Privacy & UK GDPR

Who is responsible

Autonomous Software Systems Ltd is the controller of personal data collected through this public CDS website. We are a private limited company registered in England and Wales, number 17371945. Our registered office is 112–114 Whitegate Drive, Blackpool, England, FY3 9XH. Contact info@cogsys.app about privacy, requests or complaints. No separate data protection officer contact has been confirmed.

This notice covers website visitors and access enquiries, not client code, client environments or the CDS service itself. Those require the relevant service agreement, privacy information and data processing terms.

Information collected

Please do not put passwords, source code, confidential client records, health information or other sensitive personal data in the enquiry form. Required fields let us identify your organisation and respond; without them, the form cannot submit. Optional fields can be left blank.

• Access enquiries: name, work email and organisation (required); role, engineering team size and message (optional).
• A hidden anti-spam field is checked. Valid enquiries are saved with a submission timestamp.
• When you email us, your email address and the information you choose to send are used to handle that correspondence.
• Website delivery and external font requests can expose technical information such as IP address, browser details and request time to the relevant providers. The exact hosting log fields and retention have not yet been confirmed.

Purposes and lawful bases

Enquiry handling: we use your details to assess and respond to a request for CDS access and related business correspondence. The proposed lawful basis is legitimate interests (Article 6(1)(f), UK GDPR): managing genuine business enquiries and developing business relationships. This basis requires a documented assessment of necessity, proportionality and your rights before adoption.

Where you personally request steps towards a contract to which you would be a party, Article 6(1)(b) may instead apply. It is not automatically the basis for enquiries made on an employer’s behalf. Processing required by a specific legal obligation may use Article 6(1)(c) where that obligation applies.

Submitting this form is not consent to a marketing mailing list. The current form saves an enquiry; it does not create an account or automatically subscribe you to marketing. Any separate marketing activity needs its own lawful-basis and PECR assessment.

Providers, recipients and transfers

The enquiry form uses Lovable Cloud to save requests. Authorised company personnel need access to handle enquiries. The complete list of hosting, infrastructure, email, backup and support providers and their access arrangements still needs confirmation.

This website loads Inter from Google Fonts. Your browser connects to Google to obtain the font; see the cookies and storage notice for more information.

UK-only storage has not been verified. Provider processing countries, any overseas access and the applicable UK adequacy regulations or transfer safeguards must be confirmed. Recommended approach: check processor agreements, publish the relevant recipient categories and countries, and document any required UK transfer mechanism and assessment. Ask info@cogsys.app for the current arrangements or copies of applicable safeguards; we cannot currently promise a particular location or safeguard.

Retention

Recommended policy, not an implemented deletion schedule: review unsuccessful or inactive access enquiries 12 months after the last substantive contact and delete or anonymise them unless there is a documented continuing need. If an enquiry becomes a client relationship, move the necessary information to the applicable client-record retention schedule.

Actual retention, deletion of existing requests, hosting logs and backup expiry have not yet been confirmed. A shorter period may be appropriate where the enquiry has been resolved. Any exception for a dispute or legal obligation should have a recorded reason and review date.

Your rights

Depending on the lawful basis and circumstances, you may have rights to access your personal data, correct inaccuracies, request erasure, restrict processing, object to processing and receive portable data. Portability is not a general right for all legitimate-interest processing. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. You may object to direct marketing at any time.

Email info@cogsys.app to exercise a right. We may need proportionate information to verify your identity. The usual response period is one month; lawful extensions, pauses and exceptions may apply. You do not have to contact us before raising a concern with the Information Commissioner’s Office (ICO).

Automated decisions, other sources and changes

The form has an automated anti-spam check. The current enquiry flow saves valid requests for a person to respond; it does not make a solely automated decision with legal or similarly significant effects about you.

This form obtains information directly from you. If we obtain personal information about prospects from other sources, the relevant source, categories and additional privacy information must be provided within the applicable legal time limits.

Any new purpose, provider or material change to this notice should be assessed and the notice updated before the new processing starts. This interim notice does not certify UK GDPR compliance.