Privacy policy

Last updated: 1 September 2026

1. Who we are

COZQ is a UK web design and software studio. Our legal entity is COZQ Limited, a company registered in England and Wales (company number 16592649, VAT number GB519163195, ICO registration ZC022310). Our registered office is 20 Wenlock Road, London, England, N1 7GU.

This privacy policy applies to our website at cozq.com and to any personal data we process when you contact us, submit an enquiry, or use our services. For the purposes of UK GDPR and the Data Protection Act 2018, COZQ Limited is the data controller.

2. What data we collect

We may collect the following categories of personal data:

• Contact and enquiry data - name, email address, phone number, company name, and message content when you use our contact form, case study enquiry forms, or get in touch by email or phone.
• Project and business data - information you provide about your business, requirements, or existing systems when we discuss or deliver a project.
• Technical data - IP address, browser type, device type, operating system, and general usage information when you visit our site (for example, security monitoring and site improvement).
• Cookie and consent data - your cookie preferences and related identifiers, as described in section 6 below.

We do not intentionally collect special category data (such as health information) through this website. Please do not send us sensitive personal data unless we have agreed that it is necessary for your project.

3. How we use your data

We use your personal data to:

• Respond to enquiries and provide our web design, software development, and related services.
• Manage projects, send proposals, invoices, and project updates.
• Send relevant information about our services where you have asked for this or we have another lawful basis.
• Operate, secure, and improve our website (including analytics where you have consented to non-essential cookies).
• Comply with legal, regulatory, and accounting obligations.

We do not sell your personal data to third parties.

4. Lawful basis for processing

We process personal data on the following lawful bases under UK GDPR:

• Contract - where processing is necessary to respond to your request, prepare a proposal, or deliver services you have engaged us to provide.
• Legitimate interests - to operate and improve our business, secure our website, and communicate with you in a way you would reasonably expect (for example, replying to a contact form submission). We balance these interests against your rights and will not rely on them where your interests override ours.
• Consent - where we use non-essential cookies or send marketing communications and you have agreed. You may withdraw consent at any time.
• Legal obligation - where we must retain or disclose information to comply with applicable law.

5. How long we keep your data

We retain contact and enquiry data for as long as needed to deal with your request, manage any follow-up, and for a reasonable period for legal and business purposes (typically up to six years for business records unless we have an ongoing client relationship).

Technical and access logs are kept for a shorter period for security and troubleshooting. Cookie consent records are retained to honour your preferences. You may ask us to delete your data earlier where there is no legal obligation to retain it.

6. Cookies

Our site uses cookies and similar technologies:

• Strictly necessary cookies - required for the site to function (for example, session management and security). These do not require consent under UK law.
• Preference and functional cookies - for example, to remember your cookie consent choice so we do not show the banner again on every visit.
• Analytics or marketing cookies - only if you choose “Accept” in our cookie banner. You can refuse non-essential cookies and still use the site.

You can change your preferences at any time via our cookie banner (where shown) or by contacting us. For more detail on the cookies we use, see the cookie notice displayed on the site.

7. Sharing your data

We may share your data with:

• Service providers who help us run our website or business (for example, hosting, email delivery, and analytics) under strict confidentiality and data processing terms.
• Professional advisers (such as accountants or insurers) where reasonably necessary.
• Regulators or authorities when required by law.

We do not transfer your personal data outside the United Kingdom or European Economic Area unless we have put in place appropriate safeguards (such as standard contractual clauses or an adequacy decision) as required by UK GDPR.

8. Your rights under UK GDPR

Under UK data protection law you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Request erasure of your data in certain circumstances.
• Object to or restrict certain processing.
• Data portability, where applicable.
• Withdraw consent at any time where we rely on consent.
• Lodge a complaint with the Information Commissioner’s Office (ICO) at ico.org.uk.

To exercise any of these rights, contact us using the details below. We will respond within one month, or explain if we need longer for complex requests.

9. Security

We use appropriate technical and organisational measures to protect your data against unauthorised access, loss, or misuse. These include secure hosting, encrypted connections (HTTPS), access controls, and staff confidentiality. No system is completely secure; if a breach is likely to affect your rights, we will notify you and the ICO where required by law.

10. Changes to this policy

We may update this policy from time to time to reflect changes in our services, technology, or legal requirements. The “Last updated” date at the top of this page will change when we do. We encourage you to review this page occasionally.

11. Contact

For any questions about this privacy policy or your personal data, contact: