Privacy Policy

1. Who we are, and our two roles

We are the controller for personal data we collect for our own purposes: visitors to chorum.io, people who contact us or sign up, our customers' account users, and the business contacts we hold in our own CRM.

We are a processor for the data our customers put into the Chorum platform about their own customers, staff and contacts ("Customer Data"). Our customer decides how that data is used and is the controller for it. Our Data Processing Agreement covers that processing. If your details are held in a Chorum customer's account, please contact that organisation first; we will help them answer you.

We operate in the United Kingdom only. We do not have a representative in the EU. Contact us about anything in this policy at help@chorum.io.

2. What we collect, why, and our lawful basis

Where we rely on legitimate interests, we have weighed our interest (running and growing a business software company securely) against your rights, and you can object at any time (section 7).

3. Where the data comes from

• From you, when you use our website, forms, emails or the platform.
• From your organisation, when it creates a Chorum account for you or adds you as a contact.
• From public business sources, such as Companies House or a company website, when we contact a business about Chorum.

4. Who we share it with

We do not sell personal data. We share it only with:

• the suppliers below, under written contracts that bind them to process it only on our instructions and keep it secure (UK GDPR Art. 28);
• professional advisers such as accountants and lawyers, under a duty of confidence;
• HMRC, the police, courts or regulators where the law requires it;
• a buyer of all or part of our business, who would have to use it in line with this policy.

5. International transfers

We host the platform and its databases in London, United Kingdom. Some suppliers above are based in Ireland or the United States. The Safeguard column in the table above shows what each of those transfers relies on. Ask us for a copy of the safeguard that applies.

6. How long we keep it

We keep personal data only as long as we need it. These are the default periods. Customers can set shorter ones for their own Customer Data.

We may keep anonymised or aggregated figures, which no longer identify anyone, for longer.

7. Your rights

Under UK GDPR you can ask us to:

• Access: give you a copy of the personal data we hold about you;
• Rectify: correct anything inaccurate or incomplete;
• Erase: delete your data where there is no good reason to keep it;
• Restrict: pause our use of it while a question is resolved;
• Port: give you data you provided in a machine-readable format;
• Object: stop processing based on legitimate interests, and always stop direct marketing;
• Withdraw consent: at any time, where we rely on it, without affecting what happened before.

Email help@chorum.io. We will answer within one month, and tell you if a complex request needs up to two more months. There is no charge. Every marketing email has an unsubscribe link that works straight away.

You can also complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to put things right first.

8. Cookies

We only set analytics cookies if you accept them. Our Cookie Policy lists every cookie and how long it lasts. You can change your choice at any time in Cookie settings.

9. Automated decisions and AI

We do not make decisions with legal or similarly significant effects about you by automated means alone. AI features in the platform draft or summarise content for a person to review; they only run when a user starts them, and the text is sent to Anthropic under a contract that bars training on it.

10. Security

Data is encrypted in transit with TLS. Each customer's platform runs in its own isolated environment with its own database. Staff access is limited to people who need it for support or operations. If we have a personal data breach, we tell the ICO within 72 hours of becoming aware of it where feasible, and we tell the people affected without undue delay if it is likely to put their rights at high risk.

11. Children

Chorum is a business service and is not meant for anyone under 18. We do not knowingly collect children's data.

12. Changes to this policy

We will post any change here with a new date. If a change matters to how we use your data, we will also email account holders before it takes effect.