LEGAL
Privacy Policy
How Gordon & Bridge handles your personal data.
Last updated: 28 July 2026
1. Who we are
Gordon & Bridge is a consultancy specialising in behavioural science, human-centred artificial intelligence and strategic advisory services. For the purposes of the EU General Data Protection Regulation (GDPR), applicable Italian data-protection law and, where applicable, the UK GDPR and Data Protection Act 2018, the controller is Dr Marilisa Conese, trading as Gordon & Bridge.
| Controller details | Information |
| Trading name | Gordon & Bridge |
| Legal name | Dr Marilisa Conese |
| Professional address | via Macchie 31/8, 70128 Bari, Italy |
| Privacy contact | info@gordonandbridge.com |
| Website | www.gordonandbridge.com |
| VAT no. | 08975790729 |
2. Scope of this notice
This notice applies when you visit the Gordon & Bridge website, make an enquiry, book a consultation, subscribe to communications, download a resource, register for an event or course, buy a digital product or otherwise interact with Gordon & Bridge. A separate client privacy notice or contractual provision may apply where Gordon & Bridge processes information in connection with a consultancy engagement.
3. Personal data we collect
- Identity and contact data, such as your name, job title, organisation, postal address, email address and telephone number.
- Enquiry and correspondence data, including the content of messages, meeting requests, call notes and any information you choose to provide.
- Booking and event data, including availability, appointment details, attendance, dietary or accessibility requirements where relevant, and related communications.
- Client and transaction data, including proposals, contracts, billing details, payment status, purchased products or services and support history. Payment-card data should ordinarily be processed by the payment provider rather than stored by Gordon & Bridge.
- Account and learning data, if courses, memberships or assessment tools are introduced, including sign-in details, enrolment, progress, responses, submissions, certificates and product usage.
- Marketing preferences, including subscriptions, consent records, communication preferences and engagement with messages.
- Technical and usage data, such as IP address, browser and device information, approximate location, referral source, pages viewed, interaction events, timestamps and cookie or similar identifiers.
- Professional and public-source data, such as information on a business website, professional directory or LinkedIn profile where relevant to a genuine business relationship.
- Audio, image or recording data where a workshop, speaking engagement or online session is recorded, but only with appropriate notice and any necessary permission.
Please do not send health information, psychological assessments, political opinions or other special-category data through the website unless Gordon & Bridge has specifically requested it and explained how it will be handled.
4. How we collect personal data
- Directly from you through forms, email, bookings, meetings, purchases, registrations, surveys or other communications.
- Automatically through the website, cookies and similar technologies, subject to your choices. See the Cookie Policy.
- From service providers involved in bookings, payments, email delivery, events, learning platforms, analytics or website hosting.
- From your organisation, a referrer, event organiser, business partner or publicly available professional source where lawful and relevant.
5. Purposes and lawful bases
| Purpose | Typical data | Lawful basis |
| Respond to enquiries and arrange consultations | Contact, enquiry and booking data | Steps at your request before a contract; legitimate interests in handling business enquiries |
| Provide consultancy, workshops, speaking or other services | Contact, client, event and correspondence data | Performance of a contract; legitimate interests in administering B2B relationships |
| Provide courses, memberships, downloads or digital products | Account, learning, transaction and support data | Performance of a contract; legal obligation for tax and accounting |
| Process payments, invoices and records | Identity, transaction and billing data | Performance of a contract; legal obligation; legitimate interests in debt recovery and financial administration |
| Operate, secure and troubleshoot the website | Technical, usage and security data | Legitimate interests in providing a safe, reliable website; legal obligation where applicable |
| Measure website performance and understand audiences | Cookie, technical and usage data | Consent where required for non-essential cookies; legitimate interests only where the technology and law permit |
| Send newsletters and promotional communications | Contact, preference and engagement data | Consent where required; otherwise legitimate interests for proportionate B2B marketing, subject to applicable electronic-marketing law and your right to object |
| Manage events, recordings and publications | Registration, attendance, image, audio and contribution data | Contract; consent where appropriate; legitimate interests in delivering and documenting events |
| Develop and improve services, frameworks and products | Feedback, usage and appropriately aggregated or de-identified data | Legitimate interests in service improvement; consent where required |
| Establish, exercise or defend legal claims and manage risk | Relevant contact, correspondence, client, transaction and technical data | Legitimate interests; legal obligation |
| Comply with law and regulatory requests | Data relevant to the request | Legal obligation; legitimate interests where the obligation arises outside the EU/EEA |
Where Gordon & Bridge relies on legitimate interests, it considers whether the processing is necessary and balances those interests against your rights and reasonable expectations. You may request further information about that assessment.
6. Marketing
Gordon & Bridge may send marketing where it has your consent or another lawful basis permitted by applicable law. Subscription is optional. You can unsubscribe at any time through the link in a marketing email or by contacting info@gordonandbridge.com. Withdrawing consent does not affect processing that was lawful before withdrawal.
Gordon & Bridge will not sell your personal data. It will not add a person who merely submits a contact form to a newsletter list unless there is a lawful basis and the required notice or consent.
7. Cookies, analytics and embedded content
The website may use essential technologies and, with consent where required, analytics, preference or marketing technologies. Embedded content from services such as YouTube or LinkedIn may allow the provider to receive technical or usage data. Non-essential technologies should remain disabled until the relevant consent has been given. Details and controls are set out in the Cookie Policy and consent tool.
8. Recipients and service providers
Personal data may be disclosed only as reasonably necessary to:
- website, hosting, security, cloud-storage and IT providers;
- email, customer-relationship, booking, videoconferencing and newsletter providers;
- payment, accounting, tax, banking and professional advisers;
- course, membership, event, webinar and digital-delivery platforms;
- analytics and embedded-media providers where enabled;
- contractors or delivery partners who need the information to support an engagement and are subject to suitable obligations;
- regulators, courts, law-enforcement bodies or other parties where required by law or necessary to protect legal rights; and
- a buyer, investor or adviser in connection with a proposed sale, reorganisation or transfer of the business, subject to appropriate safeguards.
The current service-provider and cookie inventories must be maintained internally and reflected in this notice or the Cookie Policy where transparency requires it.
9. International transfers
Some recipients may process personal data outside Italy, the European Economic Area or the United Kingdom. Where transfer restrictions apply, Gordon & Bridge will use an available legal mechanism, such as an adequacy decision or regulation, approved standard contractual clauses, the UK International Data Transfer Agreement or UK Addendum, together with any required transfer assessment and supplementary measures. You may request information about the applicable safeguard by contacting the privacy address above.
10. Retention
Gordon & Bridge keeps personal data only for as long as reasonably necessary for the relevant purpose, including legal, accounting, tax and dispute-resolution requirements. The following periods are intended as a practical baseline and must be checked against Italian professional, civil and tax requirements and the live systems:
| Record type | Indicative retention |
| Unsuccessful general enquiries | Up to 24 months after the last substantive contact |
| Consultation bookings and routine correspondence | Up to 24 months, unless incorporated into a client file |
| Client contracts, deliverables and core engagement records | For the engagement and generally 10 years afterwards where needed for Italian civil, tax or evidential purposes |
| Invoices, tax and accounting records | For the period required by applicable law, commonly 10 years in Italy |
| Newsletter records | Until unsubscribe or withdrawal, plus a minimal suppression record to respect the choice |
| Consent and preference evidence | For as long as relevant to demonstrate compliance and defend claims |
| Analytics data | For the period stated in the cookie consent tool and provider settings, minimised where possible |
| Course or account data | For the account term and a reasonable period afterwards; transaction records may be kept longer where legally required |
| Security logs | Normally up to 12 months, unless needed to investigate an incident or claim |
Data may be retained longer where a complaint, investigation, legal hold or dispute makes this necessary. It may be deleted or irreversibly anonymised earlier when no longer needed.
11. Security
Gordon & Bridge uses proportionate technical and organisational measures designed to protect personal data, including access controls, appropriate authentication, secure configurations, supplier due diligence, backups, staff or contractor confidentiality and incident-management procedures. No internet transmission or storage system can be guaranteed completely secure.
12. Your rights
Subject to applicable law and any relevant conditions or exemptions, you may have the right to:
- request access to your personal data and information about its use;
- request correction of inaccurate or incomplete data;
- request erasure;
- request restriction of processing;
- object to processing based on legitimate interests and object at any time to direct marketing;
- receive certain data in a structured, commonly used and machine-readable format and transmit it to another controller;
- withdraw consent at any time where processing relies on consent; and
- not be subject to a decision based solely on automated processing that produces legal or similarly significant effects, where the relevant legal conditions apply.
To exercise a right, contact info@gordonandbridge.com. Gordon & Bridge may need to verify your identity. It will normally respond within one month, subject to any lawful extension.
13. Complaints
Please contact Gordon & Bridge first so that the concern can be addressed. You also have the right to complain to the supervisory authority in your habitual residence, place of work or the place of the alleged infringement. As Gordon & Bridge is based in Italy, the relevant authority is the Garante per la protezione dei dati personali (www.garanteprivacy.it). Where the UK GDPR applies, you may also contact the UK Information Commissioner’s Office (www.ico.org.uk).
14. Children
The website and services are intended for business and adult audiences and are not directed at children. Gordon & Bridge does not knowingly collect children’s personal data through the website. Any future course intended for minors will require a separate assessment, age-appropriate information and appropriate consent arrangements.
15. Automated decision-making and AI tools
The website does not presently make solely automated decisions about individuals that produce legal or similarly significant effects. If Gordon & Bridge introduces an AI assessment or other material automated decision-making tool, it will assess the legal basis, fairness, accuracy, transparency, human oversight and data-protection risks, provide any additional required information and carry out a data protection impact assessment where necessary.
Gordon & Bridge may use carefully selected AI-assisted tools in internal work. Personal or confidential client information should not be entered into a third-party AI service unless the use is authorised, contractually controlled and consistent with applicable data-protection and confidentiality obligations.
16. Changes to this notice
This notice may be updated to reflect changes in law, technology, suppliers or services. The current version will be posted on the website with a revised date. Material changes may also be communicated directly where appropriate.