Last updated: 8 December 2025

I take your privacy seriously and want you to understand what happens to your personal information when you visit my website, read my content, subscribe to my newsletter, attend an event or webinar I host or promote, or otherwise get in touch with me.

This Privacy Policy explains how I collect, use and protect personal information related to:

• visits to my website paulkrogdahl.com, ripoutthecore.com, noitbank.com and any subpages (the “Site”)
• newsletter subscriptions and other promotional communications
• events or webinars I organise or help to organise
• day-to-day communication and business relationships

For the purposes of applicable data protection law (including the EU General Data Protection Regulation, “GDPR”), I am the data controller for the personal information described in this Privacy Policy.

From time to time I may publish additional, more specific notices (for example for a particular event or campaign). Those should be read together with this Privacy Policy.

How I collect your personal information

1. Personal information collected through the Site

Contacting me via the Site

If you contact me using details or forms on the Site, you may share:

• identity information and contact details (for example your name and email address)
• professional details (for example your role, organisation and business area)
• any other information you choose to include in your message

I will use this information to respond to you and to follow up on the topic you contacted me about.

Cookies and analytics

The Site uses cookies and similar technologies:

• to remember your preferences (for example language and cookie settings), and
• if you allow analytics cookies, to help me understand how people use the Site so I can improve content and navigation.

A cookie is a small text file that a website stores on your device.

For more information on the cookies used on the Site and your choices, please refer to my Cookie Notice (which will be linked from the Site).

2. Newsletter, promotional communications and events

Newsletters and other marketing communications

If you subscribe to my newsletter or other updates, or if you are a contact at a potential or existing client, partner or vendor, I may collect:

• identity and contact details (for example name, email address, phone number)
• professional details (for example job title, organisation, business sector, organisation address)
• marketing history (for example which emails you received, whether you registered for or attended an event, and what you appeared to be interested in)

I use this information to:

• send newsletters and other updates you have asked for or that I think may be relevant to you
• understand whether my communications are useful and how to improve them

The information is collected either directly from you (for example when you subscribe via a form) or indirectly, for example through my own records of previous interactions or (where applicable) via business partners who help me run an event or campaign.

Registration and participation in events and webinars

If you register for, or take part in, an event or webinar that I organise or promote (sometimes together with partners), I may collect:

• identity and contact details (for example name, email address, phone number)
• professional details (for example job title, organisation, organisation address, business sector)
• information relevant to the event (for example dietary or allergy information if catering is involved, or transport details if I am helping organise travel; any information you choose to share in registration forms or during the event)

This information is collected directly from you or, where appropriate, from a partner involved in organising the event.

3. Business relationships and general communication

If you are a point of contact at a client, potential client, supplier, or other business partner, I may process:

• identity information, contact details and professional details (for example name, professional title, business email address, phone number, business address)
• information required to manage our interactions (for example project communications, meeting notes, orders, invoices, and related documentation)

I use this information to:

• communicate with you
• manage proposals, projects and deliveries
• handle accounting, invoicing and other routine business activities

Compliance and legal obligations

I may also process identification and contact information as needed to:

• comply with legal and regulatory requirements
• meet internal policy requirements
• prevent, assert, exercise or defend legal claims or resolve disputes

Why I use your personal information

To the extent permitted by applicable law, I use your personal information for purposes such as:

• Providing information, content and services To operate the Site and provide you with content, resources, newsletters, updates or information you have requested.
• Organising and managing events and webinars To send invitations, manage registrations and participation, and follow up (for example by sharing presentations or feedback surveys).
• Planning and improving content and services To carry out analytics and better understand how people use the Site and my content, so I can plan, develop and improve the Site, my communications and my services.
• Sending promotional communications To let you know about new posts, book updates, events, podcasts or services that I believe may interest you. These may be sent by email and, where appropriate, other similar communication channels. You can opt out of such communications at any time by following the unsubscribe link in the message or by contacting me.
• Compliance, security and risk management To prevent and detect unlawful behaviour, ensure compliance with applicable laws and internal policies, and protect or enforce my legal rights (for example in connection with disputes or regulatory requests).

Legal bases for processing your personal information

Under the GDPR, I must have a valid legal basis for processing your personal information. Depending on the situation, I rely on the following:

• Contractual necessity When processing is necessary to enter into or perform an agreement with you (for example when I provide services or respond to a specific request). If you do not provide the information requested, I may not be able to deliver the relevant product, service or information.
• Legitimate interests When processing is necessary for my legitimate interests, provided those interests are not overridden by your rights and freedoms. My legitimate interests include running and improving the Site, promoting and developing my work, communicating with contacts and managing risk.
• Consent In some cases, for example for certain types of marketing or when collecting special categories of personal data (such as dietary or allergy details for events), I may rely on your explicit consent. You can withdraw your consent at any time as described below.

In practice, this means:

• Providing requested information, services and support
  • Legal basis: contractual necessity; legitimate interests
• Organising and allowing participation in events and webinars
  • Legal basis: contractual necessity; legitimate interests; in some cases consent (for example if you share dietary or health-related information)
• Communicating important notices (such as changes to this Privacy Policy, service updates or critical information about events)
  • Legal basis: contractual necessity; legitimate interests
• Carrying out analytics to plan, develop and improve the Site, services and marketing activities
  • Legal basis: legitimate interests (improving the Site and understanding what content is useful)
• Sending newsletters and other promotional messages
  • Legal basis: legitimate interests and, where required by law, your consent You can opt out at any time by using the unsubscribe link in my emails or by contacting me.
• Preventing and detecting unlawful behaviour, ensuring compliance and protecting my legal rights
  • Legal basis: legitimate interests; compliance with legal obligations where applicable

Who may receive your personal information

I do not sell your personal information. However, I may share it with third parties in the following situations:

Service providers

I use trusted service providers to help me operate the Site and my communications, for example:

• website hosting and maintenance providers
• email and newsletter platforms
• analytics tools
• event or webinar platforms

These providers act on my instructions, are required to keep your personal information confidential, and may not use it for their own independent purposes.

Third parties for legal reasons

I may disclose personal information if required to do so by law, regulation or a court or governmental order, or where disclosure is reasonably necessary to:

• comply with legal obligations
• respond to requests from public authorities
• protect my rights or the rights of others
• support national security, law enforcement or other public interest matters, where legally required

Business partners

Where I co-host an event, webinar or campaign with a partner, I may share registration details (such as your name, contact information and organisation) with that partner for the purposes of organising and following up on the event.

Where I do this, I will make it clear in the event information or registration form.

Business transitions

In the unlikely event that I sell or transfer the Site or a significant part of my related activities, personal information may be transferred to the relevant third party as part of that transaction, subject to appropriate safeguards.

With your consent

In any other situation, I will only share your personal information with third parties when you have given your consent for me to do so.

International transfers

My service providers and business partners may be located in countries other than your own, including outside the European Economic Area (EEA). This means your personal information may be transferred to and processed in countries with different data protection standards.

Where personal information is transferred outside the EEA, I will take appropriate steps to ensure that an adequate level of protection is in place, for example by:

• relying on adequacy decisions of the European Commission, or
• using standard contractual clauses or other appropriate safeguards recognised by data protection law.

You can contact me if you would like more information about international transfers and the safeguards used.

How long I keep your personal information

I keep personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, and in line with applicable legal, regulatory, accounting and reporting requirements.

In particular:

• Newsletter and promotional communications I will use your contact details for newsletters and other promotional emails until you tell me you no longer wish to receive them. You can unsubscribe at any time using the link in my emails or by contacting me directly.
• Events and webinars Information gathered specifically for organising and managing an event or webinar will be kept for as long as needed to run the event and handle any follow-up (for example sharing slides or feedback surveys), and then retained only as long as required for legal or administrative purposes.
• Business relationship information Information relating to projects, proposals, invoices and other business communications is retained in line with applicable legal and tax requirements and my legitimate need to keep records.

How I protect your personal information

I take appropriate technical and organisational measures to protect your personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

These measures include, for example:

• using reputable hosting and email providers
• limiting access to personal information to those who need it for legitimate purposes
• maintaining security settings, updates and monitoring on the Site and supporting systems
• using secure connections where appropriate

No system can be guaranteed to be completely secure, but I aim to ensure an appropriate level of security based on the nature of the information and the risks involved.

Children’s privacy

The Site, my newsletter and my services are aimed at adults, particularly professionals working in or around financial services and technology. I do not knowingly collect or process personal information relating to children.

If you believe a child has provided me with personal information, please contact me so I can take appropriate steps.

Your rights

Under applicable data protection laws, you have a number of rights in relation to your personal information. These may include:

• Right of access You can request confirmation of whether I process your personal information and, if so, a copy of that information together with certain details about how it is used.
• Right to rectification You can ask me to correct inaccurate or incomplete personal information.
• Right to erasure (“right to be forgotten”) and restriction of processing In certain circumstances, you can ask me to delete your personal information or to restrict how I use it (for example where you believe it is inaccurate or no longer needed).
• Right to object You can object to certain types of processing, including processing based on legitimate interests. You always have the right to object to your personal information being used for direct marketing, and you can unsubscribe from marketing at any time. If you object or unsubscribe, I may keep limited information (such as your email address) to ensure I honour your request and do not contact you again for marketing.
• Right to withdraw consent Where I rely on your consent, you can withdraw it at any time. This will not affect the lawfulness of any processing carried out before you withdrew your consent. To withdraw your consent for promotional communications, you can use the unsubscribe link in the emails you receive from me or contact me directly.
• Right to data portability In some cases you may have the right to receive personal information you have provided to me in a structured, commonly used and machine-readable format, and to ask me to transfer it to another organisation where technically feasible.
• Right to lodge a complaint You have the right to lodge a complaint with a data protection supervisory authority if you are unhappy with how I handle your personal information. In Finland, this is the Office of the Data Protection Ombudsman.

If you wish to exercise any of these rights, please contact me using the details below. For your protection, I may need to verify your identity before acting on your request. I will respond as soon as reasonably practical and within the time limits set by law. I may refuse a request where the law permits me to do so and will explain why if that happens.

Links and third-party sites

The Site may contain links to other websites, including those operated by third parties. I am not responsible for the privacy practices, security or content of those sites.

If you follow a link to a third-party site, I encourage you to read that site’s own privacy notice before providing any personal information. I am also not responsible for opinions of third parties that may appear on or be linked from the Site.

Contact me

If you have any questions, concerns or complaints about how I handle your personal information, or if you wish to exercise your privacy rights, you can contact me at:

Email: paul@krogdahl.com

Changes to this Privacy Policy

I may update this Privacy Policy from time to time, for example to reflect changes in the law, my practices or the Site. Any updates will be posted on this page with a new “Last updated” date.

I encourage you to review this page periodically to stay informed about how I protect your personal information.