Privacy Policy

The data controller responsible for your personal data is:

We collect data in two ways:

a) Data you provide directly

• Name, work email address, company name, and job title — submitted via our contact form or enquiry emails
• Information about your platform, technical challenges, and business context — provided voluntarily when you reach out
• Communications content — emails and messages you send to us

b) Data collected automatically

• IP address and approximate geographic location (country/city level)
• Browser type, device type, operating system
• Pages visited, time spent, and navigation path on our website
• Referring URL (how you arrived at our site)

Automatic data is collected via cookies and analytics tools only where you have given consent. See Section 8 (Cookies) for details.

We use your data for the following purposes:

• Responding to enquiries — to read, assess, and reply to messages submitted through our contact form or by email
• Scoping engagements — to understand your platform context and assess whether we can help
• Sending relevant follow-up communications — such as assessment findings, proposals, or resources you have requested
• Improving our website — analysing aggregated, anonymised usage data to improve site content and user experience
• Complying with legal obligations — retaining records where required by applicable law

We do not use your data for automated decision-making or profiling. We do not send unsolicited marketing emails.

For individuals in the European Economic Area (EEA), the United Kingdom, or other jurisdictions with similar data protection laws, we process personal data on the following legal bases:

• Legitimate interests (Article 6(1)(f) GDPR) — responding to professional enquiries and assessing potential engagements. Our legitimate interest is providing B2B engineering services; this processing does not override your rights.
• Consent (Article 6(1)(a) GDPR) — for the use of analytics cookies and optional marketing communications. You may withdraw consent at any time.
• Legal obligation (Article 6(1)(c) GDPR) — where retention is required by law.

We retain personal data for as long as necessary for the purposes described above:

• Enquiry and contact data — up to 24 months from last contact. If an engagement commences, data is retained for the duration of the engagement plus 24 months.
• Analytics data — aggregated, anonymised data may be retained indefinitely. Individual-level analytics data is retained for up to 14 months.
• Legal records — retained for the period required by applicable law (typically 5–7 years for commercial records in the UAE).

After the applicable retention period, data is securely deleted or anonymised.

If you are in the EEA, UK, or a jurisdiction with equivalent privacy rights, you have the following rights in relation to your personal data:

• Right of access — request a copy of the personal data we hold about you
• Right to rectification — request correction of inaccurate or incomplete data
• Right to erasure — request deletion of your data, subject to legal retention obligations
• Right to restriction — request that we restrict processing in certain circumstances
• Right to data portability — receive your data in a structured, machine-readable format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — withdraw consent for cookie or marketing processing at any time, without affecting the lawfulness of prior processing

To exercise any of these rights, email sales@coreinnovate.co. We will respond within 30 days. If you believe we have not handled your data correctly, you have the right to lodge a complaint with your national data protection authority.

We do not sell your personal data. We may share it in the following limited circumstances:

• Service providers — third-party tools used to operate our website and business (e.g. hosting, email delivery, analytics). These providers process data only on our instructions and are bound by appropriate data processing agreements.
• Legal requirements — where disclosure is required by law, court order, or regulatory authority.
• Business transfers — in the event of a merger, acquisition, or asset sale, personal data may be transferred to the relevant party, subject to equivalent privacy protections.

Where we transfer data outside the EEA, we ensure appropriate safeguards are in place (e.g. Standard Contractual Clauses or adequacy decisions).

Our website uses cookies and similar technologies. For full details of the cookies we use, your consent choices, and how to manage them, please see our Cookie Policy.

Analytics and non-essential cookies are only placed after you have given explicit consent through our cookie consent banner. You can change your cookie preferences at any time.

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or destruction. These include HTTPS encryption, access controls, and regular security reviews. No method of transmission over the internet is 100% secure; we cannot guarantee absolute security but we take all reasonable steps to protect your data.

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable law. The “Last updated” date at the top of this page indicates when it was last revised. We encourage you to review this page periodically. Continued use of our website after changes are posted constitutes acceptance of the updated policy.

For any questions about this Privacy Policy, to exercise your rights, or to raise a data protection concern, contact us at: