GDPR privacy notice

01The controller

Codian Limited is the controller of the personal data described here. We are a company registered in England and Wales (company number 16333262), with our registered office at Suite 8791, 5 Brayford Square, London E1 0SG, United Kingdom, and we are registered with the Information Commissioner's Office (ICO) under ZC084234.

To reach us about your data, write to [email protected].

For the business data a company enters in Coudy, that company is the controller and Codian acts as its processor under the Data Processing Agreement. If your data is in a company's Coudy (as its customer or employee, for example), please contact that company first.

02The data we process

• Identity and contact data: name, company, e-mail address, phone number.
• Request and meeting data: what you asked for, your topic and message, your kind of business and your answers to our questions, the meeting time and format or the call-back time you chose, and meeting notes.
• Customer data: the details of a customer company and its representatives for the contract, quotes and invoicing.
• Marketing preference: whether you agreed to receive news and offers by e-mail.
• Technical and security data: a salted, irreversible digest of your IP address, the page a form was sent from and any campaign tags (utm), and the technical data Cloudflare processes to protect the site.
• Site use (only with your consent): what Google Analytics collects — the pages visited, how long the visit lasts, rough location, device and browser type, a cookie identifier — and whether the form was sent, with the request type and product chosen.

03Purposes and legal bases

• Answering your request, arranging a demo or a meeting and preparing a quote: steps taken at your request before entering into a contract (Art. 6(1)(b)).
• Providing, maintaining and supporting the Coudy service: performance of a contract (Art. 6(1)(b)).
• Keeping tax and accounting records: compliance with a legal obligation (Art. 6(1)(c)).
• Protecting the site and its forms against abuse and automated sends: our legitimate interest in keeping the service secure, which we balance against your rights (Art. 6(1)(f)).
• Measuring how the site is used and improving it (Google Analytics): the consent you give on the cookie card (Art. 6(1)(a)) and the cookie rules (PECR in the UK, the ePrivacy rules in the EU). You can withdraw it through "Cookie settings" at the foot of every page.
• Sending news and offers by e-mail: your consent (Art. 6(1)(a)), together with the rules on electronic marketing (PECR in the UK and the ePrivacy rules in the EU). You can withdraw it at any time, from the link in every e-mail or by writing to [email protected]; withdrawing doesn't affect what was done before.

04Where the data comes from

Almost all of it comes from you: through the contact flow on coudy.app, in our meetings and when you become a customer. Technical data, and site use data if you consented, comes from your browser when you use the site.

05Recipients

We don't sell your personal data or share it for advertising. We share it only with processors who work for us, under written contracts, and only as far as needed:

• Hosting: Codian's servers in data centres in the European Union (OVHcloud and AWS), where the site, form and meeting records and Coudy's licence and telemetry service run.
• Cloudflare, Inc. (USA): the site's network and form security (Turnstile).
• Google Ireland Limited (processor) and Google LLC (USA): measuring how the site is used, only if you consented (Google Analytics). Google signals and sharing for advertising are off; what you type into the forms is never sent to Google.
• An e-mail delivery service: to deliver your request to us and our confirmation e-mails to you.
• Professional advisers and public authorities: only when the law requires it or to establish or defend legal claims.

06International transfers

• Between the United Kingdom and the European Union: the UK and the EU each recognise the other's data protection as adequate, so data moves between our UK company and our EU servers under those adequacy decisions.
• To the United States (Cloudflare and Google): on the basis of the EU–US Data Privacy Framework and its UK Extension where the provider is certified, or otherwise the standard contractual clauses approved by the European Commission and the UK's International Data Transfer Addendum.
• Coudy business data: it stays in Turkey, on the customer's own server or on a server rented from a Tier III data centre in Turkey; only telemetry, which carries no personal data, leaves the country. For customers in the UK or the EU, the Data Processing Agreement sets out the safeguards for this hosting.

07Retention

• Form requests and meeting records: at most 2 years after the request is settled, then deleted or anonymised.
• The digest of your IP address: 1 day at most.
• Google Analytics data: at most 14 months at Google; its cookies 13 months in your browser.
• Customer contract and invoicing records: for as long as tax and company law requires.
• Marketing consent: until you withdraw it.

08Your rights

You have the right to:

• access your personal data and receive a copy of it;
• have inaccurate data corrected and incomplete data completed;
• have your data erased where there is no longer a reason to keep it;
• restrict how we process it;
• receive the data you gave us in a structured, machine-readable form and have it sent to someone else (portability);
• object to processing based on our legitimate interests, and object at any time to direct marketing;
• withdraw your consent at any time;
• not be subject to a decision based solely on automated processing that significantly affects you; we make no such decisions.

09How to use your rights and complain

Write to [email protected]. We answer within one month, free of charge; for complex requests we may extend this by up to two more months and will tell you why. We may ask you to confirm who you are.

You can complain to the Information Commissioner's Office in the UK (ico.org.uk) or to the data protection authority of the EU country where you live or work. We'd appreciate the chance to sort it out with you first.

10Cookies, children and changes

• Cookies: the site uses essential cookies and, only with your consent, Google Analytics cookies; there are no advertising or tracking cookies. The Cookie Policy has the details.
• Children: coudy.app and Coudy are meant for businesses; we don't knowingly collect data from anyone under 18.
• Changes: if we change this notice we publish the new version here and tell our customers about important changes by e-mail.