Legal
Privacy Policy
1. Scope — read this first
This policy covers the Cortessa marketing website at cortessa.co.uk (the “Site”) and the personal data connected with it. It does not describe the Cortessa product.
The Cortessa product is offline-first: it processes your documents locally on your own machine, does not phone home, and sends nothing to us to answer a question. The product is not sold through this Site, and the Site has no user accounts. Data handling for a licensed deployment of the product is governed separately by the applicable licence or contract.
The Site itself is deliberately minimal: it is a static website with no contact forms, no cookies, no analytics, and no trackers. The only personal data we receive through it is whatever you choose to send us by email.
2. Who we are (data controller)
The data controller for personal data described in this policy is Cortessa Ltd, a private limited company registered in Scotland (company number SC905639).
- Contact for privacy matters: info@cortessa.co.uk
- Registered office: 37 Sundale Avenue, Glasgow, G76 7TA, United Kingdom.
In this policy, “we”, “us” and “our” mean Cortessa Ltd. This policy is written under the UK GDPR and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.
3. What personal data we collect, and why
The Site sets no cookies, runs no analytics, and has no forms. We collect personal data in only one way:
| Data | When / how | Purpose | Lawful basis (UK GDPR Art. 6) |
|---|---|---|---|
| Your name, email address, and whatever you include in your message | When you choose to email us at the address published on the Site | To respond to your enquiry and, if relevant, discuss an evaluation or pilot | Art. 6(1)(f) — our legitimate interest in responding to an enquiry you initiated |
We do not use your details for marketing unless you ask us to, and we operate no mailing list. We do not intentionally collect special category data (for example health, biometric, or political data). Please do not include such information — or any classified, export-controlled, or programme-specific material — in an email to us.
We make no automated decisions about you and do no profiling.
4. Website hosting (GitHub Pages)
The Site is a static website served by GitHub Pages, a hosting service operated by GitHub, Inc., a company based in the United States. When you visit any GitHub Pages site, GitHub logs the visitor’s IP address and stores it for security purposes; this is described in GitHub’s own documentation and privacy statement.
We do not receive or have access to those server logs. GitHub’s processing of connection data to serve and secure the Site is carried out under GitHub’s own terms and privacy statement, which we encourage you to read if this matters to you. Beyond serving the pages, the Site sends nothing to GitHub or anyone else about you: it contains no analytics scripts, no third-party embeds, no external fonts or CDNs, and no trackers.
5. Where your data goes (recipients and transfers)
- Email you send us is received and stored by our email service provider (email to info@cortessa.co.uk is delivered to a mailbox we control). Like most email services, the provider may store data on servers outside the UK; where personal data is transferred outside the UK it is protected by UK adequacy regulations or other legally recognised safeguards.
- Site hosting is provided by GitHub, Inc. (US), as described in section 4.
- We use no advertising networks, no third-party analytics, and no data brokers, and we do not sell personal data.
6. How long we keep it (retention)
We keep enquiry correspondence only as long as needed to handle your enquiry and any business relationship that follows from it — normally no longer than 24 months after our last exchange — and then delete it. We hold no server logs, so there is nothing else to retain.
7. Your rights
Under the UK GDPR you have the right to: access your data; ask us to rectify it; ask us to erase it; restrict or object to processing; and data portability. Where any processing is ever based on consent, you may withdraw that consent at any time (this does not affect processing already carried out).
To exercise any right, email info@cortessa.co.uk. We will respond within one month. There is normally no charge.
8. Complaints
If you have a concern about how we handle your personal data, you have the right to complain to us, and we ask that you contact us first at info@cortessa.co.uk so we can try to resolve it. In line with the complaints-handling duty under the Data (Use and Access) Act 2025 (in force since 19 June 2026), we will acknowledge your complaint within 30 days, look into it without undue delay, and tell you the outcome.
You also have the right to complain to the UK supervisory authority: the Information Commissioner’s Office (ICO) — ico.org.uk/make-a-complaint · helpline 0303 123 1113.
9. Cookies
The Site sets no cookies at all and uses no similar storage technologies. See our separate Cookie Notice for detail.
10. Changes to this policy
We may update this policy from time to time. The version and date at the top show the current version; please check this page for changes.
11. Version history
- 1.2 · 12 October 2026 — Data controller changed to Cortessa Ltd (registered in Scotland, company number SC905639) following its incorporation; previously Michael Davidson, a sole trader trading as Cortessa.
- 1.1 · 27 August 2026 — Trading-name reference corrected.
- 1.0 · 27 August 2026 — First published.