Privacy Notice

Version 1.0 · Last updated 9 Nov 2026

1. Who we are

Corgenta Ltd (“Corgenta”, “we”, “us”) is a company registered in England and Wales, company number 04788104, registered office 1110 Elliott Court Business Park, Herald Ave, Coventry CV5 6UB, UK. We are the controller of the personal information described in this notice. ICO registration number: ZC289692.

Contact us about privacy at privacy@corgenta.com.

2. What this notice covers

This notice explains how we use personal information when you visit corgenta.com, contact us, request the Corgenta DRA Sandbox, buy a Corgenta DRA package, or use our software and services.

Assessment data that customers put into Corgenta DRA, or give us for a DRA we carry out (for example system, zone and risk records), is customer data. We process it on the customer’s behalf under the Data Processing Annex to our General Terms or, for DRA services, section 12 of our DRA Services Terms.

3. Information we collect

• Enquiries (Get in Touch): name, work email, role, industry, company, whether you want a service or software, timing, budget status and your message.
• DRA Sandbox requests: name, work email, organisation, role, industry, how you do DRAs today, when your next assessment is due, your message, and a record that you accepted the DRA Sandbox Terms (terms version, date and time).
• DRA Practice enquiries: the same details as a DRA Sandbox request, without the terms acceptance.
• Package finder answers: the options you choose and any details you add.
• Purchases: company name, billing address, VAT number and payment details. Stripe processes card payments; we do not see or store full card numbers.
• Accounts: name, work email, role and activity records inside Corgenta DRA (for example who created, reviewed or approved a record and when).
• Details from your organisation: if your organisation gives us your details (for example to invite you as a user or name you as an approver), we get them from that organisation.
• Required details: you must give us your name and work email to request the DRA Sandbox, buy a licence or use our services. Without them we cannot provide the service. Other details are optional.
• Website use: if you allow analytics cookies, Microsoft Clarity records how you use the site (the pages you visit, clicks, scrolling and mouse movement), your device and browser, and your approximate location. We use this to make session recordings and heatmaps. Clarity hides what you type into forms. See section 10.

4. How we use it and our lawful basis

• To reply to your enquiry and discuss your needs. Lawful basis: our legitimate interests in responding to business enquiries.
• To review your DRA Sandbox request, set up the DRA Sandbox and contact you about it. Lawful basis: to take steps at your request before a contract, and to perform the DRA Sandbox Terms.
• To sell, set up and provide DRA Project and DRA Professional licences, including renewal and payment emails. Lawful basis: to perform our contract with you.
• To keep billing and tax records. Lawful basis: legal obligation.
• To keep our services secure, prevent misuse and keep audit records. Lawful basis: our legitimate interests in running a secure service.
• To understand how visitors use the website and improve it. Lawful basis: your consent, given in the cookie banner, which you can withdraw at any time with the Cookie settings link in the footer.
• To send occasional news about Corgenta DRA, only if you tick the box to opt in. Lawful basis: consent, which you can withdraw at any time with the unsubscribe link in every email.

5. Who we share it with

We do not sell personal information. We share it only with:

• Service providers who act for us: Hetzner (platform hosting, Finland), Microsoft 365 (email and office), Microsoft Clarity (website analytics), Stripe (payments), Webflow (website and forms) and Cloudflare (spam protection on website forms).
• Professional advisers, such as lawyers and accountants, where needed.
• Authorities, where the law requires it.

6. International transfers

Our platform data is hosted by Hetzner in Finland. The UK recognises the European Economic Area as providing adequate protection. Stripe, Webflow, Cloudflare and Microsoft (including Microsoft Clarity) may process data in the United States. Where they do, we rely on the UK–US data bridge for providers certified under it, or on the UK International Data Transfer Agreement or Addendum.

7. How long we keep it

• Enquiries that do not lead to a contract: 24 months from our last contact.
• DRA Sandbox requests and terms acceptance records: the 14-day DRA Sandbox term plus 12 months.
• Customer account information: for the licence term, then 30 days.
• DRA Sandbox accounts and content: deleted 14 days after DRA Sandbox access ends.
• DRA service contact records: 6 years after the engagement ends.
• Marketing consent records: 2 years after you unsubscribe.
• Billing and tax records: 6 years.
• Website analytics recordings: up to 30 days in Microsoft Clarity.

8. Your rights

You can ask us to give you a copy of your information, correct it, delete it, restrict or object to our use of it, or transfer it. Where we rely on consent, you can withdraw it at any time. Email privacy@corgenta.com. We will reply within one month.

9. Complaints

You can complain to us about how we use your information at privacy@corgenta.com. We will acknowledge your complaint within 30 days, look into it and tell you the outcome. If you are still unhappy, you can complain to the Information Commissioner’s Office (ICO): ico.org.uk, 0303 123 1113.

10. Cookies

We use essential cookies and similar browser storage to run the website. We use analytics cookies only if you accept them in the cookie banner. We do not currently use marketing cookies. You can change your choice at any time with the Cookie settings link in the footer. The cookies and storage we use are:

11. Changes to this notice

We will post any changes on this page and update the version and date at the top.