Privacy Policy | CONGs LTD

CONGs LTD

1. INTRODUCTION

1.1 About This Policy. This Privacy Policy explains how CONGs LTD ("CONGs", "we", "us", or "our") collects, uses, discloses, and protects personal data when you visit our website at www.congs.co.uk (the "Website") or interact with us. We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025), and any other applicable data protection laws.

1.2 Data Controller. CONGs LTD is the data controller responsible for your personal data. Our contact details are:

CONGs LTD Company Number: 16602984 Registered Address: 67 Hounslow Road, Hanworth, Feltham, England, TW13 6QA Email: olga.sakka@congs.co.uk Website: www.congs.co.uk

1.3 Data Protection Officer. We are not required to appoint a Data Protection Officer under the UK GDPR. For any data protection queries, please contact us using the details above.

1.4 Changes to This Policy. We may update this Privacy Policy from time to time. The "Last Updated" date above indicates when changes were last made. We encourage you to review this Policy periodically. If we make material changes that affect how we process your personal data, we will notify you by posting a prominent notice on our Website.

2. PERSONAL DATA WE COLLECT

2.1 Data You Provide Directly. When you use our contact form or otherwise communicate with us, we may collect:

(a) Identity data: your name and job title;

(b) Contact data: your email address, telephone number, and company name;

2.2 Data Collected Automatically. When you visit our Website, we automatically collect certain technical data through cookies and similar technologies:

(a) Technical data: IP address, browser type and version, device type, operating system, time zone setting, and general location (country/city level);

(b) Usage data: pages visited, time spent on pages, navigation paths, referring website, and other information about how you use our Website.

2.3 Data from Third Parties. We may receive personal data about you from third parties, including:

(a) Analytics providers: such as Wix Analytics, which provides aggregated and anonymised data about Website visitors;

(b) Professional networks: if you contact us via LinkedIn or similar platforms.

2.4 No Special Category Data. We do not intentionally collect special category personal data (such as data about health, race, religion, or political opinions) through our Website or otherwise for the purpose of our Services. Please do not submit such data to us.

3. HOW AND WHY WE USE YOUR PERSONAL DATA

3.1 Overview. We only process your personal data when we have a lawful basis to do so under the UK GDPR. The table below sets out each purpose for which we process personal data and the corresponding lawful basis.

3.2 Processing Purposes and Lawful Bases.

Responding to enquiries

To receive and respond to enquiries submitted through our contact form or by email. Data used: Identity data, Contact data, Communication data. Lawful basis: Legitimate interests (Article 6(1)(f)). It is in our legitimate interest to respond to enquiries from potential clients and other contacts, and this is necessary for us to conduct our business. This processing is proportionate and does not override your rights as you would reasonably expect us to respond when you contact us.

Service discussions

To discuss our services with you and assess whether we can assist with your requirements. Data used: Identity data, Contact data, Communication data. Lawful basis: Legitimate interests (Article 6(1)(f)). It is in our legitimate interest to engage in pre-contractual discussions with prospective clients. Alternatively, where you have specifically requested information about our services, this may constitute steps taken at your request prior to entering into a contract (Article 6(1)(b)).

Website operation

To operate, maintain, and improve our Website and ensure it functions correctly. Data used: Technical data, Usage data. Lawful basis: Legitimate interests (Article 6(1)(f)). It is in our legitimate interest to ensure our Website operates securely and efficiently, to understand how visitors use our Website, and to improve the user experience.

Security and fraud prevention

To protect our Website, systems, and business from security threats, fraud, and other harmful activities. Data used: Technical data, Usage data. Lawful basis: Legitimate interests (Article 6(1)(f)). It is in our legitimate interest to protect our business, Website, and users from security threats and fraudulent activity.

Legal compliance

To comply with legal obligations, respond to legal claims, and exercise or defend our legal rights. Data used: All categories as relevant. Lawful basis: Legal obligation (Article 6(1)(c)), where we are required by law to process personal data. Legitimate interests (Article 6(1)(f)), where we need to establish, exercise, or defend legal claims.

Marketing communications

To send you information about our services, insights, and updates (including via third parties). Data used: Identity data, Contact data. Lawful basis: Legitimate interests (Article 6(1)(f)). It is in our legitimate interest to deliver marketing and advertisement (including via third parties) to our existing prospective B2B client base. In jurisdictions where your permission is legally required, we will rely on your consent (Article 6(1)(a)).

Record keeping

To maintain records of enquiries and communications for business administration purposes. Data used: Identity data, Contact data, Communication data. Lawful basis: Legitimate interests (Article 6(1)(f)). It is in our legitimate interest to maintain accurate business records for administrative purposes and to evidence our interactions.

3.3 Legitimate Interests Assessment. Where we rely on legitimate interests as a lawful basis, we have conducted a balancing assessment to ensure that our interests do not override your fundamental rights and freedoms. You have the right to object to processing based on legitimate interests (see Section 8).

4. DISCLOSURE OF YOUR PERSONAL DATA

4.1 Overview. We may share your personal data with certain third parties. The table below sets out each category of recipient, the purpose of disclosure, and the lawful basis.

4.2 Recipients and Lawful Bases for Disclosure.

Technology services providers

To host and operate our Website, process contact form submissions, provide analytics, manage customer relations and others. Data disclosed: Technical data, Usage data, Identity data, Contact data, Communication data (as submitted via forms). Lawful basis: Legitimate interests (Article 6(1)(f)). It is necessary for us to use various service providers in order to display, advertise, deliver, manage and improve our services.

IT and security service providers

To maintain the security of our systems, provide technical support, and protect against cyber threats. Data disclosed: Technical data, Usage data. Lawful basis: Legitimate interests (Article 6(1)(f)). It is in our legitimate interest to maintain secure IT infrastructure. These providers act as our processors.

Professional advisers

To obtain legal, accounting, or other professional advice. Data disclosed: All categories as relevant to the advice sought. Lawful basis: Legitimate interests (Article 6(1)(f)). It is in our legitimate interest to obtain professional advice for the proper management of our business. Alternatively, legal obligation (Article 6(1)(c)) where disclosure is required by law.

Regulatory authorities and law enforcement

To comply with legal obligations, respond to lawful requests, or protect our legal rights. Data disclosed: All categories as relevant. Lawful basis: Legal obligation (Article 6(1)(c)), where we are legally required to disclose information. Legitimate interests (Article 6(1)(f)), where necessary to establish, exercise, or defend legal claims.

Business successors

In connection with a merger, acquisition, reorganisation, or sale of our business or assets. Data disclosed: All categories. Lawful basis: Legitimate interests (Article 6(1)(f)). It is in our legitimate interest to disclose personal data to prospective buyers or successors as part of legitimate business transactions. We will ensure appropriate protections are in place.

4.3 No Selling of Personal Data. We do not sell your personal data to third parties.

4.4 Processors. Where third parties process personal data on our behalf (as "processors"), we ensure that appropriate contracts are in place requiring them to protect your personal data and only process it in accordance with our instructions.

5. INTERNATIONAL TRANSFERS

5.1 Transfers Outside the UK. Our Website is hosted on Wix.com, which may store or process data in locations outside the United Kingdom, including the United States and Israel.

5.2 Safeguards. Where personal data is transferred outside the UK to a country not covered by an adequacy decision, we ensure appropriate safeguards are in place, including:

(a) transfers to countries that the UK Government has determined provide an adequate level of data protection;

(b) use of standard contractual clauses approved by the UK Government (the UK International Data Transfer Agreement or UK Addendum to EU SCCs); or

6. DATA RETENTION

6.1 Retention Principles. We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, reporting or archiving requirements.

6.2 Retention Periods. The following retention periods apply:

Contact form enquiries (where no engagement follows)

Retained for 2 years from date of last contact. To allow reasonable time for follow-up and to maintain records of business communications.

Contact form enquiries (where engagement follows)

Retained for the duration of engagement plus 6 years. To comply with statutory limitation periods for contractual claims and professional record-keeping.

Marketing consent records

Retained until consent is withdrawn, plus 2 years. To evidence consent and manage opt-out requests.

Website analytics data

Aggregated and anonymised data retained indefinitely. Identifiable data (e.g., IP addresses) retained for up to 26 months. In line with Wix's data retention practices and to understand Website usage trends.

Correspondence and communications

Retained for 6 years from date of communication. To comply with statutory limitation periods and maintain business records.

6.3 Deletion. When personal data is no longer required, we will securely delete or anonymise it.

7. COOKIES AND SIMILAR TECHNOLOGIES

7.1 What Are Cookies? Cookies (or pixels) are small text files placed on your device when you visit a website. They help the website function, improve your experience, and provide information to the website owner.

7.2 Cookies We Use. Our Website uses the following categories of cookies:

Strictly necessary cookies

Essential for the Website to function (e.g., security, load balancing, session management). Consent requirement: No consent required under PECR. These are exempt as strictly necessary for the service you request.

Functional and analytics cookies

To understand how visitors use our Website, which pages are most popular, and how to improve the user experience. Consent requirement: Consent. We request your consent before setting these cookies via our cookie banner, unless exempt in which case we rely on our legitimate interests to understand Website traffic.

Marketing cookies

To deliver advertisement (including via third parties) and measure the effectiveness of advertising campaigns. Consent requirement: Consent. We request your consent before setting non-essential marketing cookies.

7.3 Third-Party Cookies. Our Website is built on the Wix platform, which may set cookies for its own purposes. Please refer to Wix's cookie policy for details: www.wix.com/about/cookie-policy.

7.4 Managing Cookies. When you first visit our Website, you will be presented with a cookie banner allowing

you to accept or reject non-essential cookies. You can change your preferences at any time by:

(a) adjusting your browser settings to block or delete cookies (note that this may affect Website functionality); or

(b) using the cookie settings pop-up.

7.5 Further Information. For more information about cookies, including how to manage them, visit www.allaboutcookies.org.

8. YOUR RIGHTS

8.1 Overview. Under the UK GDPR, you have the following rights in relation to your personal data. These rights are subject to certain conditions and exemptions.

8.2 Your Rights.

Right of access

You have the right to request a copy of the personal data we hold about you and information about how we process it.

Right to rectification

You have the right to request correction of inaccurate personal data or completion of incomplete data.

Right to erasure

You have the right to request deletion of your personal data in certain circumstances (e.g., where it is no longer necessary for the purpose for which it was collected).

Right to restriction

You have the right to request that we restrict processing of your personal data in certain circumstances (e.g., while we verify accuracy following a dispute).

Right to data portability

Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.

Right to object

You have the right to object to processing based on legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary for legal claims. You have an absolute right to object to direct marketing at any time.

Right to withdraw consent

Where we process personal data based on your consent, you have the right to withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

Right not to be subject to automated decision-making

You have the right not to be subject to decisions based solely on automated processing (including profiling) that produce legal or similarly significant effects. We do not currently make such decisions.

8.3 How to Exercise Your Rights. To exercise any of your rights, please contact us at: olga.sakka@congs.co.uk.

We will respond to your request within one month. In complex cases or where we receive a large number of requests, we may extend this by up to two further months, and we will inform you if this is necessary.

8.4 Identity Verification. We may need to verify your identity before responding to your request. This is a security measure to ensure personal data is not disclosed to unauthorised persons.

8.5 No Fee Usually Required. You will not usually have to pay a fee to exercise your rights. However, we may charge a reasonable fee or refuse to comply with your request if it is manifestly unfounded or excessive.

9. COMPLAINTS

9.1 Complaints to Us. If you have any concerns about how we handle your personal data, please contact us first using the details in Section 1.2. We will investigate and respond to your complaint.

9.2 Right to Complain to the ICO. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection. We would, however, appreciate the opportunity to address your concerns before you contact the ICO.

Information Commissioner's Office Website: www.ico.org.uk Telephone: 0303 123 1113 Post: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

10. SECURITY

10.1 Security Measures. We have implemented appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:

(a) use of secure hosting infrastructure (via Wix);

(b) encryption of data in transit (HTTPS/TLS);

(d) regular review of our security practices.

10.2 Your Responsibilities. While we take steps to protect your personal data, no method of transmission over the internet is completely secure. Please do not send sensitive personal information via our contact form or unencrypted email.

11. THIRD-PARTY LINKS

Our Website may contain links to third-party websites. This Privacy Policy applies only to our Website. We are not responsible for the privacy practices of third-party websites, and we encourage you to read their privacy policies before providing any personal data.

12. CHILDREN

Our Website is not directed at individuals under the age of 18, and we do not knowingly collect personal data from children. If you believe we have inadvertently collected personal data from a child, please contact us immediately so we can delete it.

13. CONTACT US

If you have any questions about this Privacy Policy or our data protection practices, please contact us:

CONGs LTD Email: olga.sakka@congs.co.uk Address: 67 Hounslow Road, Hanworth, Feltham, England, TW13 6QA Website: www.congs.co.uk