Privacy Notice

Last updated: 2026

1. Who we are

COR5 is a cybersecurity and resilience consultancy based in the United Kingdom. For the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, COR5 is the data controller for personal data collected through this website.

Registered company details and data protection contact: [email protected].

2. What personal data we collect

We only collect personal data that you choose to provide to us. Through this website, that is limited to the information you submit in the enquiry form:

• Your name
• Your organisation (if provided)
• Your email address
• Your telephone number (if provided)
• The area of interest you select and the content of your message

We ask that you do not submit sensitive technical detail, credentials, security findings or confidential information through the website enquiry form.

3. How we use your data

We use the personal data you provide to:

• Respond to your enquiry and correspond with you about it;
• Arrange and hold an initial consultation;
• Prepare a proposal or scope of work where you ask us to;
• Maintain business records of enquiries received.

4. Lawful basis for processing

We rely on the following lawful bases under Article 6 of the UK GDPR:

• Consent — where you submit an enquiry through this website and tick the consent box.
• Legitimate interests — to respond to business enquiries and to manage our client relationships, where those interests are not overridden by your rights.
• Contract — where processing is necessary to take steps at your request before entering into a contract, or to perform one.

5. Sharing your data

We do not sell personal data and we do not share it for marketing purposes. We may share personal data with:

• Service providers who support our business operations, acting under written instruction — currently Cloudflare, Inc. for website hosting, content delivery and analytics, and Microsoft Corporation for email;
• Professional advisers such as lawyers, auditors and insurers where necessary;
• Regulators, law enforcement or other authorities where we are required to do so by law.

6. International transfers

Where personal data is transferred outside the United Kingdom, we ensure an appropriate safeguard is in place, such as an adequacy decision or the International Data Transfer Agreement or Addendum issued by the Information Commissioner's Office.

7. How long we keep it

Enquiry data is retained for as long as necessary to respond to and follow up on your enquiry, and thereafter in line with our business record-keeping requirements. Where an enquiry does not lead to an engagement, we delete the personal data once it is no longer needed. Where an engagement follows, data is retained under the terms of that engagement.

8. Cookies, analytics and hosting

This website sets no cookies. We do not use advertising or tracking cookies, we do not profile visitors, and we do not share visitor data with advertising networks. Because no cookies are set, no cookie consent banner is required.

Analytics. We use Cloudflare Web Analytics to understand how many people visit the site and which pages they read. It is cookieless and does not fingerprint devices or track visitors across other websites. It reports aggregate figures only — page views, referrers, approximate country and browser type. We cannot, and do not attempt to, identify an individual visitor from it.

Hosting and content delivery. The site is hosted on Cloudflare Pages and delivered through Cloudflare's network. In the course of serving and protecting the site, Cloudflare processes technical request data including IP addresses. Cloudflare acts as our processor for this and is bound by its own data protection commitments.

Web fonts. Typefaces are loaded from Google Fonts, which means your browser makes a request to Google's servers. That request includes your IP address and is subject to Google's own privacy policy.

9. Security

We apply technical and organisational measures appropriate to the nature of the data we hold, including access control, encryption in transit and the principle of least privilege. No transmission over the internet can be guaranteed to be entirely secure, which is why we ask you not to submit confidential or sensitive material through the website form.

10. Your rights

Under UK data protection law you have the right to request access to your personal data, to have inaccurate data corrected, to request erasure, to restrict or object to processing, to data portability, and to withdraw consent at any time where consent is the basis for processing. To exercise any of these rights, contact [email protected].

If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

11. Changes to this notice

We may update this notice from time to time. The date at the top of this page indicates when it was last revised.

12. Contact

Questions about this notice or about how we handle personal data should be sent to [email protected].