Legal

Privacy policy

How Cartmill & Cartmill Advisory LLC handles personal information on cartmilland.com and tullya.co.

Effective 4 August 2026. Last updated 4 August 2026.

1. Who we are, and what this notice covers

   Cartmill & Cartmill Advisory LLC (“we”, “us”) publishes this website. We are the controller of the personal information described here for the purposes of the UK and EU General Data Protection Regulation, and the business that collects it for the purposes of the California Consumer Privacy Act as amended by the California Privacy Rights Act.

   This notice covers two websites: cartmilland.com and tullya.co. They are run by the same legal entity, their contact forms feed the same customer relationship management system, and they share a single analytics property. If you arrived here from tullya.co, this notice applies to you.

   The contact route for anything in this notice is explore@cartmilland.com. If you came to us through tullya.co you can use contact@tullya.co instead — both reach the same business. We publish an email address rather than a postal one; if you need to write to us on paper, ask and we will tell you where to send it.

   This notice covers these websites. If we go on to work with you under a separate written agreement, any additional privacy terms will be set out in that agreement.

2. The short version

   • There are no accounts, logins or payments on either site. They are sets of static files — there is no application server and no database of ours behind them.
   • The only information you actively give us is what you type into the contact form.
   • Everything else is analytics, and it sits behind the cookie banner you see on your first visit. You can change your mind at any time.
   • Resource PDFs download directly. You never have to fill in a form to get one.
   • We do not sell your information for money. Where you allow advertising cookies, some of what analytics collects can reach Google’s advertising systems — which US privacy law may treat as “sharing”. Declining in the banner is the opt-out.

3. What we collect

   Information you give us. The contact page embeds a form provided by HubSpot, our customer relationship management (CRM) system. It asks for your name, company, email address and role; optionally your website and team size; a message; and the type of inquiry (Tullya Early Access, Product Walkthrough, Advisory Services, Partnership, Media Inquiry, Other). If the form cannot load, the page shows an email address instead and the same information reaches us by email.

   Information collected automatically. Subject to your cookie choice, third-party analytics scripts run in your browser. They see what an ordinary web request exposes: the pages you view, the page that referred you, an approximate location derived from your IP address, and your device, browser and operating system.

   Anti-abuse signals. When you submit the contact form, Google reCAPTCHA collects device and interaction signals in order to tell a person from an automated script. See Who receives your information.

   A preference stored on your device. The site stores one first-party value in your browser: a theme entry in local storage, remembering whether you chose the light or dark appearance. It is a preference, it is not sent anywhere, and it is not used to identify you.

   In the categories used by California law, that is: identifiers (name, email address, IP address); professional or employment-related information (company, role, team size); internet or other electronic network activity information (pages viewed, referring page, device and browser); approximate geolocation derived from an IP address; and the contents of any message you choose to write.

   We do not ask for sensitive personal information and we do not want it. Please do not put it in the message field — there is no reason to, and we cannot control what you type before it reaches us.

4. Why we process it, and our legal basis

   Under the UK and EU GDPR every purpose needs a lawful basis. This is ours, purpose by purpose.

   Why we process it	What we use	Legal basis
   Replying to your enquiry and keeping a record of it	Name, company, email, role, optional website and team size, inquiry type, your message	Steps taken at your request before entering into a contract where your enquiry is about a possible engagement (Art. 6(1)(b)); otherwise our legitimate interest in responding to a business enquiry addressed to us (Art. 6(1)(f))
   Understanding which pages and resources are useful	Analytics data — pages viewed, referrer, approximate location, device and browser	Your consent (Art. 6(1)(a)), given through the cookie banner, and consent for the storage on your device
   Advertising measurement, where you allow it	The same analytics data, with advertising identifiers enabled	Your consent (Art. 6(1)(a)), given through the cookie banner
   Stopping automated abuse of the contact form	Device and interaction signals collected by reCAPTCHA at the moment you submit	Our legitimate interest in keeping our only contact route usable and free of spam (Art. 6(1)(f))
   Serving and securing the site itself	The network request needed to deliver a page to you, including your IP address	Our legitimate interest in operating a working, secure website (Art. 6(1)(f))
   Remembering your light or dark appearance choice	A theme value in your browser’s local storage	Strictly necessary to provide the feature you asked for; not used to identify you
   Meeting a legal obligation, or defending a legal claim	Whatever is relevant to the obligation or the claim	Legal obligation (Art. 6(1)(c)) or our legitimate interest in establishing or defending legal claims (Art. 6(1)(f))

   You do not have to give us any of this. There is no statutory or contractual requirement to provide personal information to us, and you are not obliged to provide any in order to read either site or to download a resource. The contact form is entirely optional. The only consequence of not completing it is that we have no way to reply to you.

   Where we rely on legitimate interests, we have considered whether our interest is overridden by your rights, and you can object at any time — see Your rights over your information.

   We do not use automated processing to make decisions about you that produce legal effects or similarly significantly affect you. reCAPTCHA scores form submissions to distinguish people from automated scripts, and a low score can cause a submission to be rejected; if that happens you can always email us directly instead.

5. Cookies, consent, and withdrawing consent

   Both sites load a cookie consent banner provided by HubSpot. Your choice there is passed to Google Consent Mode, which controls whether analytics and advertising storage are allowed, and it is also what would enable session analytics.

   Before you choose: for visitors whose browser resolves to the European Economic Area, the United Kingdom or Switzerland, analytics and advertising storage start denied — Google Analytics runs in a cookieless mode that measures without setting identifying cookies, until you consent. Outside those countries that storage is not denied by default.

   You can withdraw your consent at any time, and it is as easy to withdraw as it was to give. Use the cookie banner’s controls to change your decision: the site relays every decision to Google, including a withdrawal, which switches analytics and advertising storage back to denied. You can also block or delete cookies for this site in your browser at any time, and you can email us at explore@cartmilland.com if you would rather we dealt with it. Withdrawing consent does not make what we did beforehand unlawful, and nothing on either site stops working if you decline.

   The individual cookies set are HubSpot’s, Google’s and — were it ever enabled — Microsoft’s, and their names and lifetimes change with each vendor release. Rather than publish a list that goes stale without anyone noticing, we name every provider and what it does in Who receives your information; each of those providers publishes and maintains its own cookie documentation. Ask us at explore@cartmilland.com if you want us to walk you through what is set on a particular page.

6. Who receives your information

   These are the third parties that receive personal information when you use either site. They process it on our behalf, or — where they determine their own purposes, as Google does for advertising — as recipients in their own right.

   • HubSpot — our CRM, and the same portal for both sites (each site has its own form). HubSpot provides the contact form, the cookie consent banner and its own website analytics, all of which load on every page. Contact form submissions go to HubSpot directly from your browser — they do not pass through a server we operate — and are stored there. Our HubSpot instance is configured in HubSpot’s North America region.
   • Google Analytics 4 (Google) — website analytics. It loads on every page of both sites, which share a single Google Analytics property, and what it is allowed to store is governed by your consent choice. Where you allow advertising storage in the cookie banner, Google Analytics is granted advertising permissions — advertising storage, the use of advertising data, and advertising personalisation — and Google may then use what it collects here for advertising purposes, including personalised advertising. That is what the advertising permissions in the banner control, and declining them, or withdrawing later, switches them back off.
   • Google reCAPTCHA (Google) — bot protection on the contact form. It does not load when you open the page: HubSpot loads reCAPTCHA only at the moment you submit the form. At that point it collects device and interaction signals — such as your IP address, browser and device characteristics, and how you interacted with the page — and sends them to Google, which scores the submission to distinguish a person from an automated script. Google is a recipient of that information and processes it under its own terms.
   • Microsoft Clarity — session analytics, including session replay. Both sites are wired to load Clarity only after you allow analytics, but Clarity is not enabled and does not run today: no project ID is configured, so no Clarity script is served, no session is recorded and no Clarity cookie is set. If that ever changes, this notice will be updated before it does, not after.
   • Amazon Web Services — hosting. Both sites are served as static files from Amazon S3 through the Amazon CloudFront content delivery network, which handles your request — including your IP address — in order to deliver the page to you.

   Beyond these providers, we may disclose information to our professional advisers, or where we are legally required to, or where it is necessary to establish or defend a legal claim. We do not otherwise pass your information to anyone else.

   Each site sends a Content-Security-Policy that restricts which third parties can run scripts on the page or receive data from it, to the providers named here. Web fonts are self-hosted and served from the site’s own domain, so loading a page makes no request to a font provider.

7. Whether we sell or share your information

   We do not sell your personal information for money. We do not trade, rent or otherwise disclose it to data brokers, and we receive nothing of value in exchange for it.

   We do, however, treat the advertising side of analytics as “sharing”. Where you allow advertising cookies, Google Analytics is granted advertising permissions and the information it collects here can reach Google’s advertising systems. Under California law that may amount to “sharing” personal information for cross-context behavioural advertising — that is, using what you did on our site to target advertising to you elsewhere. We would rather disclose that plainly than argue it does not apply.

   How to opt out. Decline advertising cookies in the banner, or withdraw a choice you already made — see Cookies, consent, and withdrawing consent. That switches the advertising permissions off and stops the sharing. You can also email explore@cartmilland.com and ask us to opt you out. We will not treat you any differently for doing so; see Additional rights for California residents.

   We do not knowingly collect personal information from anyone under 16, and we do not knowingly sell or share it.

8. Where your information is processed

   Google, HubSpot, Microsoft and Amazon Web Services are United States companies operating globally, and our HubSpot instance is in HubSpot’s North America region. Using either site therefore means information about your visit can be processed in the United States and in other countries where those providers operate.

   Those countries may not give personal information the same legal protection as the United Kingdom or the European Economic Area. Where information is transferred out of the UK or the EEA, we rely on the transfer safeguards each provider makes available in its data processing terms. If you want to know which safeguard applies to a particular provider, email explore@cartmilland.com and we will tell you.

9. How long we keep it

   We keep personal information for as long as is necessary for the purposes described in this notice, and after that only for as long as the law requires us to, or for as long as we may need it to establish or defend a legal claim. In practice that means:

   • Enquiries. We keep what you send through the contact form for as long as we are dealing with your enquiry and for as long as we have an ongoing business relationship with you or your organisation. Where a conversation goes nowhere, we keep the record only so long as it is useful to know that the conversation happened.
   • Analytics. Analytics data is retained under the retention setting configured in the analytics provider’s own platform, after which it is deleted or retained only in aggregate form that does not identify anyone.
   • Cookies. Cookies expire on their own schedule, set by the provider that placed them. You can delete them from your browser at any point without waiting.

   You do not have to wait for any of these periods to run. Email explore@cartmilland.com and ask us to delete a record we hold about you, and we will — see How to make a request, and how long we take.

10. Your rights over your information

    If the UK or EU GDPR applies to our processing of your information, you have the following rights. They are free to exercise.

    • Access. Ask whether we hold information about you, and get a copy of it along with an explanation of what we do with it.
    • Rectification. Have inaccurate information corrected, and incomplete information completed.
    • Erasure. Ask us to delete information where there is no good reason for us to keep it.
    • Restriction. Ask us to pause what we do with your information — for example while you contest its accuracy, or while an objection is being considered — so that we store it but do nothing else with it.
    • Portability. Receive the information you gave us in a structured, commonly used, machine-readable format, and have it sent to another organisation where that is technically feasible.
    • Objection. Object to processing we base on legitimate interests, on grounds relating to your particular situation. If we cannot show compelling legitimate grounds that override your interests, we will stop. Where information is used for direct marketing, you can object at any time and we will stop, with no balancing test.
    • Withdrawing consent. Where we rely on your consent — analytics and advertising cookies — you can withdraw it at any time, as easily as you gave it. See Cookies, consent, and withdrawing consent for how. Withdrawal does not affect the lawfulness of what we did while the consent was in force.
    • Complaining to a regulator. You can lodge a complaint with the data protection supervisory authority in the country where you live, where you work, or where you believe the problem happened. You do not have to come to us first — though we would much rather you did, so we can put it right.

11. Additional rights for California residents

    If you are a California resident, you have the following rights under the CCPA as amended by the CPRA, in addition to everything described above.

    • The right to know. Ask what categories of personal information we collected about you, where it came from, why we collected it, the categories of third party we disclosed it to, and the specific pieces of information we hold.
    • The right to delete personal information we collected from you, subject to the exceptions the statute allows.
    • The right to correct inaccurate personal information we hold about you.
    • The right to opt out of the sale or sharing of your personal information. We do not sell it for money; we treat granting advertising cookies as “sharing”, and declining or withdrawing in the cookie banner is the opt-out. See Whether we sell or share your information.
    • The right to limit the use of sensitive personal information. We do not ask for sensitive personal information, do not use it to infer characteristics about you, and do not disclose it for any purpose that this right restricts. The right is yours regardless — email us and we will honour it.
    • The right not to be discriminated against for exercising any of these rights. We will not deny you anything, charge you a different price, or give you a lesser level of service because you asked.

    You can use an authorised agent to make a request on your behalf; we may ask for proof that you gave them permission.

12. How to make a request, and how long we take

    Email explore@cartmilland.com — or contact@tullya.co if you came to us through tullya.co. Tell us what you would like us to do and include enough detail for us to find your record: the email address you used, and roughly when you were in touch, is usually enough. We may need to take reasonable steps to check you are who you say you are before we act, particularly on a request to delete or to hand over a copy.

    How long we take. Under the UK and EU GDPR we will respond within one month. That can be extended by up to two further months where a request is complex or where there are several of them, and if we need to extend we will tell you within the first month and explain why. Under California law we will confirm receipt within 10 business days and respond substantively within 45 days, which can be extended by a further 45 days where reasonably necessary — again, we will tell you if that happens.

    If we cannot do what you asked, we will tell you why, and you can complain to a supervisory authority as described in Your rights over your information.

13. How we protect it

    Both sites are served over HTTPS only; plain HTTP requests are redirected and the sites send a strict transport security header. The storage the sites are served from is private and not publicly readable — content reaches you only through the content delivery network. Each site restricts which scripts are allowed to run, and does not permit itself to be embedded in a frame on another site.

    Information you submit through the contact form is held by HubSpot and is subject to HubSpot’s own security measures. No method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

14. Children

    These are business-to-business websites. They are not directed to children, we do not knowingly collect personal information from anyone under 16, and we do not knowingly sell or share it. If you believe a child has sent us personal information, email explore@cartmilland.com and we will delete it.

15. Changes to this notice

    When what these sites do changes — a new analytics provider, a different form, a different host — we update this page. The date at the top shows when it was last changed. Where a change materially affects how we use information you have already given us, we will take reasonable steps to tell you rather than relying on you noticing the date.

16. How to contact us

    Questions about this notice, about information we hold, or about a request you have made, go to explore@cartmilland.com — or contact@tullya.co if tullya.co is where you found us. You can also reach us through the contact page.