Privacy Policy

Who we are

Code23 is a trading name of Twenty & Three Ltd, a company registered in England and Wales (company number 14975230). Our registered office is Spaces, Arlington Business Park, Theale, Reading, Berkshire, RG7 4SA. We are the data controller for personal data collected through this website.

Questions about this policy or your data: email [email protected].

What we collect and why

Enquiry form. When you contact us we collect your name, email address, and anything you choose to include: company name, phone number, service area, your message and any files you attach. We use this to respond to your enquiry and, where it leads to a working relationship, to manage that relationship. The lawful bases are your consent (given via the checkbox when you submit the form) and our legitimate interest in responding to business enquiries.

Requested resources. If you request our AI & Automation Starter Kit, we use your name and email address to send the download links you asked for. This doesn't subscribe you to marketing or request a personalised review. We don't add the details to a mailing list. We keep a record of your request and its delivery status in Attio, our customer relationship system. The lawful basis is our legitimate interest in fulfilling your request. Download links expire after 24 hours and don't contain your name or email address.

Technical data. Our hosting provider processes IP addresses and request data in server logs for security and to deliver the site. The lawful basis is legitimate interest in running a secure website.

Analytics. With your consent, given via the cookie banner, we use Google Analytics and PostHog to understand how the site is used: pages visited, how you arrived, clicks, interaction patterns, performance, and browser errors. PostHog may also record a privacy-masked replay of a session. Form inputs are masked and uploaded attachment details are excluded from recordings. These tools set cookies on your device only after you accept. The lawful basis is your consent, which you can withdraw at any time using the "Cookie settings" link in the footer. If you decline, no analytics cookies are set. We use the same consent choice for optional advertising measurement.

Advertising measurement. With your cookie consent, Google Ads and, where configured, OpenAI Ads measurement help us understand which advertising leads to enquiries. This can include page and event data, advertising click identifiers and browser or request information. We don't send the contents of your enquiry or toolkit form to these measurement tools. Declining optional cookies doesn't prevent you from contacting us or requesting the toolkit.

Who processes your data

We use a small number of service providers to run this site:

• Cloudflare hosts the website and provides security and content delivery.
• Resend delivers enquiry-form submissions to us and sends requested toolkit emails. It processes the recipient details and email content needed for delivery, with primary processing in the United States. Its data processing terms include the UK transfer clauses and safeguards.
• Attio stores contact details and a separate record of each enquiry or toolkit request, so we can respond and check delivery. Enquiry records include the details you submit, the page you used and, with optional measurement consent, advertising attribution. We don't upload attached files to Attio. A toolkit request doesn't add you to a marketing list or mark you as a qualified sales opportunity. Attio's data processing terms cover its processing on our behalf.
• Google Analytics provides usage analytics, with your consent.
• Google Ads and OpenAI provide advertising measurement when enabled and with your consent.
• PostHog provides product analytics, hosted in the EU, with your consent.
• Google Fonts supplies the typefaces on this site; your browser requests font files from Google's servers, which involves disclosure of your IP address to Google.

Where processing happens outside the UK, it is covered by UK-approved safeguards such as the UK Addendum to Standard Contractual Clauses or adequacy regulations.

How long we keep it

Enquiry correspondence is kept for as long as needed to handle the enquiry and any resulting business relationship, and afterwards as part of our business records for up to six years, in line with UK limitation periods. Server logs are retained for short periods by our hosting provider.

Toolkit request records in Attio are kept for as long as needed to fulfil the request and resolve delivery questions. They aren't marketing subscriptions. Our email provider also processes delivery records under its retention settings. You can contact us about these records or ask for deletion at [email protected]. The 24-hour download expiry is an access limit, not a claim that request or email delivery records are deleted after 24 hours.

Your rights

Under UK GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• restrict or object to our processing;
• receive your data in a portable format;
• withdraw consent at any time, where consent is the basis.

To exercise any of these, email [email protected]. You also have the right to complain to the Information Commissioner's Office at ico.org.uk.

Changes

We'll update this policy when our practices change and revise the date at the top of this page.