Working draft. This policy has not yet been reviewed by legal counsel. Please have it approved, and the bracketed items confirmed, before the site goes live.

1. Who we are

CognitivZen (“CognitivZen”, “we”, “us”, “our”) is a digital engineering services company with offices in San Jose, California, United States, and Hyderabad, India. This policy applies to cognitivzen.com and to personal information we handle in the course of marketing, sales and client relationships.

For information we process on behalf of a client under a services agreement, that client is the controller and their own privacy notice governs. We act as a processor and handle the information only on their documented instructions.

Data controller contact: marketing@cognitivzen.com. [Confirm the correct legal entity name, registered address, and whether an EU/UK representative or Data Protection Officer must be named.]

2. Information we collect

Information you give us

  • Contact details you submit through our enquiry form — name, company, work email, and the description of what you are looking to build.
  • Information you send us directly by email, or share during calls and meetings.
  • Application materials, where you apply for a role with us.

Information collected automatically

  • Technical data: IP address, browser type and version, device type, operating system and screen size.
  • Usage data: pages viewed, time on page, referring URL and approximate location derived from IP address.
  • Cookies and similar technologies, as described in section 10.

We do not ask for, and ask that you do not send us, sensitive categories of personal data — health information, government identifiers, payment card numbers, or similar — through this website.

3. How we use information

  • To respond to your enquiry and to prepare a proposal or estimate.
  • To provide, maintain and improve our services and this website.
  • To send business communications you have asked for, and marketing communications where you have consented or where we are permitted to do so.
  • To keep our systems secure, prevent misuse, and investigate incidents.
  • To meet legal, accounting, audit and regulatory obligations.

We do not sell personal information, and we do not use it to make decisions about you by automated means alone.

4. Legal bases for processing

Where the UK GDPR or EU GDPR applies, we rely on the following bases:

  • Legitimate interests — responding to business enquiries, operating and securing the site, and understanding how it is used.
  • Performance of a contract — delivering services under an agreement with you or your organisation.
  • Consent — non-essential cookies and marketing email, which you may withdraw at any time.
  • Legal obligation — where we must retain or disclose information by law.

5. Sharing and disclosure

We share personal information only with:

  • Service providers who work on our behalf — hosting, email delivery, analytics and CRM — under contracts that limit what they may do with it. [List the actual sub-processors in use.]
  • Professional advisers, including lawyers, auditors and insurers, where necessary.
  • Authorities, where we are required to do so by law or to establish or defend legal claims.
  • An acquirer or successor, in connection with a merger, acquisition or sale of assets, subject to this policy.

6. International transfers

We operate from the United States and India, so information you give us may be transferred to and processed in either country. Where information is transferred out of the UK, the European Economic Area or another region with transfer restrictions, we put appropriate safeguards in place — ordinarily the relevant Standard Contractual Clauses together with a transfer risk assessment. [Confirm the safeguards actually in place and where copies can be requested.]

7. How long we keep information

We keep personal information only as long as we need it for the purpose it was collected, then delete it or anonymise it. Enquiry records are ordinarily retained for [period to confirm]; client relationship and contractual records for as long as the relationship continues and afterwards for the period required by tax, accounting and limitation rules.

8. Security

CognitivZen maintains an information security programme certified to ISO/IEC 27001 and reports against SOC 2 Type II criteria. Measures include access control on a need-to-know basis, encryption in transit, logging and monitoring, supplier due diligence, staff training and an incident response process. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9. Your rights

Depending on where you live, you may have the right to:

  • Ask what personal information we hold about you and get a copy of it.
  • Have inaccurate information corrected, or incomplete information completed.
  • Ask us to delete information, or to restrict or object to how we use it.
  • Ask for information you gave us to be sent to you or another provider in a portable format.
  • Withdraw consent at any time, without affecting processing already carried out.
  • Complain to your data protection authority. In the UK this is the Information Commissioner’s Office; in the EU it is the supervisory authority where you live or work.

If you are a California resident, you also have the rights to know, delete, correct, and to opt out of sale or sharing under the CCPA as amended by the CPRA. We do not sell or share personal information as those terms are defined, and we will not discriminate against you for exercising any right.

To exercise a right, write to marketing@cognitivzen.com. We will respond within the period the applicable law allows, and may need to verify your identity first.

10. Cookies

We use cookies and similar technologies that are strictly necessary for the site to work, and — where you consent — analytics cookies that help us understand how the site is used. You can control cookies through your browser settings; blocking necessary cookies may stop parts of the site working. [Confirm the analytics and marketing tools in use, and whether a consent banner is required for the site’s audience.]

11. Children

This website is intended for business audiences. We do not knowingly collect personal information from anyone under 16. If you believe a child has given us information, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. The “last updated” date at the top shows when it last changed, and material changes will be signalled on this page.

13. Contact us

Questions about this policy or about how we handle personal information: marketing@cognitivzen.com, or write to us at our San Jose or Hyderabad office.

Back to home