Privacy Policy

1. Who We Are

CoreStack Group (“we”, “us”, “our”) is a technology capability engine that curates and deploys technology professionals into complex organisations. We are committed to protecting your privacy and handling your personal data transparently and lawfully.

For data protection enquiries, contact us at contact@corestack.co.uk.

2. What Data We Collect

We may collect the following personal data:

• Contact form submissions: name, email address, and message content when you submit an enquiry via our website.
• Chatbot interactions: name, email address (if provided via lead capture), and conversation content when you use our AI chatbot assistant.
• Technical data: IP address, browser type, and device information collected automatically when you visit our website. We do not use this data for tracking or profiling.

3. How We Use Your Data

We use your personal data for the following purposes:

• To respond to your enquiries and provide information about our services.
• To log chatbot conversations for quality assurance and follow-up purposes.
• To protect the security and integrity of our website (e.g., rate limiting, abuse prevention).

We do not use your data for marketing purposes unless you have explicitly opted in. We do not sell, rent or share your personal data with third parties for their marketing purposes.

4. Lawful Basis for Processing

We process your personal data on the following legal bases under UK GDPR:

• Legitimate interest: responding to enquiries, improving our services, and protecting our website.
• Consent: where you voluntarily provide your details via our contact form or chatbot lead capture.
• Contractual necessity: where processing is required to fulfil a service agreement.

5. Data Storage and Third Parties

Your data may be processed by the following third-party services:

• Vercel: website hosting (servers located in the EU/US). See Vercel Privacy Policy.
• Notion: chatbot conversation logging. See Notion Privacy Policy.
• Google (Gemini AI): powers our chatbot responses. Conversation content is sent to Google's API for processing. See Google Privacy Policy.

We ensure all third-party processors provide adequate data protection safeguards. Where data is transferred outside the UK, we rely on appropriate transfer mechanisms (adequacy decisions or standard contractual clauses).

6. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected:

• Contact form submissions: up to 12 months.
• Chatbot conversation logs: up to 6 months.
• Technical logs (IP addresses): up to 30 days.

7. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Request correction of inaccurate data.
• Request deletion of your data (“right to be forgotten”).
• Object to or restrict processing of your data.
• Request data portability.
• Withdraw consent at any time (where consent is the basis for processing).

To exercise any of these rights, email us at contact@corestack.co.uk. We will respond within 30 days.

8. Complaints

If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint.

9. Changes to This Policy

We may update this privacy policy from time to time. Any changes will be posted on this page with an updated revision date.