fit, and you may choose to record something about your health in one. If you do, it stays in your own private account, we do not read it in the normal course of business, and it is protected exactly as described in Section 2. You can edit or delete any entry at any time.

**How we use it.** We use this information only to show it back to you inside the app, and to produce the totals, streaks and summaries the app shows you. We do not use it for advertising, we do not sell it, we do not share it with insurers, employers or anyone else, and we do not use it to build a profile of you.

**Where this counts as health data in law.** Data protection law treats information about your health as a special category that needs stronger protection. We do not ask you for it, and our apps are not designed to hold it. Where something you choose to record does count as health data, we process it on the basis of your explicit consent, which you give by choosing to enter it, and which you can withdraw at any time by deleting the entry, or by deleting your account (see Section 16).

**Not medical advice.** Our apps, guides and content are for general information and motivation. They are not medical, nutritional or clinical advice, and they are not a substitute for a doctor, a dietitian or a qualified coach. If you have a health condition, are pregnant, are injured, or are making a significant change to your training or your diet, speak to a suitably qualified professional first.

## 7. Calendars you add to an app

Some of our apps let you bring in your own calendar by adding a calendar file (a `.ics` file) that you export from Apple Calendar, Google Calendar, Outlook or another calendar app.

* The file you choose is read by the app and turned into the events shown in your planner. We do not receive the file itself.
* Only the events in the near future are kept, so the app does not carry years of history around.
* These events are then part of your content and are stored and protected exactly as described in Section 2.
* This is a one way copy taken at the moment you add the file. It is not a live connection, nothing is written back to the calendar you exported from, and the app has no access to that calendar account.
* You can switch an imported calendar off, or remove it, at any time inside the app.

## 8. Connecting your Google Calendar

This section explains how we handle your information when you use the optional "Connect your calendar" feature in one of our apps. It adds to the rest of this Privacy Policy and applies only to the calendar connection. **Connecting your calendar is entirely optional. If you never connect one, none of this section applies to you.**

### What connecting your calendar does

When you choose "Connect your calendar" and sign in with Google, you grant the app permission to READ the events on your Google Calendar. We use this to show your upcoming events inside the app alongside your own goals, sessions and plans, so the app stays current on its own.

### What we access

We request a single, read-only permission:

* See the events on your Google calendars (the Google scope `https://www.googleapis.com/auth/calendar.events.readonly`).

This is read-only. We cannot create, change, or delete anything on your Google Calendar. We do not request access to your email, contacts, files, or any other Google data.

### How we use it

* We read your calendar events and display them in the app.
* The sync is one way: your Google Calendar flows into the app. The app never writes back to Google.
* We use the data only to provide the calendar feature to you. We do not use it for advertising, we do not sell it, and we do not use it to build profiles.

### What we store, and where

* We store the permission (an access token and a refresh token from Google) so the app can keep your events up to date without asking you to sign in every time. These tokens are held securely on our server (our backend runs on Supabase) and are never placed in the app on your device or shared with anyone.
* We store a copy of the calendar events themselves so they can appear in the app across your devices. This copy sits in your own private, access controlled area of our database.

### How we share it

We do not sell your calendar data and we do not share it with third parties for their own purposes. The only processor involved is our hosting and database provider (Supabase), which stores the data on our behalf so the feature can work. Human staff do not read your calendar events except where you specifically ask us to for support, or where the law requires it.

### How we protect your data

We protect the Google Calendar information you connect with the following measures:

* **Encryption in transit.** All data moves over secure, encrypted connections using TLS, the same kind of secure connection used for online banking, between your device, Google and our servers.
* **Encryption at rest.** The stored connection and your synced calendar events are held by our database provider (Supabase) and are encrypted at rest.
* **Secure handling of access tokens.** The tokens that grant access to your calendar are kept secret and server side only. They are never placed in the app on your device, never exposed to the browser, and never shared with other users or any third party. They can only be used by our server side functions.
* **Per account access controls.** Your synced events sit in your own private area of our database, protected by row level security, so each account can only read its own calendar events and no other user can access them.
* **Least privilege.** We request only read-only access to calendar events, the narrowest permission for this feature, so the connection can never create, change or delete anything on your Google Calendar.
* **Limited internal access.** Access to this data is restricted to what is strictly necessary to operate the feature. Our team does not read your calendar data except where you ask us for support, or where the law requires it.
* **Deletion.** We delete the stored connection and the synced events when you disconnect, when you close your account, or when your access to the app ends (see below).

### Limited Use

Guy Gotta Change's use and transfer to any other app of information received from Google APIs will adhere to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

### Keeping the connection, and removing it

* You can disconnect at any time using "Disconnect calendar" inside the app's settings. When you disconnect, we delete the stored permission (tokens) and remove the synced calendar events from the app.
* You can also remove the app's access from your Google Account at any time at [https://myaccount.google.com/permissions](https://myaccount.google.com/permissions). Doing so stops any further syncing.
* If you close your account, or if your access to the app ends (for example a refund), we remove the stored calendar permission and the synced events.

### Retention

We keep your calendar tokens and synced events only while your calendar is connected. Once you disconnect, or your access is removed as above, we delete them.

### Contact

Questions about the calendar connection or your data: [info@guygottachange.com](mailto:info@guygottachange.com).

## 9. Where we collect personal information from

We may collect personal information from the following sources:

* Directly from you, including when you create an account, visit or use the Services, use an app, communicate with us, or otherwise provide us with your personal information.
* Automatically through the Services, including from your device when you use our products or services or visit our websites, and through cookies and similar technologies.
* From our service providers, including when we engage them to enable certain technology and when they collect or process your personal information on our behalf.
* From our partners or other third parties.

## 10. How we use your personal information

Depending on how you interact with us or which Services you use, we may use personal information to:

* **Provide, tailor and improve the Services.** This includes performing our contract with you, processing your payments, fulfilling your orders, creating and managing your account, syncing and backing up your content, remembering your preferences and items you are interested in, sending notifications related to your account, processing purchases, returns, exchanges or other transactions, arranging shipping, enabling you to post reviews, and creating a customised shopping experience, such as recommending products related to your purchases.
* **Marketing and advertising.** We may send marketing, advertising and promotional communications by email, text message or post, and show you online advertisements for products or services on the Services or other websites, including based on items you previously purchased or added to your cart and other activity on the Services. We never use the content you keep in our apps for this.
* **Security and fraud prevention.** We use personal information to authenticate your account, provide a secure payment and shopping experience, detect, investigate or take action regarding possible fraudulent, illegal, unsafe or malicious activity, protect public safety, and secure our Services. If you register an account, you are responsible for keeping your account credentials safe, and we strongly recommend that you do not share your username, password or other access details with anyone else.
* **Communicating with you.** We use personal information to provide customer support, to be responsive to you, and to maintain our relationship with you.
* **Legal reasons.** We use personal information to comply with applicable law or respond to valid legal process, including requests from law enforcement or government agencies, to investigate or take part in civil discovery, potential or actual litigation or other adversarial legal proceedings, and to enforce or investigate potential violations of our terms or policies.

Where the law requires a lawful basis (for example under the EU and UK GDPR), we rely on: performance of our contract with you, to provide the Services you sign up for; your consent, for example for marketing, non essential cookies and connecting your calendar; our legitimate interests, to run and secure our business in a way that is not overridden by your rights; and compliance with legal obligations.

## 11. How we disclose personal information

We do not sell the content you keep in our apps. In certain circumstances, we may disclose your personal information to third parties for legitimate purposes subject to this Privacy Policy. These may include:

* With Shopify, vendors and other third parties who perform services on our behalf, for example IT management, payment processing, data analytics, customer support, cloud storage, app sync, fulfilment and shipping.
* With business and marketing partners to provide marketing services and advertise to you. For example, we use Shopify to support personalised advertising with third party services based on your online activity with different merchants and websites. Our business and marketing partners use your information in accordance with their own privacy notices. Depending on where you live, you may have a right to direct us not to share information about you to show you targeted advertisements and marketing based on your online activity with different merchants and websites. You can exercise your right to opt out of those uses through the [Shopify Privacy Portal](https://privacy.shopify.com/en).
* When you direct, request or otherwise consent to our disclosure of certain information to third parties, such as to ship you products or through your use of social media widgets or login integrations.
* With our affiliates or otherwise within our corporate group.
* In connection with a business transaction such as a merger or bankruptcy, to comply with applicable legal obligations (including responding to subpoenas, search warrants and similar requests), to enforce applicable terms of service or policies, and to protect or defend the Services, our rights, and the rights of our users or others.

**Our main service providers.** These include:

* Shopify, which hosts our online store and processes orders.
* Supabase, which provides sign in and the secure database that stores and syncs your content.
* Cloudflare, which delivers and helps secure our apps.
* Google, where you choose to connect your Google Calendar (see Section 8).
* Payment providers, which process card and other payments.
* Email and communication providers, which we use to send account, support and marketing messages.

**Data processing agreements.** Each provider that processes personal information on our behalf is bound by a data processing agreement, so it must protect your data, use it only on our instructions, keep it secure, and help us meet our obligations under data protection law. This includes Supabase, Shopify and Cloudflare. Where personal information is transferred internationally, these agreements rely on recognised safeguards such as the European Commission's Standard Contractual Clauses. We can provide an up to date list of our service providers on request.

## 12. Relationship with Shopify

The Services are hosted by Shopify, which collects and processes personal information about your access to and use of the Services in order to provide and improve the Services for you. Information you submit to the Services will be transmitted to and shared with Shopify, as well as third parties that may be located in countries other than where you live, in order to provide and improve the Services for you.

In addition, to help protect, grow and improve our business, we use certain Shopify enhanced features that incorporate data and information obtained from your interactions with our store, along with other merchants and with Shopify. To provide these enhanced features, Shopify may make use of personal information collected about your interactions with our store, along with other merchants, and with Shopify. In these circumstances, Shopify is responsible for the processing of your personal information, including for responding to your requests to exercise your rights over the use of your personal information for these purposes.

To learn more about how Shopify uses your personal information and any rights you may have, you can visit the [Shopify Consumer Privacy Policy](https://www.shopify.com/legal/privacy/app-users). Depending on where you live, you may exercise certain rights with respect to your personal information through the [Shopify Privacy Portal](https://privacy.shopify.com/en).

## 13. Cookies and similar technologies

We use cookies and similar technologies to run the Services, remember your preferences, keep you signed in, understand how the Services are used and, where you agree, for marketing. You can manage non essential cookies through our cookie banner or your browser settings. Essential cookies are needed for the Services to work.

Our apps also use your browser's local storage to keep a copy of your content on your device, so the app is fast and works offline. That copy is on your device, not on our servers, and you can clear it from your browser settings at any time.

## 14. Third party websites and links

The Services may provide links to websites or other online platforms operated by third parties, including links you add to your own content. If you follow links to sites not affiliated with or controlled by us, you should review their privacy and security policies and other terms and conditions. We do not guarantee and are not responsible for the privacy or security of such sites, including the accuracy, completeness or reliability of information found on them. Information you provide on public or semi-public venues, including information you share on third party social networking platforms, may also be viewable by other users of the Services and/or users of those platforms, without limitation as to its use by us or by a third party. Including a link does not, by itself, imply any endorsement of the content on those platforms or of their owners or operators, except as disclosed on the Services.

## 15. Children's data

Our store and our apps are intended for adults, and are not directed at children. We do not knowingly collect personal information about children under the age of majority in your jurisdiction.

If you are under the age at which you can consent to online services in your country (for example 16 in Ireland), please use the Services only with the involvement of a parent or guardian. If you are the parent or guardian of a child who has provided us with personal information, you may contact us using the details in Section 21 to request that it be deleted.

As of the effective date of this Privacy Policy, we do not have actual knowledge that we "share" or "sell" (as those terms are defined in applicable law) personal information of individuals under 16 years of age.

## 16. Security and retention of your information

We take reasonable technical and organisational measures to protect your information, including encryption in transit and at rest, per account access controls, hashed passwords, restricted access to our systems, and reputable infrastructure providers. Please be aware that no security measures are perfect or impenetrable, and we cannot guarantee "perfect security". Any information you send to us may not be secure while in transit, so we recommend that you do not use unsecure channels to send us sensitive or confidential information. Please keep your password private and do not reuse it on other sites.

How long we keep your personal information depends on different factors, such as whether we need it to maintain your account, to provide the Services, to comply with legal obligations, to resolve disputes, or to enforce other applicable contracts and policies. When we no longer need it, we delete or anonymise it. If you close your account, we delete the content associated with it within a reasonable period, except where we are required to keep certain records, for example order records for tax purposes.

## 17. Your rights and choices

Depending on where you live, you may have some or all of the rights listed below in relation to your personal information. These rights are not absolute, may apply only in certain circumstances and, in certain cases, we may decline your request as permitted by law.

* **Right to access / know.** You may have a right to request access to the personal information we hold about you.
* **Right to delete.** You may have a right to request that we delete personal information we hold about you, including your content and your account.
* **Right to correct.** You may have a right to request that we correct inaccurate personal information we hold about you.
* **Right of portability.** You may have a right to receive a copy of the personal information we hold about you and to request that we transfer it to a third party, in certain circumstances and with certain exceptions. For content you keep in our apps, you can also download your own copy from inside the app at any time.
* **Right to opt out of sale or sharing for targeted advertising.** Depending on where you live, you may have a right to opt out of the "sale" or "sharing" of your personal information, or of the processing of your personal information for purposes considered to be "targeted advertising", as defined in applicable privacy laws. You can exercise this right through the [Shopify Privacy Portal](https://privacy.shopify.com/en). If you visit our website with the Global Privacy Control opt-out preference signal enabled, depending on where you are, we will automatically treat this as a request to opt out for the device and browser you use to visit the website. If we are able to associate the device sending the signal with a Shopify account, we will apply the opt out request to that account as well. To learn more about Global Privacy Control, visit [https://globalprivacycontrol.org/](https://globalprivacycontrol.org/). Other than the Global Privacy Control, we do not recognise other "Do Not Track" signals that may be sent from your web browser or device.
* **Managing communication preferences.** We may send you promotional emails, and you may opt out of receiving them at any time using the unsubscribe option in our emails. If you opt out, we may still send you non-promotional emails, such as those about your account or orders you have made.

If you live in the UK or the European Economic Area, and subject to exceptions and limitations provided by local law, you may also have the following rights:

* **Objection to processing and restriction of processing.** You may have the right to ask us to stop or restrict our processing of personal information for certain purposes.
* **Withdrawal of consent.** Where we rely on consent to process your personal information, you have the right to withdraw it. Withdrawing consent does not affect the lawfulness of any processing based on your consent before its withdrawal.

You may exercise any of these rights where indicated on the Services or by contacting us using the details in Section 21. To learn more about how Shopify uses your personal information and any rights you may have, including rights related to data processed by Shopify, visit [https://privacy.shopify.com/en](https://privacy.shopify.com/en).

We will not discriminate against you for exercising any of these rights. We may need to verify your identity before we can process your request, as permitted or required under applicable law. In accordance with applicable laws, you may designate an authorised agent to make requests on your behalf. Before accepting a request from an agent, we will require the agent to provide proof that you have authorised them to act on your behalf, and we may need you to verify your identity directly with us. We will respond to your request in a timely manner, as required under applicable law.

## 18. Complaints

If you have a complaint about how we process your personal information, please contact us using the details in Section 21. Depending on where you live, you may have the right to appeal our decision by contacting us, or to lodge a complaint with your local data protection authority. In Ireland, this is the Data Protection Commission ([www.dataprotection.ie](https://www.dataprotection.ie)). For the rest of the EEA, you can find a [list of the responsible data protection supervisory authorities here](https://edpb.europa.eu/about-edpb/about-edpb/members).

## 19. International transfers

Please note that we and our service providers may transfer, store and process your personal information outside the country you live in.

If we transfer your personal information out of the European Economic Area or the United Kingdom, we will rely on recognised transfer mechanisms like the European Commission's Standard Contractual Clauses, or any equivalent contracts issued by the relevant competent authority of the UK, unless the transfer is to a country that has been determined to provide an adequate level of protection.

## 20. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes to our practices or for other operational, legal or regulatory reasons. We will post the revised Privacy Policy on this website, update the "Last updated" date and provide notice as required by applicable law.

## 21. Contact

Should you have any questions about our privacy practices or this Privacy Policy, or if you would like to exercise any of the rights available to you, please contact us:

Guy Gotta Change LTD
Unit 3/4, Deansgrange Business Park, Blackrock, Dublin, A94 D954, Ireland
Email: [info@guygottachange.com]

For the purposes of applicable data protection laws, Guy Gotta Change LTD is the data controller of your personal information.