Privacy policy

Who we are #

This privacy policy explains how Context Visualised Limited ("CoVi", "we", "us") collects, uses and shares your personal data. Context Visualised Limited also trades as CoVi Analytics [CONFIRM].

It applies when you:

• Use our website and blog
• Contact us through the Talk to us form, or by email
• Sign up to follow Halden
• Come to events we run or speak at [CONFIRM: still relevant]

Data controller: Context Visualised Limited
Company number: [CONFIRM]
Registered address: 3 Lloyd's Avenue, London EC3N 3DS [CONFIRM: is this also the registered office?]
ICO registration: ZA555645
Contact: legal@covianalytics.com

1. Information you give us #

We collect information you give us directly, including when you:

• Send us a message through the Talk to us form
• Sign up to follow Halden
• Email us, or otherwise contact us
• Register for or attend an event or webinar [CONFIRM: still relevant]
• Apply for a job [CONFIRM: still relevant]

The Talk to us form asks for your name, firm, role, email address, and what you are trying to fix. It does not ask for a phone number.

Follow Halden asks only for your email address.

If you email us or apply for a job, we also hold whatever you choose to send.

2. Information we collect automatically #

When you visit our website, we collect:

• Log information. Browser type, access times, pages viewed, IP address, and the page you came from.
• Device information. Device type, operating system and version, and screen size.
• Cookies and similar technologies. Small files and scripts that tell us how the site is used. We set strictly necessary cookies automatically. We set analytics and marketing cookies only if you accept them. See section 3 and our cookie policy.

3. Analytics and marketing tags #

We use the tools below to understand how our website is used. Google Analytics, PostHog and the LinkedIn Insight Tag load only if you choose "Accept all" in our cookie banner, or turn them on under "Choose". "Reject all" is shown as an equal choice, and the site works the same either way.

• Google Tag Manager. Not used yet. When we use it, it will load our other tags. It does not itself build a profile of you.
• Google Analytics 4. Tells us which pages people visit, how they arrived, and which buttons they click. For example, whether someone opened a Halden report or sent the Talk to us form. Provided by Google Ireland Limited and Google LLC [CONFIRM].
• Our Google Analytics export. [CONFIRM: BigQuery export live] Each day, Google copies the same Google Analytics data into our own database in Google Cloud (BigQuery). It is stored in London (Google Cloud region europe-west2). We use it for our own analysis. It holds data only from visitors who accepted analytics cookies. Provided by Google [CONFIRM: Google Cloud entity].
• PostHog. Shows us how people use the site: session recordings, heatmaps of clicks and scrolling, and the paths people take from page to page. A session recording replays the pages you saw, your clicks and your scrolling. Everything you type into a form is hidden before it leaves your browser [CONFIRM]. PostHog loads and records only after you accept analytics cookies. If you reject them, PostHog does not run at all. We add the PostHog session ID to Google Analytics, so we can find the recording for a visit. We do not give PostHog your name or email address [CONFIRM]. Provided by PostHog Inc., on its EU Cloud in Frankfurt, Germany.
• LinkedIn Insight Tag. Tells us which LinkedIn campaigns bring people to the site, and gives us grouped reports on visitors' job titles and industries, which do not name anyone. Provided by LinkedIn Ireland Unlimited Company [CONFIRM]. [CONFIRM: if used for retargeting, add: "It also lets us show our ads on LinkedIn to people who have visited our site."]

Where your visit came from. We add campaign tags (UTM parameters) to links we share, so we can see which posts and emails bring people to the site. When you send a form [CONFIRM: both forms], we store these details with it:

• The campaign tags, including any search term in the link (utm_term)
• The page you came from (the referrer)
• The first page you landed on
• Any ad click ID: gclid from Google Ads, or li_fat_id from LinkedIn

We keep these details with your enquiry in our customer records system, Attio [CONFIRM: Attio entity and location].

If you accept marketing cookies [CONFIRM: marketing or analytics], we also set our own cookie, covi_ft. It remembers these details from your first visit for 90 days. So if you come back later and send a form, we can see what first brought you here. Without the cookie, we use only the details of the visit in which you send the form.

Telling Google and LinkedIn about a qualified enquiry. This is not running yet. We plan to tell Google Ads and LinkedIn when an ad click leads to an enquiry that becomes a qualified opportunity. It shows us which ads bring real enquiries. We do this only if you gave marketing consent in our cookie banner. For Google, we send the Google click ID (gclid). For LinkedIn, we send the LinkedIn click ID (li_fat_id), or your work email in hashed form through LinkedIn's Conversions API. Hashing turns your email into a fixed code before it leaves our systems. LinkedIn can match that code to a LinkedIn member who uses the same email. With each, we send the type of conversion and its date.

You can change your choice at any time through "Cookie settings" in the footer of any page.

4. Information from other sources #

We may receive information about you from other sources and combine it with what we hold. For example, LinkedIn may tell us that a visit came from one of our campaigns. If you click one of our ads, Google or LinkedIn adds a click ID to the link, and we store it with your enquiry (section 3). We may also receive information from people you have authorised to share it with us.

5. How we use your information, and our lawful basis #

We do not sell your personal data. We do not use it for automated decisions that have legal or similarly significant effects on you.

6. The Halden email #

If you follow Halden, we send one email a month, "This month at Halden", and a short alert when we publish a new report. We send nothing else to this list unless you agree.

Every email has an unsubscribe link. One click takes you off the list.

[CONFIRM: if the email tool tracks opens and clicks, keep this paragraph:] Our emails contain a small tracking pixel and tracked links. They tell us whether an email was opened and which links were clicked. We use this only to make the emails more useful.

Our email tool is [CONFIRM: email provider name and location].

7. Who we share your information with #

We share your information only in these cases:

• Service providers. Companies that run services for us under contract: our website host [CONFIRM: e.g. Wix.com Ltd], our form tool [CONFIRM], our email tool [CONFIRM] and our customer records system, Attio [CONFIRM]. They also include Google (Analytics, Tag Manager, and BigQuery in Google Cloud, London), PostHog Inc. (PostHog EU Cloud, Frankfurt) and LinkedIn (Insight Tag). They may use your data only to provide their service to us [CONFIRM: LinkedIn joint-controller wording].
• Advertising platforms. Not running yet. Google (Google Ads) and LinkedIn, when an ad click leads to a qualified enquiry and you gave marketing consent (section 3). [CONFIRM: Google Ads entity, and whether each platform acts as our processor or as a controller]
• Business partners. For joint events or campaigns, only for that specific activity, and only where we have told you. [CONFIRM: still relevant]
• Legal requirements. When the law, a regulator or a court requires it.
• Business transfers. If we are involved in a merger, sale, financing or acquisition.
• With your consent. When you have asked us to, or agreed.

We may also share aggregated or de-identified information that cannot reasonably identify you.

8. International transfers #

Some of our service providers process data outside the UK, including in the United States. When that happens, we rely on a lawful safeguard: [CONFIRM: the UK Extension to the EU-US Data Privacy Framework, or the ICO International Data Transfer Agreement, or standard contractual clauses with the UK Addendum].

PostHog stores our data in its EU Cloud in Frankfurt, Germany. UK law treats data protection in the EU as adequate, so storage there needs no extra safeguard. PostHog Inc. is a US company [CONFIRM: safeguard for any access from the US, under PostHog's data processing agreement].

Our Google Analytics export to BigQuery is stored in London [CONFIRM: BigQuery export live].

You can ask us for a copy of the safeguards we use at legal@covianalytics.com.

9. How long we keep your information #

We keep personal data only as long as we need it for the purposes in this policy:

• Talk to us messages. [CONFIRM: e.g. 2 years from our last contact with you], unless you become a client.
• Where an enquiry came from. The campaign tags, search term, referrer, landing page and click IDs stored with an enquiry. We keep them for as long as the enquiry itself.
• Marketing data, including the Halden list. Until you unsubscribe, or for 3 years after you last open or click one of our emails, whichever comes first [CONFIRM].
• Google Analytics data. 14 months [CONFIRM: setting applied in GA4].
• Our Google Analytics export (BigQuery). 14 months, the same as Google Analytics [CONFIRM].
• PostHog data. Session recordings stay on PostHog for 30 days. We may export recordings to our own storage for analysis [CONFIRM: where exports are stored]. We keep PostHog data, including exported recordings, for no longer than 14 months [CONFIRM].
• The covi_ft cookie. 90 days in your browser.
• LinkedIn Insight Tag data. As set by LinkedIn [CONFIRM: current LinkedIn retention period].
• Conversions sent to Google and LinkedIn. Not running yet. Once sent, as set by Google and LinkedIn [CONFIRM: each platform's retention period].

• Legal and business records. As the law and our legitimate business needs require.

10. Your rights under UK data protection law #

You have these rights over your personal data:

• Access. Ask for a copy of the personal data we hold about you.
• Rectification. Ask us to correct data that is wrong or incomplete.
• Erasure. Ask us to delete your data in certain circumstances.
• Restriction. Ask us to limit how we use your data in certain situations.
• Data portability. Receive your data in a portable format.
• Object. Object to how we use your data, including for direct marketing.
• Withdraw consent. Where we rely on consent, withdraw it at any time. For the Halden email, use the unsubscribe link. For cookies, use "Cookie settings" in the footer.

To use any of these rights, email legal@covianalytics.com. We will respond within one month.

You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk.

11. Marketing preferences #

You can unsubscribe from any marketing email with the link at the bottom, or by emailing legal@covianalytics.com.

12. Cookies and your choices #

When you first visit, our cookie banner asks whether to allow analytics and marketing cookies. "Accept all", "Reject all" and "Choose" sit side by side, with equal weight. "Choose" lets you turn analytics and marketing cookies on or off one by one. Strictly necessary cookies are always on, because the site needs them to work.

You can change your choice at any time through "Cookie settings" in the footer of any page. You can also block or delete cookies in your browser settings, though some parts of the site may then not work as expected.

Our cookie policy lists every cookie and tag we use.

13. Security #

We use appropriate technical and organisational measures to protect personal data from unauthorised access, change, disclosure or destruction. No internet transmission is completely secure.

14. Children's privacy #

Our website is not intended for children under 16. We do not knowingly collect personal data from children under 16. If we learn that we have, we will delete it.

15. Social sharing and links #

Our website may include buttons that let you share pages on social media, and links to other sites. If you use them, the social media provider or other site may collect information about you under its own privacy policy. Please read their policies.

16. Changes to this policy #

We may update this policy from time to time. When we do, we will change the date at the top. Where the change matters, we will also tell you on our website or by email.

Questions about this policy? #

Email: legal@covianalytics.com
Address: Context Visualised Limited, 3 Lloyd's Avenue, London EC3N 3DS
ICO registration: ZA555645