Last updated: June 2026
Protecting personal information is a fundamental component of Cortextual's commitment to operating a secure, transparent, and trustworthy platform.
As an AI-powered organisational intelligence platform, Cortextual enables organisations to organise institutional knowledge, improve operational visibility, and support workforce transformation through the responsible use of technology. In providing these services, we process personal information in a variety of contexts and recognise the importance of doing so lawfully, fairly, transparently, and securely.
This Privacy Notice explains how Cortextual collects, uses, stores, discloses, transfers, and otherwise processes personal information in connection with the operation of our website, the provision of our platform, our commercial activities, and our interactions with customers, users, business partners, suppliers, and other individuals.
It also explains the legal bases on which we process personal information, the safeguards we implement to protect it, the circumstances in which personal information may be shared with third parties, and the rights available to individuals under applicable data protection legislation.
This Privacy Notice forms part of Cortextual's broader governance framework and should be read together with our Security & Trust, Responsible AI & AI Transparency, Cookie Notice, Terms of Service, and any applicable contractual documentation governing the use of the Cortextual platform.
Where Cortextual processes personal information solely on behalf of one of its customers, such processing is generally governed by the contractual arrangements concluded with that customer, including any applicable Data Processing Agreement. In those circumstances, this Privacy Notice explains Cortextual's own privacy practices but does not replace the privacy information that our customers are responsible for providing to individuals whose personal information they control.
Cortextual develops and operates an AI-powered organisational intelligence platform that enables organisations to organise, preserve, and utilise organisational knowledge while supporting operational efficiency, workforce transformation, and the responsible adoption of artificial intelligence.
Depending on the nature of the processing activity, Cortextual may process personal information either as a data controller or as a data processor (or the equivalent concepts under applicable data protection legislation).
Where we determine the purposes and means of processing personal information relating to our own business operations—including our website, sales activities, marketing, customer relationships, supplier management, and operation of our business—we generally act as a data controller.
Where we process personal information solely to provide our platform and related services on behalf of a customer, we generally act as a data processor, processing personal information only in accordance with the customer's documented instructions and the applicable contractual arrangements.
The capacity in which we process personal information therefore depends upon the particular processing activity, the relevant contractual framework, and the applicable legal requirements.
This Privacy Notice applies whenever personal information is processed by Cortextual in connection with the operation of our website, the provision of our products and services, customer onboarding, administration of user accounts, AI-enabled functionality, customer support, authorised integrations with third-party services, commercial communications, recruitment activities, supplier management, and other activities carried out in the ordinary course of our business.
The Notice applies irrespective of whether personal information is provided directly by an individual, supplied by one of our customers during implementation or use of the platform, generated through the operation of our services, or obtained from authorised third-party sources.
The processing activities described in this Notice may therefore apply to website visitors, prospective customers, customer contacts, organisation owners, administrators, managers, employees, invited users, suppliers, business partners, applicants, and other individuals whose personal information is processed through the use of our products and services.
The specific processing activities applicable to an individual will naturally depend upon the manner in which that individual interacts with Cortextual and the services provided.
Cortextual processes personal information obtained from a variety of lawful sources depending upon the services being provided and the manner in which our platform is used.
In many cases, personal information is provided directly by individuals. This includes information submitted when requesting a demonstration of our services, creating a user account, communicating with our personnel, registering for events, subscribing to communications, participating in onboarding activities, requesting customer support, or otherwise interacting with Cortextual.
Personal information may also be provided by our customers as part of their implementation and use of the Cortextual platform. For example, customers may configure organisational structures, create user accounts, invite employees to access the platform, establish user permissions, connect authorised business systems, or upload organisational information that contains personal information.
Certain information is generated automatically through the operation of the platform. This includes technical information relating to authentication, platform usage, system performance, device characteristics, browser configuration, security monitoring, log files, and other information necessary to ensure the secure, reliable, and efficient operation of our services.
Where customers choose to connect third-party applications or business systems to Cortextual, the platform may also receive personal information from those authorised integrations in accordance with the permissions configured by the customer and the applicable contractual arrangements.
In limited circumstances, we may also receive personal information from publicly available sources, professional networking platforms, business partners, service providers, or other lawful third-party sources where doing so is appropriate, proportionate, and permitted by applicable law.
Cortextual processes personal information only where there is an appropriate legal basis for doing so and only for legitimate and specified purposes.
The manner in which personal information is used depends upon the relationship between the individual and Cortextual, the services being provided, and the role Cortextual performs in relation to the relevant processing activity.
Where we act as a data controller, we may process personal information to operate and improve the Cortextual platform, provide requested products and services, administer user accounts, authenticate users, facilitate customer onboarding, provide technical support, manage customer relationships, communicate with customers and prospective customers, conduct demonstrations of our services, manage subscriptions and licensing, fulfil contractual obligations, comply with legal and regulatory requirements, protect the security of our platform, investigate potential misuse, respond to enquiries, improve our products and services, and operate our business efficiently.
Where Cortextual acts as a data processor, we process personal information solely for the purposes of providing the services requested by the relevant customer and in accordance with that customer's documented instructions.
We do not process personal information for purposes that are incompatible with those described in this Privacy Notice unless required or permitted by applicable law.
Where Cortextual acts as a data controller, we process personal information only where an appropriate legal basis exists under applicable data protection legislation.
Depending on the particular processing activity, personal information may be processed because it is necessary for the performance of a contract, to take steps prior to entering into a contract at the request of an individual, to comply with legal or regulatory obligations, to pursue our legitimate business interests where those interests are not overridden by the rights and freedoms of individuals, or, where required by law, on the basis of an individual's consent.
Our legitimate interests may include operating and improving the Cortextual platform, maintaining the security and integrity of our systems, providing customer support, developing new products and functionality, preventing fraud and misuse, protecting our legal rights, managing our business operations, and communicating with customers and prospective customers regarding our products and services.
Where processing is based on consent, individuals may withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out prior to its withdrawal.
Where Cortextual acts solely as a data processor, the relevant customer is responsible for determining the appropriate legal basis for the processing of personal information carried out through the platform.
Artificial intelligence forms an integral part of the Cortextual platform and supports a range of functionality designed to assist organisations in accessing and understanding organisational knowledge more effectively.
Depending on the functionality used, AI-enabled features may process personal information contained within customer-provided information, authorised knowledge sources, user prompts, platform interactions, and AI-generated responses. Such processing is carried out solely for the purpose of providing the requested functionality, improving user experience, maintaining platform security, supporting system performance, and continuously improving the quality and reliability of the services provided.
Cortextual does not use customer information indiscriminately for the development or training of artificial intelligence models. The manner in which customer information is processed in connection with AI functionality depends upon the services provided, the contractual arrangements concluded with the customer, the technical architecture supporting the relevant functionality, and the applicable legal framework.
Where AI-enabled functionality processes personal information on behalf of a customer, such processing is performed solely in accordance with the customer's documented instructions and the applicable contractual arrangements.
The operation of AI functionality is also governed by the principles described in our Responsible AI & AI Transparency Statement, including our commitments relating to transparency, human oversight, accountability, information security, and responsible innovation.
Cortextual treats personal information as confidential and does not sell personal information to third parties.
Personal information may, however, be disclosed where necessary to provide our services, fulfil contractual obligations, comply with applicable legal requirements, protect our legitimate interests, or otherwise operate our business effectively.
Depending upon the circumstances, personal information may be shared with carefully selected service providers supporting the operation of our platform, including providers of cloud infrastructure, hosting services, customer support systems, communication platforms, payment processing services, security services, analytics tools, professional advisers, auditors, insurers, and other providers whose services are necessary for the operation of our business.
Where customers choose to integrate third-party applications or business systems with the Cortextual platform, personal information may also be exchanged with those authorised integrations in accordance with the permissions configured by the customer.
We may also disclose personal information where required by applicable law, regulation, judicial process, or requests from competent public authorities, or where disclosure is necessary to establish, exercise, or defend legal claims, protect the rights or safety of Cortextual, our customers, or other individuals, investigate suspected unlawful activity, or facilitate a corporate transaction such as a merger, acquisition, restructuring, or sale of assets.
Where third parties process personal information on our behalf, we seek to ensure that appropriate contractual and organisational safeguards are implemented to protect such information and to ensure that processing is carried out only for authorised purposes.
Cortextual may process or permit the processing of personal information in jurisdictions outside the country in which the information was originally collected.
Where personal information is transferred internationally, we seek to ensure that appropriate safeguards are implemented to provide an adequate level of protection consistent with applicable data protection legislation.
Depending upon the circumstances, such safeguards may include adequacy decisions adopted by competent authorities, Standard Contractual Clauses approved by the European Commission or other competent supervisory authorities, legally recognised transfer mechanisms, contractual safeguards, or other appropriate measures required under applicable law.
Where Cortextual processes personal information on behalf of customers, international transfers are carried out in accordance with the applicable contractual arrangements governing the provision of our services.
Cortextual retains personal information only for as long as necessary to fulfil the purposes for which it was collected, to comply with applicable legal obligations, to resolve disputes, enforce contractual arrangements, protect our legitimate interests, or satisfy other lawful business purposes.
The appropriate retention period depends upon a number of factors, including the nature of the personal information, the purpose of the processing, applicable legal or regulatory requirements, contractual obligations, operational necessity, and the potential risks associated with continued retention.
Where personal information is no longer required for the purposes for which it was collected, we seek to securely delete, anonymise, or otherwise dispose of that information in accordance with our internal retention practices and applicable legal requirements.
Where Cortextual processes personal information solely on behalf of a customer, the retention of such information is governed primarily by the applicable contractual arrangements and the customer's documented instructions.
Protecting personal information forms an essential part of our broader commitment to information security and organisational governance.
Cortextual implements technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, unauthorised access, or other forms of unlawful processing.
These safeguards are designed having regard to the nature of the information processed, the risks associated with the processing activities, recognised industry practices, applicable legal requirements, and the continuing evolution of cybersecurity threats.
Further information regarding our approach to information security, infrastructure protection, incident response, vulnerability management, encryption, and operational resilience is available in our Security & Trust documentation.
While we continuously seek to maintain an appropriate level of security, no method of electronic transmission or storage can be guaranteed to be completely secure. Accordingly, organisations and users also play an important role in maintaining the security of their own accounts, credentials, devices, and organisational information.
Cortextual is committed to respecting the rights of individuals in relation to their personal information. Subject to the applicable data protection legislation and the specific circumstances in which personal information is processed, individuals may be entitled to exercise a number of rights regarding the processing of their personal information.
These rights may include the right to obtain confirmation as to whether personal information relating to them is being processed, to request access to that information, to request the correction of inaccurate or incomplete personal information, and, in certain circumstances, to request the deletion of personal information where there is no longer a lawful basis for its continued processing.
Individuals may also have the right to request that the processing of their personal information be restricted, to object to certain categories of processing, including processing carried out on the basis of legitimate interests, and, where technically feasible and legally applicable, to receive certain personal information in a structured, commonly used, and machine-readable format or to request that such information be transmitted directly to another controller.
Where processing is based upon consent, individuals have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out prior to its withdrawal.
The availability of these rights depends upon the applicable legal framework and the role Cortextual performs in relation to the relevant processing activity.
Where Cortextual processes personal information solely on behalf of one of its customers as a data processor, requests relating to the exercise of data protection rights should generally be directed to the relevant customer, who acts as the data controller and is responsible for determining how such requests should be addressed. Where appropriate, Cortextual will provide reasonable assistance to its customers in responding to such requests in accordance with applicable law and the contractual arrangements governing the provision of the services.
Individuals also have the right to lodge a complaint with the competent data protection supervisory authority if they believe that the processing of their personal information infringes applicable data protection legislation. We encourage individuals to contact us first so that we have an opportunity to understand and address any concerns before they are referred to a supervisory authority.
The Cortextual website and certain components of the Cortextual platform use cookies and similar technologies to support the operation, security, performance, and functionality of our online services.
These technologies enable us to maintain user sessions, authenticate users, remember preferences, improve website and platform performance, understand how our services are used, identify technical issues, protect against fraudulent or malicious activity, and, where permitted, support analytics and marketing activities.
The specific cookies and similar technologies used may differ depending on whether an individual is visiting the public website, accessing the authenticated platform, or interacting with particular functionality within the Cortextual services.
Where required by applicable law, we will obtain consent before placing non-essential cookies or similar technologies on a user's device. Individuals may also manage or withdraw their cookie preferences at any time through the mechanisms made available on our website or platform.
Further information regarding the categories of cookies we use, their purposes, applicable retention periods, and available user controls is available in our separate Cookie Notice, which forms part of this Privacy Notice and should be read together with it.
The Cortextual platform has been developed for use by organisations and business users. It is not directed towards children, nor is it intended to be used by individuals who are not legally permitted to enter into binding contractual arrangements under the applicable laws of their jurisdiction.
Cortextual does not knowingly collect personal information directly from children or intentionally provide services to children.
Where we become aware that personal information has been collected from a child in circumstances that are not authorised by applicable law, we will take appropriate steps to investigate the matter and, where required, delete the relevant personal information or otherwise address the issue in accordance with applicable legal requirements.
If you believe that a child has provided personal information to Cortextual inappropriately, we encourage you to contact us using the details provided below.
Privacy regulation, technology, and the services provided by Cortextual continue to evolve. Accordingly, we may amend or update this Privacy Notice from time to time to reflect changes in our products and services, our processing activities, our governance framework, applicable legal requirements, or recognised industry practices.
Where changes are material, we may provide additional notice through the Cortextual platform, our website, or other appropriate communication channels where required by applicable law or where we consider it appropriate to do so.
The most current version of this Privacy Notice will always be made available through the Cortextual Trust Centre and will indicate the date on which it was last updated. We encourage users and customers to review this Privacy Notice periodically to remain informed about how personal information is processed and protected.
If you have any questions regarding this Privacy Notice, the processing of your personal information, or your privacy rights, you may contact Cortextual using the details below.
Privacy Team
Email: privacy@cortextual.com
If your enquiry relates specifically to information security, cybersecurity incidents, or the reporting of potential security vulnerabilities, please refer to our Security & Trust documentation.
If your enquiry concerns the governance or operation of AI-enabled functionality within the Cortextual platform, please refer to our Responsible AI & AI Transparency Statement or contact our Legal & Compliance Team.
Where applicable, individuals may also contact our Data Protection Officer or designated privacy representative using the contact details published on our website or otherwise made available to customers.
We are committed to handling privacy enquiries promptly, transparently, and in accordance with applicable data protection legislation.
