Privacy policy

Last updated 7 September 2026. We are keyperformanceindicators.com, an independent publisher writing about EOS® and business KPIs. You can reach us any time at [email protected].

The short version: reading the site is anonymous apart from ordinary server logs, one first-party cookie that remembers how you found us, and a record of the cookie choice you made. If you fill in the contact form we keep what you typed, plus your IP address and a rough location worked out from it, so we can reply to you and keep spam out. We do not sell anything about you to anybody.

What we collect when you are just reading

Like any website, our server and the hosting in front of it record ordinary requests: the page asked for, the time, the IP address it came from, and the browser user agent your device sends with every request. That is how the web works, and it is how we notice a scraper hammering the site. We do not go looking through those logs to work out who you are.

We set a first-party cookie called kpi_attr after you accept. If you are reading from outside the EEA, the UK and Switzerland, we set it on your first visit without asking. It records the page you landed on, the site that referred you, and any campaign tags in the link (the utm_ parameters and a Google click id if one is present). We write it once and never update it, so it holds first-touch information only.

The cookie is HTTP-only, so page scripts cannot read it. It carries a signature, so a tampered value is thrown away rather than trusted. It expires after 30 days. No third party sets it and no third party can read it.

We may use Google Analytics 4 to see which pages bring in enquiries. When it is on, Google sets its own cookies (_ga and one named after our property) and receives the addresses of the pages you look at along with anonymised usage data. We never send it your name, your email address, or anything you typed into the form. When you reach the thank-you page after submitting the form, we send Google one event saying an enquiry happened and which category it was, such as looking for an implementer. That event carries no name, email or message either.

We only enable Analytics in the configuration where Google anonymises IP addresses, and we deliberately keep it off the administration area, whose page addresses contain lead identifiers. We do not run any other third-party analytics, and we do not run advertising or retargeting pixels or switch on Google's advertising and audience features.

What we collect when you send the contact form

Whatever you type into the form. Depending on which questions you answer that is your name, email address, phone number, company, rough company size, industry, location, what you are trying to fix, your timeline, and your message.

Alongside it we store:

• your IP address;
• an approximate location worked out from that IP address (country, region, city, and the coordinates of that city, not of you);
• the user agent string your browser sends, which names the browser and operating system;
• the referring page, the page you first landed on, and any campaign tags, read back from the kpi_attr cookie;
• a few automatic checks on the email address you gave us, such as whether the domain can receive mail and whether it belongs to a known throwaway-address service;
• a priority score we work out from your answers, and an identifier for which version of the form you filled in.

Submitting the form also writes a short-lived counter keyed on your IP address, and another keyed on a one-way hash of your email address, so that nobody can send the form fifty times in an hour. Those counters hold no other information and are deleted after two days.

The location lookup happens on our own server against a copy of the MaxMind GeoLite2 City database that sits on the same machine, so your IP address is not sent to a geolocation service to do it. If that lookup comes up empty, we fall back to the approximate location headers our hosting or CDN provider has already attached to the request, which means that provider has resolved the address on its own side as part of delivering the page to you.

Why we collect it

Mostly to answer you. If you ask us to point you at an implementer, your country and rough location decide who is even worth suggesting, and your phone number decides whether we call or write.

The rest of it keeps the form usable. A public contact form collects automated rubbish, and the IP address, the user agent, how fast the form came back and the checks on the email address are how we tell a real enquiry from a bot. Knowing which page an enquiry came from also tells us which pages are worth writing more of.

That is the whole of it. We are not building a sales profile of you out of your reading, and nothing here goes to an advertising network.

Our legal grounds

If the UK or EU rules apply to you, we rely on your consent for the part that matters most: you filled in a form asking us to get in touch, and you can withdraw that at any time by telling us to stop. For the anti-spam checks and the basic server logging we rely on legitimate interests, because a public contact form that nobody defends stops working within a week.

How long we keep it

We keep the details of your enquiry for as long as they are useful for helping you, and we delete them sooner if you ask.

The IP address, the city, and the coordinates derived from it are removed automatically 12 months after you submit the form. That is not a promise we keep by hand: a cleanup job runs on the server every few minutes and blanks those fields on any enquiry past the deadline. A coarse country, region and time zone can stay attached to the enquiry after that, because they tell us nothing about you individually and they are what we use to route a request.

Ask us and we will remove any of it before the 12 months are up.

Who else sees it

• SMTP2GO delivers our email. The notification we send ourselves and the confirmation we send you both pass through it, so it handles your name, your email address and your message in transit.
• An EOS implementer or coach, but only when you have asked us for an introduction, and only the one we are introducing you to. We do not circulate enquiries to a panel of people hoping somebody bites.
• Google, when Analytics is switched on, and only the page addresses and anonymised usage described above. Google never receives the contents of an enquiry.
• Our own hosting, which stores the database the enquiry sits in.

That is the whole list. We do not sell, rent or trade personal information, and we do not hand it to advertising networks or data brokers.

Cookies we set

• kpi_consent, 12 months. Records the choice: accepted, essential only, or set for you without asking where the rules do not require a prompt. The page reads this cookie to check whether Analytics may load. It holds no personal data.
• kpi_attr, 30 days. Set after you accept, or without a prompt where the rules do not require one. Remembers the page and campaign you first arrived through so we can tell which pages bring in real enquiries. First-party, HTTP-only, signed.
• _ga and _ga_<property>, set by Google Analytics when it is switched on, to count visits and sessions. These are Google's cookies, governed by Google's own policies, and they last up to two years unless you clear them.
• A session cookie for the administration area, which only exists for the handful of people who log in to run the site. If you are reading the site you never receive one.

We do not set advertising or retargeting cookies. Readers in the EEA, the UK and Switzerland see a bar at the foot of the page on their first visit. It has two buttons of equal weight: Accept, or Essential only. Until you press one of them, only the cookies the site cannot work without will run. Everywhere else, Analytics and the attribution cookie start without a prompt. Either way, you can change your mind whenever you like. Cookie settings in the footer brings the bar back.

Your rights

Email [email protected] and we will act on it. You can ask for a copy of what we hold about you, ask us to correct it, ask us to delete it, ask us to stop contacting you, or ask which implementer we passed an introduction to. We aim to answer within a few working days and always within a month.

You do not need to give a reason and we will not make you argue for it.

Children

This site is written for people running companies. It is not aimed at children and we do not knowingly collect anything from anyone under 16.

Changes to this page

When we change how we handle data we update this page and change the date at the top. If a change is significant, and we are still in touch with you, we will tell you rather than rely on you rereading it.