Privacy & data use

CoreGrowth is the public-facing brand. The legal data controller’s name, registered address and dedicated privacy contact must be confirmed. Until then, use the Talk to CoreGrowth page to raise a privacy question without including sensitive information. This draft is not a verified statement of all current processing arrangements.

The enquiry form collects your name, work email, company, job title, phone number, request type and message, where supplied. It also sends any HubSpot portal reference, referral source and campaign attribution parameters included in the page address. The support form collects name, work email, company, support topic and message. Both include a spam-protection field.

These submissions are sent to our configured enquiry-processing service so the team can respond. Hosting and connected services may process technical information such as IP addresses, browser details and request logs; the actual providers, logging practices and retention must be verified. Required form fields are needed to identify and respond to a request; other fields are optional.

The intended purposes are responding to enquiries, arranging demonstrations, providing support, preparing and delivering agreed services, preventing misuse and maintaining business records. Appropriate lawful bases must be confirmed for each activity: steps at an individual’s request before a contract, legitimate interests in handling business enquiries and security, and legal obligations for statutory records, as applicable.

Submitting an enquiry does not automatically subscribe you to marketing or provide consent for unrelated uses. Any electronic marketing must have a lawful basis and comply with applicable marketing rules, with a clear way to object or unsubscribe. Where processing relies on consent, you can withdraw it without affecting earlier lawful processing.

Connecting CoreSuite HS to a client portal is separate from browsing this website. The client must authorise access and determine the permitted objects, properties, users and purposes. Controller and processor roles, processing instructions, categories of data and individuals, retention, security, approved subprocessors and deletion arrangements must be documented in the service agreement and data processing agreement before client data is processed.

The service commitment is that client data is isolated by tenant and is not used to train general-purpose AI models. Approved AI processing for delivering the client service is distinct from model training; provider terms and technical settings must support that commitment. AI actions require human review and approval. Do not connect a portal on the strength of this website notice alone.

Information may need to be accessed by authorised staff and contracted providers of hosting, enquiry handling, CRM, support, security or approved AI processing, only for the relevant purpose. Disclosure may also be necessary to professional advisers or public authorities where required by law. The actual recipients, provider roles and processing locations must be confirmed before this notice is finalised.

Any transfer outside the UK must meet applicable data protection requirements, such as an adequacy decision or appropriate contractual safeguards and required assessments. Do not assume information remains in the UK: the actual locations and safeguards have not been verified for this draft. Details and copies of applicable safeguards should be available from the confirmed privacy contact.

Information should be kept only as long as needed for the stated purpose, applicable legal requirements or the establishment, exercise or defence of legal claims. Specific enquiry, support, log and client-data retention periods, or meaningful criteria for determining them, must be confirmed; this draft does not promise an unverified deletion schedule.

Appropriate access controls, confidentiality duties and security measures should protect personal information. No online transmission is entirely risk-free. Do not send credentials or unnecessary sensitive information in public forms. Client-data return and deletion, incident handling and backup treatment must be agreed separately.

Subject to applicable conditions, you may request access, correction, erasure, restriction or portability of your personal data, and object to processing, including direct marketing. You may also withdraw consent where consent is the lawful basis. Requests may require proportionate identity verification and will be handled within applicable legal time limits.

You can complain to the UK Information Commissioner’s Office at ico.org.uk, or your relevant supervisory authority. You do not have to contact us first. For client CRM data, contact the client as controller; we should assist it under the agreed processing arrangements. No legally or similarly significant solely automated decision-making is intended in handling website enquiries; any different actual practice must be disclosed before adoption.

This website uses remotely hosted fonts and media, which can result in browser requests to their providers. Hosting or platform services may also set cookies or use browser storage. A complete inventory of actual cookies, similar technologies, providers, purposes and lifetimes must be verified; this draft does not claim the site is cookie-free.

Non-essential cookies or similar tracking must not be activated without the consent required by applicable law. This page is not a consent mechanism. The cookie inventory and any necessary consent controls must be completed before such tracking is used. Updates to this notice will be dated and material changes communicated where required.