Privacy Notice

Last updated: 3 November 2026

1. Our privacy commitment

Your data remains yours. Colligere AI Analytics Limited (“We, Us, Our”) designs its websites, products and services around data minimisation, responsible use, appropriate security, transparency and human oversight. We do not sell personal data. Your data is not used to train AI models without your explicit authorisation, a lawful basis and appropriate safeguards.

2. Who we are

Colligere AI Analytics Limited is the controller of personal data collected through this corporate website, the Contact Us enquiry form and our direct business communications.

COLLIGERE AI ANALYTICS LIMITED
Registered in England and Wales
Company No. 17317855
Registered Office: 66 Paul Street, London, EC2A 4NA, United Kingdom
Registered with the Information Commission’s Office (ICO): ZC279705
Privacy contact: privacy@colligereai.com

3. Information We collect

We collect personal data directly from you when you submit forms or contact Us, automatically through your use of Our website where necessary to operate and protect it, and from organisations that engage with Us regarding Our services.

The Contact Us form collects your name, organisation, work email address, area of interest and enquiry message. It does not ask for a postal address or telephone number; you may choose to provide additional contact information in your message or later correspondence.

Purposes and legal bases for processing

Please do not submit participant, patient, financial, credential, authentication or other sensitive personal data through the public Contact Us form. If sensitive information is necessary for an engagement, We will agree an appropriate secure channel separately.

You are not required by law or by contract to give Us your personal data. We need your name, email address and message to reply to an enquiry; without them We cannot respond.

4. Why We use this information

We use enquiry information to respond to you, understand the problem or opportunity you describe, assess whether Colligere products or services may be relevant, assess potential projects, pilots or collaborations, plan appropriate follow-up, maintain business correspondence, develop and improve Our services and protect Our systems.

We may process limited technical information to operate and secure the website and prevent spam or abuse. If you switch on “Analytics” in the cookie settings, We also count how often each page is viewed, as daily totals that do not identify you, as explained in Our Cookie Notice.

Submitting the Contact Us form does not subscribe you to marketing. If you separately opt in to optional marketing, We may send occasional product news, research-data insights and related updates. You can withdraw consent at any time using the unsubscribe option in the email or by contacting privacy@colligereai.com. The current Contact Us form does not collect a marketing opt-in.

5. Our lawful bases

Under the UK GDPR (and the EU GDPR where it applies), We rely on legitimate interests to respond to business enquiries, administer prospective business relationships, understand demand, develop Our services, identify suitable project or pilot opportunities and secure Our website. These interests include running and improving Our business and providing relevant information to organisations that contact Us, balanced against your rights and expectations.

Where you specifically ask Us to take steps before entering into a contract with you, processing may also be necessary to respond to that request. We rely on consent for optional marketing where required by applicable law, on consent for optional page-view counting, and on legal obligations when handling applicable privacy requests or complying with other statutory requirements.

6. Customer, project and product data

If an organisation later engages Colligere to provide a product or service, the roles and responsibilities for customer, research, programme, participant or operational data will depend on the relevant engagement. Where a customer determines why and how personal data is processed, the customer will normally act as controller and Colligere will normally act as processor, subject to the applicable customer agreement and data processing terms.

Customers remain responsible for ensuring they have the authority, lawful basis, notices, consents or approvals required for data they choose to collect or process using Colligere products and services.

7. Data ownership and AI

You retain ownership rights in your data. We do not claim ownership of customer or participant data merely because it is processed through Our products or services. Your data is not used to train AI models without explicit authorisation, a lawful basis and appropriate safeguards. AI-assisted outputs remain subject to human review and customer control.

8. Service providers, subprocessors and infrastructure

We use carefully selected service providers to operate and secure Our website, communications, products and services.

• Amazon Web Services (AWS) runs Our own Contact Us form service in AWS’s London (UK) region. It receives your enquiry, stores it there in encrypted form and then sends a copy to Our business inbox by email. To limit spam and abuse, it keeps a short-lived counter identified by a keyed one-way code (hash) of your IP address; your IP address itself is not stored in Our enquiry records or form-service logs. If you switch on “Analytics”, AWS in London also runs Our separate page-view counting service, which receives the page address with each request and stores only daily totals per page, not your IP address or browser details.
• Google (Google Workspace) provides Our business email, where enquiries and related correspondence are received and kept. This includes the email copy of each Contact Us enquiry, which is kept separately from the copy in Our AWS form service.
• AWS Amplify Hosting serves the website’s pages, images and scripts. They are delivered through Amazon’s global content delivery network, so a page request may be answered by a server outside the UK, which receives your IP address and browser information in order to deliver the page.

We may also use providers for communications. Providers processing personal data on Our behalf are required to protect it appropriately and use it only for authorised purposes under applicable contractual arrangements.

Our production cloud infrastructure is planned to use Amazon Web Services (AWS) where appropriate. The public Contact Us form is a separate collection channel from any customer production platform. A current list of relevant production subprocessors will be maintained as Our services develop and made available to customers where appropriate.

9. International transfers and data residency

We select hosting locations and service providers with privacy, security and data-residency requirements in mind. Our Contact Us form service receives and stores submissions in AWS’s London (UK) region. AWS states that it will not move or replicate stored content outside the region We choose without Our agreement, except where necessary to provide the services We use or to comply with law or a binding order. Where personal data subject to the UK GDPR is transferred outside the UK by AWS as Our processor, for example for support or security, the UK GDPR Addendum to AWS’s Data Processing Addendum applies the UK Standard Contractual Clauses (the EU Standard Contractual Clauses as amended by the ICO’s International Data Transfer Addendum).

Not all processing takes place in the UK. The email copy of your enquiry is held in Our Google Workspace account, and emails there may be processed in the United States and other countries where Google operates; Google’s data processing terms for Google Workspace include terms that cover international transfers. Website pages are delivered through a global network, as explained in section 8.

Where We transfer personal data outside the UK, the applicable transfer arrangements may include:

• UK adequacy regulations: where the destination or relevant arrangement is recognised as providing adequate protection.
• Approved contractual safeguards: where required, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, together with any required transfer assessment and supplementary measures.

The appropriate safeguard depends on the provider and transfer concerned. You may contact Us at privacy@colligereai.com for information about the safeguards relevant to your personal data and how to obtain a copy, subject to appropriate redactions. Hosting and data-residency requirements for customer deployments may also be agreed separately.

10. Retention and deletion

We will keep your personal information only for as long as necessary to fulfil the purpose for which it was collected, or to meet legislative requirements. Personal information will be securely destroyed or put beyond use when it is no longer required, in accordance with Our data retention policy. In particular:

• Contact form records: Enquiries stored in Our AWS contact-form database are scheduled to expire 90 days after receipt. Expired records are automatically deleted through a background process, normally within a few days after expiry. Email copies and related correspondence are retained separately under the retention periods described below.
• Spam-prevention counters (the keyed code of your IP address): set to expire one hour after the end of the clock hour in which you sent an enquiry, then deleted automatically in the same way.
• Page-view totals (daily totals per page, containing no personal data): set to expire 90 days after the day counted, then deleted automatically in the same way.
• Technical logs of the form service: kept for 30 days. They record errors and enquiry reference numbers, not the content of enquiries.
• Enquiries and related correspondence in Our email and business records: reviewed 24 months after Our last meaningful contact with you, then deleted or anonymised unless still needed.
• Records relating to a contract that follows an enquiry: kept for the life of the contract and up to six years afterwards, to meet legal, tax and accounting requirements and to deal with possible claims.
• Privacy requests and complaints: kept for up to two years after We close them, so We can show how We handled them.
• Marketing opt-outs: We keep a minimal suppression record for as long as needed to respect your preference.

Retention, return and deletion of customer data used in production services will be governed by the applicable customer agreement, data processing terms and any legal or regulatory retention requirements.

11. Cookies, local storage and similar technologies

The corporate website is designed to minimise non-essential tracking. Its only optional technology is aggregate page-view counting, which runs only if you switch on “Analytics” in the cookie settings. If we introduce other non-essential analytics, advertising or similar technologies, we will provide the notice and choice required by applicable law before using them.

Our Cookie Notice lists exactly what this website stores on your device and explains how to change your choices.

12. Security

We use technical and organisational safeguards appropriate to the nature and risk of the information processed, including encryption, access management, logging, backup, recovery, data minimisation and appropriate hosting arrangements. We are committed to keeping your personal data confidential and implementing and managing security measures appropriate to Our processing. We limit access to people with a genuine business need to know. Those processing your information do so only in an authorised manner and are subject to a duty of confidentiality. No internet service can guarantee absolute security.

For more detail, see Our Data Processing & Security overview.

13. Disclosure and sharing

We may disclose information to service providers acting on Our behalf, including form-processing, cloud-hosting and email providers, professional advisers, regulators or public authorities where required by law, or where reasonably necessary to protect rights, safety, security or the integrity of Our services. Payment service providers may receive relevant information if you later purchase a service; the Contact Us form does not request payment details. We do not sell personal data.

14. Your privacy rights

The UK GDPR provides rights over your personal data. These rights apply subject to the conditions and exceptions in applicable law:

1. Right to be informed: You can ask how and why We process your personal data, what information We hold, where it is processed and with whom it is shared. This notice provides information about Our website and enquiry processing.
2. Right of access: You can request access to your personal data and a copy of it, together with information about its processing.
3. Right to rectification: You can ask Us to correct inaccurate information and complete information that is incomplete.
4. Right to erasure: You can ask Us to delete personal data where the relevant conditions apply, including where it is no longer needed, consent has been withdrawn and no other basis applies, you have successfully objected, it was processed unlawfully, or deletion is required by law. This right is subject to exceptions, including applicable legal retention requirements.
5. Right to restrict processing: You can ask Us to limit processing while accuracy is checked, where processing is unlawful and you prefer restriction to deletion, where We no longer need the information but you need it for a legal claim, or while an objection is being considered.
6. Right to data portability: Where processing is automated and based on consent or a contract, you can request the personal data you provided in a structured, commonly used, machine-readable format and, where technically feasible, ask for it to be sent to another controller.
7. Right to object: You can object to direct marketing at any time; this is an absolute right. You can also object, on grounds relating to your situation, to processing based on legitimate interests or a public task where applicable. We may continue such processing where the law permits, for example where there are compelling legitimate grounds that override your interests, rights and freedoms.
8. Rights concerning automated decision-making and profiling: Where applicable law provides these rights, you can request relevant information about automated decisions, profiling, their significance and consequences, contest a decision and request human intervention. You may also ask about the checks used to assess these systems. The public website and Contact Us form do not make solely automated decisions with legal or similarly significant effects.

You can withdraw consent at any time where processing is based on consent. Withdrawal does not affect the lawfulness of processing before withdrawal.

To exercise your rights, use Our Your Data Rights page or contact privacy@colligereai.com. Please identify the rights you wish to exercise and any details that may help Us locate the relevant information. You do not need to use a particular form or legal phrase to make a request.

We will normally respond within one month of receipt, subject to the time limits and permitted extensions under applicable law. We may request proportionate proof of identity where necessary. If an extension or another applicable exception affects the response, We will explain it. Requests are generally free of charge, although We may charge a reasonable fee or refuse a request where permitted by law.

Complaints

If you are unhappy with how We have used your personal data, you can complain to Us. Use Our Your Data Rights form (choose “Make a data protection complaint”) or email privacy@colligereai.com. We will acknowledge your complaint within 30 days, look into it without undue delay, keep you informed and tell you the outcome.

We hope to resolve any query or concern about Our use of your information and would appreciate the opportunity to address it. This does not affect your right to complain to the Information Commission’s Office (ICO) or another relevant supervisory authority. For UK complaints, visit ico.org.uk/make-a-complaint.

15. Automated decision-making

The public Colligere website and Contact Us form do not make decisions about you that produce legal or similarly significant effects solely by automated means.

16. Children

The public Colligere website and Contact Us form are intended for professional and organisational use and are not directed to children. Do not submit information about children through the public enquiry form.

17. Third-party websites

Our website contains links to other websites, such as LinkedIn and the ICO. Those websites have their own privacy notices and terms of use. We do not accept responsibility for the content, privacy practices or security of websites operated by third parties. We encourage you to read the privacy notices of any external websites you visit. The Ploceus360™ website (ploceus360.com) has its own privacy notice and terms, which apply when you use it.

18. Changes to this notice

We may update this Privacy Notice as our website, products, service providers or legal requirements evolve. The date at the top of this page shows when it was last updated.

19. Contact us

For questions about this Privacy Notice or how we handle personal data, contact privacy@colligereai.com.