How I handle your data.

Plain English. No legalese unless it's necessary. If you have a question, email me.

Last updated: 4 June 2026

01Who I am

This is the privacy policy for Wingman Executive, the trading brand of Executive Wingman Human Resources Consultancies - FZE, a free-zone company registered in Dubai, United Arab Emirates, managed by Paul Littlejohn. The website is wingmanexecutive.com. Contact: [email protected].

Executive Wingman Human Resources Consultancies - FZE is the data controller for any personal information collected through this site or through my advisory work.

02What I collect

I keep this minimal. I collect:

• Your email address when you sign up for the workbook, the newsletter, or any free resource.
• Your name and email address when you book a paid session or engagement.
• Payment information (handled and stored by Stripe, not by me) when you buy a product.
• Information you share in pre-session questionnaires or during sessions, including details of your situation, decisions, and context.
• Site analytics (pages you visit, how you arrived, your approximate location, your device and browser type) collected through Google Analytics.
• Behavioural data (clicks, scrolls, mouse movement, and anonymised recordings of how pages are used) collected through Microsoft Clarity. Text you type and sensitive fields are masked, so I don't see what you enter.

I do not collect special category data (such as health, religion, or political beliefs) unless you choose to share it during a session, in which case it's covered by the same confidentiality terms as everything else.

03Why I collect it

• To send you the resources you've asked for.
• To deliver the products and services you've paid for.
• To send you occasional emails about my work, if you've opted in.
• To process payments through Stripe.
• To understand how the site is used, and where it's confusing, so I can improve it.

04What I don't do

I don't sell your data. I don't share it with advertisers. I don't pass it to third parties for their own marketing purposes, and I don't build advertising profiles of you myself.

One honest caveat: the analytics tools I use (Google Analytics and Microsoft Clarity) collect data through your browser and process it under their own privacy terms. Google and Microsoft may use what they collect for their own purposes, which in Microsoft's case can include advertising. I've linked both of their privacy statements in section 05 so you can read exactly what they do with it.

If I ever change any of this, I'll update this policy and tell you directly.

05The tools I use

To run the business, I use the following services. Each one processes some of your data on my behalf and has its own privacy practices:

• GoHighLevel: my CRM and email platform. Stores your name, email, and any tags relevant to how you came in (e.g. workbook download, course buyer, session booker).
• Stripe: payment processing. Handles your payment details directly. I never see your full card information.
• Google Workspace: for email correspondence and documents.
• Calendly or equivalent: for booking sessions.
• Google Analytics (GA4): to understand which pages people visit and how they get there. GA4 doesn't store your full IP address; it uses it briefly to estimate your approximate location (city level), then discards it. It doesn't collect your name or email. More detail in Google's privacy policy.
• Microsoft Clarity: a session-replay and heatmap tool that shows how visitors click, scroll, and move around the site, so I can find what's confusing and fix it. Recordings are masked, so I don't see what you type into forms. The data is stored by Microsoft on the Azure cloud, and Microsoft may also use it for its own purposes, including advertising. More detail in the Microsoft Privacy Statement.

06How long I keep it

Email subscribers: as long as you remain subscribed. You can unsubscribe at any time using the link at the bottom of every email.

Clients: I keep records of your engagement (questionnaire, written plan, correspondence) for up to 7 years after the engagement ends, in case we work together again or for tax and accounting purposes. After that, records are deleted unless you ask me to keep them longer.

Payment records: as required by relevant tax law, typically 5 to 7 years.

Analytics data: Google Analytics and Microsoft Clarity hold the data they collect under their own retention schedules. Clarity typically keeps session data for up to 13 months and then deletes it. Google Analytics retention is set to the shortest practical period.

07Confidentiality

Everything you share with me before, during, or after a paid session is confidential. I won't name you, your organisation, or any identifying details of your situation in any public material (content, talks, writing, or otherwise) without your written permission.

I may reference anonymised, non-identifying examples in my teaching and writing. If a description of a situation is specific enough that you might recognise yourself in it, I will have asked first or changed the details enough that no one else could identify you.

I sometimes use AI tools (such as Claude and ChatGPT) to help with drafting, editing, and admin. I don't put your name, your organisation, or any identifying detail of your situation into them. Anything client-related is anonymised before it goes anywhere near a tool like this, so nothing that could identify you is shared with a third-party AI service.

08Your rights

Wherever you live, you have the right to:

• Ask me what data I hold about you.
• Ask me to correct anything that's wrong.
• Ask me to delete your data (subject to anything I'm legally required to keep).
• Ask me to stop sending you marketing emails.
• Take a copy of your data with you to another service.
• Object to how I'm using your data.

To exercise any of these rights, email me at [email protected]. I'll respond within 30 days.

09Where your data is held

The tools I use are based in different countries, including the United States and the European Union. By using this site, you accept that your data may be stored or processed outside the UAE or your home country. The providers I use offer appropriate safeguards (such as Standard Contractual Clauses) for international data transfers.

10Cookies and analytics

This site uses a small number of cookies and similar technologies. Some are essential: they make the site work. Others are set by Google Analytics and Microsoft Clarity so I can see which pages get visited and how the site is actually used. These are analytics and tracking technologies. I don't set advertising cookies of my own, though, as noted in section 04, Google and Microsoft may use what their tools collect for their own purposes.

If you're visiting from the European Economic Area, the UK, or Switzerland, the non-essential analytics cookies only load after you've given consent. You can change or withdraw that choice at any time, and you can disable non-essential cookies through your browser settings, without affecting the site's core functionality.

11Children

This site is intended for adults. I don't knowingly collect data from anyone under 18. If you believe I've inadvertently collected data from a minor, contact me and I'll delete it.

12Changes to this policy

If I make material changes to this policy, I'll update the date at the top and, where appropriate, notify you by email.