Privacy Policy

Effective date: 31 August 2026

www.keystoneimpactsolutions.au (the "Site") is owned and operated by Jessica Hodgson, trading as Keystone Impact Solutions. Jessica Hodgson is the data controller and can be contacted at:

Purpose

The purpose of this Privacy Policy is to inform users of our Site of the following:

1. The personal data we will collect;
2. Use of collected data;
3. Who has access to the data collected;
4. The rights of Site users; and
5. The Site's cookie policy.

This Privacy Policy applies in addition to the Terms and Conditions of our Site.

GDPR

Our Site is built for an Australian audience and is not directed at users in the European Union or United Kingdom. Where the GDPR nonetheless applies to a user of our Site, we adhere to Regulation (EU) 2016/679 (the "GDPR") and, for users in the United Kingdom, the GDPR as enshrined in the Data Protection Act 2018.

We have not appointed a Data Protection Officer, as we do not fall within the categories of controllers and processors required to appoint one under Article 37 of the GDPR.

Consent

By using our Site, users agree that they consent to the conditions set out in this Privacy Policy.

When the legal basis for us processing your personal data is that you have provided your consent to that processing, you may withdraw your consent at any time. If you withdraw your consent, it will not make processing which we completed before you withdrew your consent unlawful. You can withdraw your consent by contacting hello@keystoneimpactsolutions.au.

Legal Basis for Processing

We collect and process personal data about users in the EU only when we have a legal basis for doing so under Article 6 of the GDPR. We rely on users having provided their consent to the processing of their data for one or more specific purposes.

Personal Data We Collect

We only collect data that helps us achieve the purpose set out in this Privacy Policy. We will not collect any additional data beyond the data listed below without notifying you first.

Data collected automatically

When you visit and use our Site, we may automatically collect and store the following information:

1. IP address;
2. Location (in coarse form, inferred from IP address);
3. Hardware and software details (browser and device type);
4. Content viewed (pages requested); and
5. Data associated with Google reCAPTCHA and our newsletter sign-up form.

Data collected in a non-automatic way

We may also collect the following data when you perform certain functions on our Site:

1. First and last name;
2. Business name;
3. Email address;
4. Phone number;
5. Message content and preferred contact method; and
6. Written responses submitted to the Impact Logic tool.

This data is collected using the following methods: the newsletter sign-up form (collects email address only), the contact form (collects name, business name, email, phone, message, and preferred contact method), and the Impact Logic tool (collects written responses to assessment questions and an email address).

How We Use Personal Data

Data collected on our Site will only be used for the purposes specified in this Privacy Policy or indicated on the relevant pages of our Site. We will not use your data beyond what we disclose in this Privacy Policy.

Data collected automatically is used only to operate and secure the website — for example, to keep the site running, diagnose technical issues, and prevent spam and bot submissions through our forms.

Data collected when you perform a function on our Site is used for: communication (responding to contact form enquiries), sending our email newsletter (for newsletter sign-ups), and generating and delivering the requested output (for the Impact Logic tool, including sharing your output with Dr Jess Hodgson only where you have chosen to do so).

Who We Share Personal Data With

Employees

We may disclose user data to any member of our organisation who reasonably needs access to it to achieve the purposes set out in this Privacy Policy. As a solo consulting practice, Keystone Impact Solutions does not have employees with independent access to your data.

Third parties

We may share user data with the following third parties: Google (Fonts and reCAPTCHA), Moxie, Splitforms, Brevo (Sendinblue), Netlify, and Anthropic.

We may share the following data with these third parties: IP address, device and browser details, contact details (name, business name, email, phone), message content, discovery call scheduling details, and written responses submitted to the Impact Logic tool.

We share this data for the following purposes: to load site fonts, prevent spam and bot submissions, send our newsletter, process contact enquiries, host and run the website, manage discovery call bookings, and generate and deliver Impact Logic outputs using AI processing.

Third parties will not be able to access user data beyond what is reasonably necessary to achieve the given purpose.

Other disclosures

We will not sell or share your data with other third parties, except in the following cases: if the law requires it; if it is required for any legal proceeding; to prove or protect our legal rights; and to buyers or potential buyers of this business in the event that we seek to sell it.

If you follow hyperlinks from our Site to another site, please note that we are not responsible for and have no control over their privacy policies and practices.

How Long We Store Personal Data

User data is stored until the purpose the data was collected for has been achieved. In practice, this means: newsletter subscribers remain on our list until they unsubscribe; contact form enquiries are kept as long as needed to respond to and resolve them; the Impact Logic tool does not retain your written responses beyond generating your output. You will be notified if your data is kept for longer than this period.

How We Protect Your Personal Data

All traffic to our website is encrypted (HTTPS). We do not build or maintain our own database of visitor data — form submissions and enquiries are handled by established third-party providers (Splitforms, Brevo, and Netlify) rather than stored on infrastructure we manage ourselves, and each of these providers maintains its own security measures. Google reCAPTCHA is used on our forms to detect and block automated and malicious submissions. The Impact Logic tool does not retain the responses you submit; your answers are processed to generate your output and are not stored afterwards. As a solo consulting practice, Keystone Impact Solutions does not have employees with independent access to your data.

While we take all reasonable precautions to ensure that user data is secure and that users are protected, there always remains the risk of harm. The internet as a whole can be insecure at times, and therefore we are unable to guarantee the security of user data beyond what is reasonably practical.

Your Rights as a User

Under the GDPR, where it applies to you, you have the following rights: right to be informed; right of access; right to rectification; right to erasure; right to restrict processing; right to data portability; and right to object.

Children

We do not knowingly collect or use personal data from children under 16 years of age. If we learn that we have collected personal data from a child under 16 years of age, the personal data will be deleted as soon as possible. If a child under 16 years of age has provided us with personal data, their parent or guardian may contact our privacy officer.

How to Access, Modify, Delete, or Challenge the Data Collected

If you would like to know if we have collected your personal data, how we have used it, if we have disclosed it and to whom, if you would like your data to be deleted or modified in any way, or if you would like to exercise any of your other rights, please contact our privacy officer:

Do Not Track Notice

Do Not Track ("DNT") is a privacy preference you can set in certain web browsers. We do not track the users of our Site over time and across third-party websites, and therefore do not respond to browser-initiated DNT signals. We are not responsible for and cannot guarantee how any third parties who interact with our Site will respond to DNT signals.

How to Opt-Out of Data Collection, Use or Disclosure

In addition to the methods described above, we provide the following specific opt-out methods:

1. You can opt out of receiving our email newsletter by clicking "unsubscribe" at the bottom of any newsletter email.
2. You can opt out of your Impact Logic responses being shared with Dr Jess Hodgson by unchecking the "Share my output with Dr Jess Hodgson" box before submitting the Impact Logic tool.

Cookie Policy

A cookie is a small file stored on a user's device by a website, used to collect data relating to the user's browsing habits. You can choose to be notified each time a cookie is transmitted, and you can choose to disable cookies entirely in your internet browser, though this may decrease the quality of your experience on our Site.

We do not set any first-party cookies ourselves. We use the following third-party cookies on our Site: cookies set by Google reCAPTCHA, used to detect and block bots and spam on our forms, and cookies set by the Brevo newsletter widget, used to run our sign-up form. Neither is used for advertising or to track visitor interests.

Modifications

This Privacy Policy may be amended from time to time in order to maintain compliance with the law and to reflect any changes to our data collection process. When we amend this Privacy Policy, we will update the "Effective date" at the top of this page. We recommend that our users periodically review this Privacy Policy to ensure they are notified of any updates. If necessary, we may notify users by email of changes to this Privacy Policy.

Complaints

If you have any complaints about how we process your personal data, please contact us through the details in the Contact Information section below so that we can, where possible, resolve the issue directly.

If you are located in Australia and feel we have not addressed your concern satisfactorily, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC). If you are located in the European Union or United Kingdom and this Privacy Policy's GDPR provisions apply to you, you may instead contact your local supervisory authority, such as the UK's Information Commissioner's Office.

Contact Information

If you have any questions, concerns, or complaints, you can contact our privacy officer, Dr Jessica Hodgson, at: