Privacy notice

This notice explains what personal data we collect when you visit runconnor.com or get in touch, why we collect it, the legal basis we rely on, who else sees it, how long we keep it, and what rights you have.

It covers this website only. If your organisation uses the Connor product, the personal data processed inside it is governed by your services agreement and the data processing addendum attached to it, where we act as your processor rather than as a controller.

Who we are

Connor is operated by Zindex Ltd, a company registered in England and Wales. We are the controller of the personal data described here. Reach us at james.zhao@runconnor.com, which is also the address for any privacy question or rights request.

Company number and registered office to be inserted before publication. We have not appointed a Data Protection Officer, and are not required to.

What we collect, and why

When you contact us

Our forms ask for your work email. A promotion review request also includes your selected jurisdiction and any asset you upload. These are emailed to our team through Resend so we can arrange your review. If you send us a message or reply to us, we hold whatever you choose to put in it. We use this to reply to you, to send you the example report if that is what you asked for, and to have a conversation about whether Connor is useful to your organisation.

Legal basis: legitimate interests (Article 6(1)(f)) — responding to somebody who has approached us about our product, which you would reasonably expect. For marketing you did not ask for we rely on consent or the soft opt-in under PECR, and every message carries an unsubscribe link.

When you visit

Our hosting provider processes your IP address and request details to serve the page and keep the service secure and available. This is ordinary server logging and happens for every website.

Legal basis: legitimate interests — operating and securing the site.

If you accept analytics

With your consent we use Vercel Analytics to count page views and see which pages get read. It records the page, the referrer, and coarse device and country information. It does not build a profile of you or follow you to other sites.

Legal basis:consent (Article 6(1)(a)), given through the banner and withdrawable at any time by clearing this site’s storage in your browser. Nothing analytical loads until you accept.

Cookies and local storage

We use browser storage for three things:

• Your theme preference — so the site is not the wrong colour every time you arrive. Strictly necessary; no consent required.
• Your answer to the cookie banner — so we do not ask again, and so we know whether analytics may run. Strictly necessary; no consent required.
• Analytics — only if you accept.

We use no advertising cookies and share nothing with advertising networks. Fonts are served from our own servers, so loading a page here does not send your IP address to a third-party font provider.

Who else sees your data

A small number of processors, each acting on our instructions under a written agreement:

• Vercel Inc. — hosting and, with your consent, analytics. United States, with transfers under the EU Standard Contractual Clauses and the UK Addendum, and the EU–US and UK–US Data Privacy Framework.
• Resend — delivering our replies, and the contact list you join when you ask us to send you something. United States, same transfer basis.
• Google Workspace — our own email, where any conversation with you ends up.

We do not sell personal data and do not share it for anybody else’s marketing. We may disclose data where the law requires it, or to advisers and to a buyer in connection with a financing or sale of the business, under confidentiality.

International transfers

Some processors above are in the United States. Where personal data leaves the UK or EEA we rely on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or on an adequacy decision where one applies, and we have satisfied ourselves the recipient can meet those terms.

How long we keep it

• Enquiries and correspondence: while the conversation is live, then up to 24 months, so we can pick it up if you come back.
• Contact list: until you unsubscribe, or after 24 months without engagement, whichever comes first.
• Server logs: as retained by our hosting provider, typically 30 days.
• Analytics: aggregate counts only, not tied to you.

We delete sooner on request, subject to anything we are legally required to keep.

Your rights

Under the UK GDPR you may ask us to give you a copy of your data, correct it, delete it, restrict what we do with it, or send it to somebody else in a portable form. You may object to processing we base on legitimate interests, and you may withdraw consent at any time without affecting what we did before you withdrew it.

Email james.zhao@runconnor.com and we will respond within one month, at no charge. If you are unhappy with how we handle it you can complain to the Information Commissioner’s Office at ico.org.uk, though we would rather you told us first so we can put it right.

Security

The site is served over HTTPS. Access to enquiry data is limited to the people who need it and protected by two-factor authentication. We hold no payment details on this website.

Children

Connor is sold to organisations. This site is not directed at children and we do not knowingly collect data from anybody under 16.

Changes

If we change this notice we will update the date above. Where a change materially affects how we use data you have already given us, we will tell you directly.