Privacy Policy

Real Treasury, LLC is an independent advisory firm for corporate treasury teams. This policy covers realtreasury.com. It describes what the website collects, who processes it on our behalf, and what you can ask us to do about it.

We do not sell your personal information, and we do not receive fees from technology vendors.

1. Information We Collect

Information you give us

• Contact form: first name, last name, email address, company, and the message you write.
• Newsletter signup: your email address, the page you signed up from, and the date and time you opted in. Alongside your email, we may also hold your name, company and role from our mailing list in our contact database.
• Gated content (the selection guide, Treasury Tech Portal access, webinar and workshop registrations): your name, work email, company, job title, and phone number where the form asks for it, along with your consent to be contacted.
• Guide feedback: your email address and the rating you give the selection guide, from the link in our follow-up email or the feedback page.
• Email and meetings: anything you send us directly, and the scheduling details if you book a call.

We do not operate user accounts on this website. There is no username or password to create, and we do not take payment through the site.

Information collected automatically

• Server and security data: your IP address, browser and device type, and the pages you request. Our CDN and firewall need these to serve the site and block abuse.
• Gated-form submissions: we store a one-way hash of the submitting IP address and browser user agent, not the raw values, to detect automated abuse of our forms.
• How you reached a gated page: when you submit a gated form, we record the campaign tags on the link you followed, the page you landed on, and the referring site’s domain with your submission, whether or not analytics cookies are on. If they are on, your browser also keeps this in session storage until you close the tab, so a form on a later page records where your visit started; if not, it is kept for the current page only.
• Analytics and marketing: pages viewed, time on page, referring source, the company your visit likely comes from, and whether you arrived from a LinkedIn ad — only while analytics and marketing cookies are on (see section 4). While they are off, Google Analytics still receives a cookieless signal for each page view (the page, your IP address, and browser type) with no cookie set.

2. How We Use It

Purpose	Legal basis (UK/EU GDPR)	Data used
Answer your enquiry and deliver what you asked for	Contract / steps taken at your request	Name, email, company, message
Send the newsletter you subscribed to	Consent	Email, signup source, consent record
Follow up on a guide download or portal request	Legitimate interest in responding to a business enquiry	Name, work email, company, job title, how you reached the page
Keep a record of who has been in touch with us so our follow-up is relevant	Legitimate interest in keeping track of our business contacts	Name, work email, company, role label, what you asked for or wrote and when, the page you used, and for gated content how you reached it
Learn whether the selection guide was useful	Legitimate interest in improving what we publish	Email, your rating
Keep the site up and block abuse	Legitimate interest in site security	IP address, user agent, hashed form metadata
Understand which pages get read	Outside the US: consent for analytics cookies and identified usage data; legitimate interest in counting page views for the cookieless signal Google Analytics sends before you choose. In the US: on by default, and you can turn them off at any time (section 4)	Analytics cookies and usage data
Meet legal and tax obligations	Legal obligation	Whatever the obligation requires

3. Who Processes Your Data

We are a small firm and we use third-party services to run the website and our email. Each of these acts on our instructions. They are:

Provider	What it does	What it sees
Automattic (WordPress.com, Jetpack)	Website hosting, image delivery, site search	Everything you submit through the site; IP address; search terms
Akismet (Automattic)	Spam filtering on the contact form	Your IP address, browser user agent, name, email and message
Cloudflare	Content delivery, firewall, and the Turnstile check on our forms	IP address, browser and device signals
Google (Analytics 4, Tag Manager)	Website analytics	Analytics cookies and identified usage data — only while analytics cookies are on. Otherwise, a cookieless signal per page view (page, IP address, browser type)
LinkedIn (Insight Tag)	Measures LinkedIn ads and builds LinkedIn ad audiences	Page visits and LinkedIn cookies — only while analytics cookies are on
Apollo.io	Identifies the company a site visit likely comes from	IP address and page visits — only while analytics cookies are on
Resend	Sends our newsletter and form confirmations	Your email address, delivery events, and which links in our emails you click
HubSpot	We use HubSpot to manage our contacts and understand how visitors use our site	Your contact details, your IP address and browser type when you use our guide feedback page, and, while analytics cookies are on, your visits to our site
Microsoft 365	Our email and document storage	Correspondence you send us

We may also disclose information where the law requires it — a court order, a lawful request from a public authority, or to establish or defend a legal claim.

We do not sell personal information. While analytics and marketing cookies are on, LinkedIn receives data about your visit that can be used to show you LinkedIn ads; under California law that can count as sharing for cross-context behavioral advertising. Rejecting, or later switching the cookies off, stops it.

4. Cookies

In the US, analytics and marketing cookies are on unless you turn them off in cookie settings or your browser sends a Global Privacy Control signal; elsewhere we ask first. Essential cookies — the ones that keep the site secure, filter form spam, remember your cookie choice, and record which country’s cookie rules apply — are always on, because the site does not work without them.

Our Cookie Policy lists every cookie we set and who sets it. You can change your mind at any time using the cookie preferences control.

5. How Long We Keep It

• Newsletter subscription: until you unsubscribe. After that we keep your address on a suppression list so we do not email you again.
• Gated-content and enquiry records, and other contact records in HubSpot (newsletter signups and guide feedback), including the pages you visited that are linked to them: three years from our last contact with you, then deleted.
• Email correspondence: retained as business records, normally seven years.
• Analytics data: Google Analytics retains user-level data for 14 months. Pages you visited that are not linked to a contact record in HubSpot are kept for 14 months, then deleted.
• Hashed form metadata: 12 months.
• Server and security logs: retained by our hosting and CDN providers under their own schedules, typically under 30 days.

6. Your Rights

Wherever you are, you can ask us to give you a copy of the personal information we hold about you, correct it, or delete it. You can unsubscribe from the newsletter using the link in any email, without asking us.

UK and EU (GDPR)

You have the right of access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests. Where we rely on consent, you can withdraw it at any time; that does not affect anything we did before you withdrew it. You may also complain to your national data protection authority.

California (CCPA/CPRA)

In the last 12 months we have collected the following categories of personal information: identifiers (name, email address, IP address), professional information (employer, job title, and a role label: the one you gave us, or our best judgement from your company), commercial information (what you requested from us), and internet activity (pages viewed; with analytics enabled, and as a cookieless page-view signal to Google Analytics when it is not). We collect it from you directly and from your use of the site, for the business purposes in section 2, and we disclose it to the service providers in section 3.

We have not sold personal information in the last 12 months, and we do not do so. In the last 12 months we have shared internet activity (pages viewed) with LinkedIn through the LinkedIn Insight Tag described in section 3, which can count as sharing for cross-context behavioral advertising. You can opt out of that sharing by rejecting analytics and marketing cookies, or switching them off later; a Global Privacy Control signal from your browser also opts you out. We do not collect sensitive personal information as the CPRA defines it, so there is nothing to limit the use of. You have the right to know, delete, correct, opt out of sharing, and to be free from retaliation for exercising those rights.

Making a request

Email [email protected]. We will acknowledge within 10 business days and respond within 30 days, or tell you why we need longer. We may ask you to confirm the email address the request relates to, so that we do not hand your data to someone else.

7. Security

The site runs over TLS. Form submissions go through a bot check before they reach us. Signing in to the systems holding enquiry records, including our contact database, is limited to the two principals of the firm, and those sign-ins are protected by multi-factor authentication. A small number of automated jobs on a server we control also read and update those records using access tokens rather than a sign-in. Our hosting, CDN and email providers maintain their own security programs and certifications.

We are a two-person firm and we would rather be accurate than impressive: we do not run a formal certified information security program of our own. No method of transmission or storage is completely secure.

8. Where Your Data Goes

We are based in the United States and our service providers process data in the United States. If you are in the UK or EEA, your information is transferred outside your country. Those transfers rely on the transfer mechanisms our providers have in place — principally the European Commission’s Standard Contractual Clauses and the UK Addendum, incorporated into each provider’s data processing terms, and the EU-US Data Privacy Framework where the provider is certified.

9. Children

This site is for treasury and finance professionals. It is not directed at children, and we do not knowingly collect information from anyone under 16. If you believe a child has given us personal information, email us and we will delete it.

10. Other Sites

We link to vendor websites, LinkedIn profiles, and other third-party pages. This policy does not cover them. Our Treasury Tech Portal shows information about technology vendors; visiting the portal does not share your details with any vendor unless you ask us to introduce you.

11. Changes

When we change this policy we update the “Last Updated” date above. If a change materially affects how we handle information you have already given us, we will tell subscribers by email and, where the law requires consent, ask for it.

12. Contact