Privacy policy

Last updated 22 September 2026.

This policy explains how The GTM Studio Pte Ltd collects, uses and protects personal data. It is written to meet Singapore's Personal Data Protection Act 2012 (PDPA) and, for people in the European Union, the European Economic Area, the United Kingdom and Switzerland, the GDPR and UK GDPR.

1. Who we are

The GTM Studio Pte Ltd ("we", "us") is a company registered in Singapore, UEN 202541716R, at 105 Cecil Street, #18-18, Singapore 069534. We design, build and run revenue systems for business-to-business (B2B) companies.

For any question about your personal data, contact our Data Protection Officer, Charles Tidswell, at [email protected].

2. When you deal with us directly

When you contact us, or book a call or a workshop: your name, work email, company, role, company size, where your go-to-market is today, and anything you write in your message.

When you subscribe to the newsletter: your email address.

When we meet: we may take notes of the meeting, including with a note-taking tool, so that we can follow up accurately.

When we work together: business contact details, correspondence, invoices, and the material that belongs to the engagement.

When you visit the website:

• Google Analytics 4 records the pages you view, how you arrived, your approximate location, and your device and browser. It sets cookies to recognise a returning visit.
• Claydar identifies the company a visit comes from, using the visitor's IP address and similar signals, so that we can see which organisations are interested in our work.

If you are in the EU, EEA, UK or Switzerland, neither Google Analytics nor Claydar runs until you accept in the cookie banner. Elsewhere they run when the page loads. See section 10.

3. When we contact you on a client's behalf, or on our own

Our work is business-to-business outreach: finding the companies and people most likely to need a product, and contacting them at a relevant moment. To do this we process limited business contact data about professionals, strictly for go-to-market purposes.

What we process:

• Name and job title.
• Business email address and business phone number.
• Company name, industry and company size.
• LinkedIn profile URLs and other professional social media information.
• Campaign engagement data, such as email opens, clicks and replies, LinkedIn interactions and call outcomes.
• Publicly observable professional signals, such as a change of role, content you have engaged with publicly, or events you have attended.
• Internal notes, scores and segment labels used to decide who to contact and when.

We do not intentionally process special categories of personal data, such as health, religion or political opinions.

Where it comes from: public professional sources such as LinkedIn and company websites; business data providers that we use to find and verify business contact details; and, when we work for a client, the client's own records, such as their CRM.

Our role:

• When we run outreach for a client, the client decides who is contacted and why. We act on their instructions as their processor, under our agreement with them, which includes a data processing agreement where the law requires one. If you want to exercise your rights over that data, you can contact the client or us, and we will help.
• When we contact you about our own services, we are the controller. We rely on our legitimate interest in contacting businesses about services relevant to their work (under the GDPR) and on the business contact exception (under the PDPA).

You can object at any time to being contacted, and we will stop and keep a record so that you are not contacted again. Email [email protected] or reply to the message you received.

4. How we use personal data

• To reply to enquiries and arrange calls and workshops.
• To deliver the work we are engaged to do, including outreach on our clients' behalf.
• To contact businesses about our own services.
• To send the newsletter, if you subscribed. Each issue explains how to stop receiving it.
• To understand which pages are useful and which companies are interested in our work, so we can improve the site and follow up where it is relevant.
• To meet our legal, tax and accounting obligations.

5. Legal basis

Under the PDPA, we collect personal data with consent, with consent deemed from your providing it for a clear purpose (such as submitting the booking form), or under an exception the Act allows, such as for business contact information.

Under the GDPR and UK GDPR, we rely on: your consent (analytics, visitor identification and the newsletter); the steps needed to enter into or perform a contract (workshops and engagements); our legitimate interest in replying to enquiries and in contacting businesses about relevant services, balanced against your rights; and, when we act for a client, the client's own lawful basis.

6. Automated decisions

We use software, including AI tools, to research companies, score and segment contacts, and draft messages, and a person reviews how that work is used. We do not make decisions that have legal or similarly significant effects on you by automated means alone.

7. Who we share it with

We do not sell personal data. We share it only with the providers that run our website, our business and our client work, each acting on our instructions under contract, with authorities where the law requires it, and with anyone else only with your consent.

Website and our own business

Client work. Depending on the engagement, the platforms we use may include:

• Finding, enriching and structuring data: Clay, AI Ark, Prospeo, BlitzAPI, Jina, Phantombuster, Discolike and Supabase.
• Checking that contact details are valid: Reoon, ENROW, ICYPEAS and Email Guard.
• Sending and deliverability: Zapmail, InboxKit, Email Bison, Smartlead and Boomerang.
• LinkedIn outreach and calling: LinkedIn, HeyReach, AimFox, and NL Pearl for AI voice calls.
• Domains and landing pages: GoDaddy and Webflow.
• Signals and automation: Clay Web Intent, Gojiberri, Rapid AI, Apify and Zapier.
• AI for research, drafting and building our workflows: OpenAI, Anthropic (including Claude Code), Google Gemini, Perplexity and Cursor, and HeyGen for personalised video.

A current list of the platforms active on an engagement is available on request.

8. International transfers

We are based in Singapore and use cloud platforms that process data in other countries, including the United States. Where we transfer personal data out of Singapore, we make sure it is protected to a standard comparable to the PDPA. For data from the EU, EEA, UK or Switzerland, we rely on Standard Contractual Clauses or an equivalent recognised safeguard, and we support our clients' transfer impact assessments with descriptions of our data flows and where our providers host data.

9. How long we keep it

We keep personal data only as long as we need it for the purpose we collected it for, then delete it or make it anonymous.

• Enquiries that do not lead to work: 24 months from our last contact.
• Meeting notes: with the record of the relationship, and deleted 24 months after our last contact unless an engagement follows.
• Newsletter: until you unsubscribe. We then keep only your email address on a suppression list, so that you are not added again by mistake.
• Data processed for a client's outreach: for the length of the engagement, then deleted or returned within 90 days of it ending, unless our agreement with the client sets a different period.
• Our own outreach data: reviewed at least once a year. Contacts we have had no engagement with for 24 months are deleted. If you object to being contacted, we keep only what we need to make sure you are not contacted again.
• Client engagement, invoicing and accounting records: five years from the end of the financial year they relate to, as Singapore law requires for business records.
• Google Analytics data: 14 months.
• Your cookie choice: stored in your browser until you change it or clear it.

10. Cookies and your choice

The site uses cookies and similar storage for three things: making the site work, remembering your cookie choice, and, where allowed, Google Analytics and Claydar.

If you are in the EU, EEA, UK or Switzerland, a banner asks before any analytics or visitor identification runs. You can change your choice at any time with the Cookie settings link in the footer. You can also clear or block cookies in your browser.

11. Security

We protect personal data with role-based access and least-privilege permissions, individual user accounts with strong authentication, encrypted connections to every platform we use, minimal local storage, internal guidance on handling data, and limits on how much data we collect and how long we keep it. No system is perfectly secure. If a breach affects your personal data, we will tell you and the relevant authority as the law requires, without undue delay.

12. Your rights

You can ask to see the personal data we hold about you, correct it, or ask us to delete it. You can object to our contacting you at any time. Under the GDPR and UK GDPR you can also ask us to restrict or stop processing it, ask for a copy in a portable format, and withdraw consent at any time. Email [email protected]. We reply within 30 days.

13. Children

Our work is for businesses. We do not knowingly collect personal data from anyone under 16. If you believe we have, email us and we will delete it.

14. Changes

When we change this policy, we update the date at the top of this page.

15. Complaints

Please contact us first, so we can put it right. You can also complain to Singapore's Personal Data Protection Commission (www.pdpc.gov.sg) or, in the EU, EEA, UK or Switzerland, to your local data protection authority.