Privacy

This notice explains how The Private Office of Courtney Jordan Incorporated (“the Office”, “we”, “us”) collects, uses and protects personal information through this website. It is written to meet the requirements of the UK General Data Protection Regulation (“UK GDPR”), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (“PECR”), the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”), and the comparable privacy laws of other US states.

1. Who we are

The Office is the controller of the personal information described in this notice. You can reach us about any privacy matter through the contact page, using the subject “Privacy request”.

2. Information we collect

• Correspondence. When you use the contact form, we collect your name, email address, the subject and content of your message, and the IP address from which it was sent.
• Team accounts. Members of staff and invited collaborators who use the private team area provide their name, email address and any profile details, messages and files they choose to share. Requests for access are recorded with the details supplied.
• Technical information. Our hosting provider records standard server logs, including IP address, browser type, pages requested and the date and time of each request.
• Cookies. See section 8.

We do not knowingly collect sensitive personal information, and we ask that you do not send it to us through this website.

3. How we use it, and our legal bases

• To read and respond to correspondence, on the basis of our legitimate interest in handling enquiries addressed to the Office (UK GDPR Article 6(1)(f)).
• To provide and secure the team area, on the basis of our legitimate interest in enabling our staff and partners to work together, or to take steps toward or perform an agreement with you (Article 6(1)(b) and (f)).
• To keep this website secure and to prevent misuse, on the basis of our legitimate interest in protecting our systems and users.
• To comply with our legal obligations (Article 6(1)(c)).
• Where analytics are enabled, to understand how the website is used, with your consent where the law requires it (Article 6(1)(a)).

4. Sharing

We share personal information only with service providers who process it on our behalf under written contracts, such as our website hosting and email providers, and with professional advisers or authorities where the law requires. We do not sell personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA. We have not done so in the preceding twelve months.

5. International transfers

The Office operates in the United Kingdom and the United States, so your information may be processed in either country. Where we transfer personal information out of the United Kingdom, we rely on an adequacy regulation (including the UK Extension to the EU-US Data Privacy Framework where applicable) or on the International Data Transfer Agreement or Addendum issued by the Information Commissioner.

6. How long we keep it

• Correspondence: up to 24 months after our last exchange, unless a longer period is needed for a continuing matter.
• Team accounts and messages: for as long as the account is active, and up to 12 months afterward.
• Server logs: up to 90 days.

7. Your rights

United Kingdom and European Economic Area

You have the right to request access to your personal information, to have it corrected or erased, to restrict or object to its use, and to receive it in a portable format. Where we rely on consent, you may withdraw it at any time. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk, although we would welcome the chance to resolve your concern first.

United States

Depending on your state of residence, including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon and others with comparable laws, you may have the right to know what personal information we hold about you, to obtain a copy, to correct it, to delete it, and to opt out of its sale, sharing for targeted advertising, or profiling. As explained above, we do not sell or share personal information for those purposes. We will not discriminate against you for exercising any of these rights.

You may make a request yourself or through an authorized agent. We will verify your request by matching the information you provide with what we hold. If we decline a request, you may appeal by replying to our decision, and residents of states that provide for it may contact their state attorney general if they remain dissatisfied.

8. Cookies and similar technologies

This website sets one strictly necessary cookie, cj_session, which keeps forms secure and keeps team members signed in. It is exempt from consent under PECR and expires when your browser closes. We do not use advertising cookies. If analytics are enabled, they are configured to anonymize IP addresses, and where consent is required we ask for it first. We honor Global Privacy Control signals as a valid request to opt out of sale or sharing.

9. Children

This website is not directed to children under 13 in the United States or under 16 in the United Kingdom, and we do not knowingly collect their personal information. If you believe a child has sent us information, please contact us and we will delete it.

10. Security

We use encrypted connections, hashed passwords, access controls and restricted storage for files shared in the team area. No system is perfectly secure, and we will notify you and the relevant authorities of any breach where the law requires.

11. Changes to this notice

We will update this notice when our practices change. The date of the latest revision appears below.