Privacy — CORD

CORD (“we”, “us”, “our”) protects and respects your privacy. This notice explains how we collect, use, and safeguard your personal data when you use this website, under the UK GDPR and the Data Protection Act 2018. We are the data controller for this data.

If you are a client, a creator or talent we work with, a supplier, or a job applicant, our Company Privacy Notice explains how we handle your data.

1. Who we are

Legal entity: Cord Entertainment Ltd, registered in England and Wales, company number 13208636
Privacy contact: hi@cord.xyz
Postal address: CORD, SH-003 (The Shed), 91 Brick Lane, London, E1 6QL
Registered office: 15 Grafton Road, Newport, NP19 0AS, Wales
ICO registration number: ZC175781

2. What we collect through this website

Case file requests. Your full name, work email, company, that you agreed to be contacted by CORD, which case study you requested, and when and from which page you requested it, along with basic technical details such as your browser type.
Tap In messages. Your name, email, company (if given), and your message, including, if you asked for access to a private case study, which one.
Introductions from our careers page. Your name, email, what you do, any link to your work or profile, what you’d bring to CORD, your CV if you attach one, and that you agreed we can keep your details.
How the site is used. We use Vercel Web Analytics to see anonymous, aggregated information such as pages viewed, referring sites, device type, and country. It does not use cookies and does not identify you. Our hosting provider also keeps standard server logs, which include IP addresses, for security and to keep the site running.
On your own device. Your browser remembers whether you switched CORD on or off and which case files you requested during your visit. This stays in your browser, is not sent to us, and is not used to track you. You can clear it at any time in your browser settings. We do not use advertising or tracking cookies.

Do you have to give us your details? No. But we can’t send you a case file, reply to your message, or consider your introduction without them.

3. How and why we use your data

Under the UK GDPR, we only process your data when we have a valid legal basis.

PurposeDataLawful basis

Sending you the case file you requested, and following up about itIdentity, ContactLegitimate interests (responding to a business enquiry)

Replying to Tap In messages and requests for access to private case studiesIdentity, Contact, CommunicationLegitimate interests (responding to a business enquiry)

Keeping your careers introduction (and CV, if attached) on file and contacting you about future rolesApplication dataYour consent (you can withdraw it at any time)

Understanding how the website is usedAnonymous usage dataLegitimate interests (improving the site)

Keeping the website secure and runningServer logs, including IP addressesLegitimate interests (security)

You can opt out of follow-up contact at any time by emailing hi@cord.xyz. Every message we send gives you a simple way to do this. We don’t make decisions about you by automated means alone.

4. Who processes your data

We never sell your data. Website data is processed securely using the following services:

Vercel: hosts this website and provides its anonymous analytics.
Resend: delivers the internal email that tells our team about a website enquiry or careers introduction.
Google Workspace: company email, where we reply to your enquiry.
Missive: shared inbox management for replying to enquiries.

International transfers. Some of these providers store data outside the UK (for example, in the US). We make sure they use approved safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, or are certified under the UK Extension to the EU-US Data Privacy Framework, so your data remains protected. Ask us if you’d like details.

Keeping it secure. We limit access to the people who need it, use two-factor authentication across our tools, and restrict access to financial details. If a data breach puts you at risk, we’ll tell you and, where required, the ICO.

5. How long we keep it

Website enquiries and case file requests: 24 months from our last contact, unless we go on to work together, when our Company Privacy Notice applies.
Introductions from our careers page (and any CV attached): 6 months from when you send it, then deleted unless you agree that we can keep it longer.
Server logs: kept by Vercel for a short period for security, then deleted.

6. Your rights

Under UK law, you have rights over your personal data, including to:

Access: request a copy of the personal data we hold about you.
Rectification: ask us to correct inaccurate or incomplete data.
Erasure: ask us to delete your data (subject to legal exceptions, such as HMRC record keeping).
Restriction and objection: ask us to limit how we use your data, or object to processing based on legitimate interests, including follow-up contact.
Portability: get a copy of data you gave us in a format you can reuse, where we hold it under a contract or your consent.
Withdraw consent: at any time, where we rely on it.

To exercise any right, email hi@cord.xyz. It’s free. We respond within one calendar month. If a request is complex, we may need up to two more months, and we’ll tell you why.

7. How to complain

If you have concerns about how we handle your data, please contact us first at hi@cord.xyz. We’ll acknowledge your complaint within 30 days and come back to you as quickly as we can.

You also have the right to complain at any time to the Information Commissioner’s Office (ICO), the UK data protection regulator, at ico.org.uk.

8. Changes to this notice

We may update this notice from time to time. The latest version will always be on this page, with the date at the top. If we make significant changes, we’ll let you know.