UK Privacy Notice

This notice explains how Cogniv GmbH handles personal data about people in the United Kingdom, and it applies the UK General Data Protection Regulation and the Data Protection Act 2018. It covers two groups: people whose work contact details we hold because we may write to them about our product, and people who contact us.

If you visited this website and want to know what the site itself records, that is set out in our German privacy policy, which covers server logs, hosting and the contact form.

Who we are

The data controller is:

Cogniv GmbH
Schicklerstraße 5
10179 Berlin
Germany

Managing Director: Michael Bejan
Email: [email protected]

Registered with the Information Commissioner's Office (ICO), registration reference ZC207928.

Our UK representative

Cogniv GmbH is established in Germany and has no establishment in the United Kingdom. Under Article 27 of the UK GDPR we have appointed a representative in the UK. You may contact our representative instead of, or as well as, us about anything in this notice — including to exercise any of your rights.

Alexander Kuhnle
UK Representative for Cogniv GmbH
Email: [email protected]

A postal address for our representative is available on request from the email address above.

Business contact data: what we hold and where we got it

We build a list of organisations in the UK whose published work includes helping people claim what they are entitled to — housing associations, local authorities and advice charities — so that we can write to the person who leads that work.

For those organisations we may hold: the organisation name and website, a work email address, a work telephone number, and where the organisation publishes it, a person's name and job title.

Where it came from: we did not collect this from you. It came from one of two public sources, and only ever from these two:

• your own organisation's public website; or
• a public register your organisation is listed on — for charities, the register of charities published by the Charity Commission for England and Wales, which includes the contact details your organisation gave the Commission for publication.

We do not buy contact lists, we do not take contact details from social media or from data brokers, and we do not guess or generate contact details that were not published. If you ask us, we will tell you which of the two sources your details came from.

Why we use it, and our lawful basis

We use it for one purpose: to contact you once, at work, about a product intended to help you do the job your organisation publicly describes you as doing.

Our lawful basis is legitimate interests (Article 6(1)(f) UK GDPR). Our interest is in reaching the small number of people for whom this product is relevant. We have weighed that against your interests: the details were published by your organisation for business contact, our message relates directly to your professional role, we write individually rather than by automated campaign, and you can stop it with a one-word reply. If you would like a copy of that assessment, ask and we will send it.

Who we share it with

Nobody. We do not sell, rent or share business contact data with third parties, and we do not use it for any purpose other than the one above.

Where it is held

Our systems are operated from Germany and hosted in the European Union. The UK recognises the EU as providing an adequate level of protection for personal data, so no additional transfer safeguards are required.

How long we keep it

• Contact details we have not used, and have not re-checked against the published source, are deleted 12 months after we collected them.
• Where we have recorded that an organisation is not a fit, the person-level fields — name, job title, personal work email — are cleared after 6 months.
• If you ask us not to contact you, we keep the minimum needed to honour that — normally just your email domain or address — indefinitely. That is deliberate: it is the only way to guarantee we never contact you again, and deleting it would defeat your own request.

Your rights

Under the UK GDPR you have the right to ask us for a copy of the personal data we hold about you, to have it corrected, to have it erased, to restrict how we use it, to object to our use of it, and to receive it in a portable format. You do not have to give a reason, and exercising any of these rights is free.

The quickest way to stop hearing from us:reply to any email from us with the word "no", or write to [email protected]. We will add you to our do-not-contact list the same working day, delete your details from our working records, confirm it once, and never write again. Where you object to direct marketing, that right is absolute — we will not ask you to justify it or try to change your mind.

We will respond to any request within one month.

Complaining to the regulator

If you are unhappy with how we have handled your personal data you can complain to the Information Commissioner's Office. You can do that without contacting us first, but we would rather have the chance to put it right.

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113
ico.org.uk/make-a-complaint

Changes to this notice

If we change how we use personal data we will update this page and change the date at the top. If the change is significant we will tell the people it affects.