Last updated 22 July 2026

Privacy Policy

Who I am

This website and the consulting practice behind it are operated by Vindispensable LLC, a New York limited liability company through which I, Daley Brennan, practice ("I", "me"). Vindispensable LLC is the data controller for all personal data described in this policy.

Postal address: 418 Broadway STE N, Albany, NY 12207. Email for privacy matters: privacy@daleybrennan.com. I am based in the United States. Where I process personal data of people in the European Union or the United Kingdom in connection with monitoring their professional activity or offering my services to them, the EU General Data Protection Regulation and the UK GDPR apply to that processing, and this policy is written to their standard.

The short version

I collect the details you send me when you ask about my services, book a call, or use the tools on this site, and I use them to reply and to do the work. Separately, as a working export consultant, I sometimes notice from public professional sources that a producer is at a moment where my help is relevant, and I write to them once, personally. I never sell data, never send automated marketing, and you can object at any time and I will stop.

Data I collect from you

When you submit the enquiry form: your name, email, role, brand or company, and the commercial details you choose to share (markets, pricing, volumes, an optional link to a tech sheet). When you unlock the price calculator or the state map: your email address and your browser's language. When you book a call: the details Cal.com needs to schedule it. I also keep a security and activity log of submissions (including automated or rejected ones), which records IP address and timestamps.

Data I collect about you from other sources (prospecting)

Part of my practice is noticing, from public professional sources, when a wine or spirits producer appears to be at a commercial turning point in which my work is relevant, for example a newly announced importer, the loss of a distributor, a first round of US label approvals, or a search for an export director. Where that happens, I may compile a short internal note about the business and, where identifiable, the professional responsible for exports or commercial strategy, and I may write to that person personally.

What I collect: name, professional role, business name, business contact details, and the public facts of the commercial signal, with its source. I do not collect private-life information, and I do not use data brokers or purchased lists.

Where it comes from:trade press and industry feeds, public press releases and news indexes, the public label-approval registry of the US Alcohol and Tobacco Tax and Trade Bureau (TTB), public job boards and recruiter listings, industry newsletters, and the business's own website or public exhibitor listings. Each note records its specific source.

Legal basis: Article 6(1)(f) GDPR, my legitimate interest as an independent consultant in making a small number of relevant, individually written introductions to businesses in my field. I have assessed this interest against your rights (summary available on request) and I limit it strictly: public professional data only, no automated sending, no profiling beyond a relevance score, and hard retention limits.

Your rights here: you may object at any time, without giving a reason, and I will stop immediately. Reply to any message from me, or write to privacy@daleybrennan.com. The first message I ever send you will say what prompted it, name the public source, and link to this policy. If I hold your data and have not contacted you within one month, I will either delete the note or provide this information to you directly, as Article 14 requires.

Why I process your data, and on what legal basis

I never sell personal data, never share it for advertising, and never send automated outbound email to prospects: every message to a prospect is written, reviewed, and sent personally by me.

Who receives your data

I use a small number of service providers ("processors") who handle data only on my instructions: Vercel (site hosting and privacy-preserving analytics, USA), Supabase (database hosting, Canada), Cloudflare (Turnstile human-verification on forms, USA/global), Cal.com (call scheduling, USA), IONOS (email sending, EU/USA), Anthropic (AI-assisted document preparation and research support, USA), Telegram (the messaging service through which I receive an instant alert, including your enquiry details, when you submit the form, USA/global), and Apple (iCloud Mail, to which my mailbox forwards, USA). I separately read an industry newsletter in a Google mailbox; that is a source I read, not a place your data is stored. I do not sell or rent personal data, and no third party receives it for its own marketing.

International transfers

I am in the United States, so data you send me is processed there. My database is hosted in Canada, which the European Commission recognises as providing adequate protection. For US providers, transfers rely on the EU-US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses in that provider's data-processing agreement. Details of the safeguard applying to any specific provider are available on request.

How long I keep it

Your rights

Under the GDPR/UK GDPR you may ask me to: access the personal data I hold about you (Art 15); correct it (Art 16); erase it (Art 17); restrict processing (Art 18); provide it in a portable format where processing rests on contract or consent (Art 20); and you may object to any processing based on legitimate interest (Art 21). For direct marketing, including prospecting, the right to object is absolute and I will stop without weighing anything against it.

To exercise any right, email privacy@daleybrennan.com from the address concerned, or from another address with enough information for me to find your data. I respond within one month. There is no charge. If I refuse a request, for example where I must keep a minimal do-not-contact record to honor your objection, I will say so and explain why.

A note on erasure: when you ask for erasure, I delete your data from my active files and database. If you have objected to outreach, I keep only the minimal do-not-contact record needed to make sure I do not approach you again. Any copies that remain in routine backups are not used in the ordinary course of business, and I remove your data from my working records when you ask.

Cookies and similar technologies

This site sets exactly one cookie: NEXT_LOCALE, which remembers whether you read the site in English or French. It stores only that choice and is read by no one but this site. The contact form uses Cloudflare Turnstile solely to check that a submission comes from a human; Cloudflare processes connection signals for that purpose and no other. I measure aggregate readership with Vercel Analytics, which sets no cookies, uses no cross-site identifiers, and shows me counts, not people; if you object to even this, an ad- or tracker-blocker will stop it and the site works identically. There is no advertising, no retargeting, and no sale of data here, which is why there is no cookie banner.

Security

I keep personal data in access-controlled systems, transmit it over encrypted connections, and limit who and what can reach it. No system is perfectly secure, but I take the measures appropriate to a small practice handling commercially sensitive data.

Changes and complaints

I will update this policy when my practice changes and will change the date at the top. You have the right to lodge a complaint with your supervisory authority; in France, the CNIL (3 Place de Fontenoy, 75007 Paris; cnil.fr); in the UK, the ICO (ico.org.uk).