Your privacy.

KORCO is a web design studio run by Koray Saliah, a sole trader, trading as KORCO. He decides how your information is used, so in data protection terms he is the controller.

For anything on this page, email hello@korco.co.uk or ring 07834 223616.

When you send an enquiry

Your name, business name, email address, phone number if you give it, and your message. We use it to reply to you and talk about your project.

Legal basis: taking the steps you asked for before a possible contract.

When you book a call

Your name, email address, business name, any notes you add and the time you picked. It becomes an event in our Google Calendar, you get a calendar invite with a video link, and we get an email saying you booked.

To stop automated bookings, Cloudflare Turnstile checks that the form is being used by a person, and we count bookings from each IP address so that nobody can fill the calendar.

Legal basis: taking the steps you asked for before a possible contract.

If you are a client using the portal

Your name and email address, your project details and the dates it moved between stages, a record of what has happened on your project (which your portal shows you), the contracts and invoices we share with you, and uptime checks on your website. If you sign in with Google, Google gives us your name, email address and profile picture.

What you send us through the portal: messages and change requests, the files you attach to them, and your answers to the checklist of things your website needs, such as your logo, photos, opening hours and who your domain is registered with. Photos can carry the place they were taken; we remove that location data before we store them.

When you approve a design or ask for changes to it, we record the decision, any comment you write, the email address you were signed in with and the time. That record cannot be edited afterwards, by you or by us, because it is how we both know what was agreed.

Each time you sign in we also record the IP address, the browser and device you used, and when. That lets us keep the portal secure and stop anyone trying to guess their way in. The portal shows you the devices you are signed in on, and lets you sign the others out.

We email you when your project moves on, when we message you or post a design for you to look at, at most once an hour, and you can turn those emails off in the portal under Account. An email about a message includes it, or its opening lines if it is long. Sign-in links are always sent, because they are how you get in. When you send us something through the portal, we are emailed about it too, and that email quotes your message or comment, or its opening lines if it is long. We keep a log of each email the portal sends: what kind it was and when, not who it went to or what it said. It lets us stay within our email provider’s daily limit.

Legal basis: our contract with you for the portal itself, and our legitimate interest in keeping it secure for the sign-in records and in running it within its limits for the email log.

When you visit the site

We do not use analytics, advertising or tracking of any kind. Like every website, the servers that deliver it see your IP address, and so does Google when your browser loads the site's typeface from Google Fonts.

When something looks like an attack, such as too many requests, a forged link or a refused sign-in, the server records what happened and the IP address it came from. We use these records only to protect the site and the portal.

Legal basis: our legitimate interest in running and protecting the site.

We never sell your information, and we do not add you to a mailing list. Nothing about you is decided by an automated system.

A few services do part of the work for us. They handle your information only to provide that service, under contract, and not for their own purposes.

Cloudflare

Hosts the site, stores the portal's records in a database in Western Europe, keeps portal files private, and forwards email sent to hello@korco.co.uk.

Google

Runs our email inbox and calendar, provides Google sign-in for the portal, and serves the site's typeface.

Resend

Sends portal sign-in links, portal emails and booking alerts, including the emails that carry the text of a portal message.

Web3Forms

Delivers the enquiry form to our inbox.

Some of these companies are based in the United States, so your information may be handled there. When that happens it is covered by safeguards approved under UK law, such as the UK Extension to the EU-US Data Privacy Framework or the international data transfer agreement.

Enquiries and bookings

Twelve months from our last contact, if they do not lead to a project. If they do, they become part of the project record.

Project records and portal accounts

For as long as we are building or hosting your site, then twelve months after that ends. Deleting a portal account deletes its files, its messages, its sign-in records and its history with it.

Messages, files and checklist answers

Kept with your project record, for the same time. A file you take back from the checklist before we have ticked it off is deleted straight away.

Design approvals

Kept with your project record, for the same time, and never edited while they are kept. Deleting a portal account deletes them with it.

Sign-in records

Only while that sign-in lasts. Each one is deleted shortly after it ends: when you sign out, when you sign that device out from the portal, or when it runs out. That is after a day if you did not ask to stay signed in, or after 30 days without using the portal if you did.

Security records

Three days, after which Cloudflare deletes them. The counters that limit how often something can be done are deleted within a day.

The email log

90 days. Older entries are deleted automatically.

Uptime checks

About a month. Older checks are deleted automatically.

Contracts and invoices

Six years after the end of the tax year they belong to, because tax law requires us to keep them.

The public site sets no cookies. It keeps two small notes in your browser for the length of your visit: one so the opening screen does not play again every time you change page, and one so the back button returns you to where you were on a page. Both are cleared when you close the tab, and neither leaves your device.

The client portal uses cookies only to keep you signed in and to complete a sign-in, including Google sign-in. Without them the portal cannot work, so the law does not ask us to request your consent for them, and there is no cookie banner. None of them track you or are shared with anyone.

How long the sign-in cookie lasts is your choice. Normally it is deleted when you close your browser. If you tick “Keep me signed in for 30 days”, it stays for 30 days and starts again each time you use the portal, so you are only asked to sign in again after a month away. A second cookie, kept only until the browser closes, remembers that you did not tick it, and Google sign-in uses one more for a few minutes while it completes.

If we ever add a cookie that is not essential, we will ask first and update this page.

You can ask us to:

• give you a copy of the information we hold about you
• correct anything that is wrong
• delete it, unless the law requires us to keep it, as with invoices
• limit how we use it, or stop using it where we rely on legitimate interest
• send it to you or another company in a format a computer can read

Email hello@korco.co.uk and we will reply within a month. It is free.

If you are unhappy with how we have handled your information, please tell us first so we can put it right. You also have the right to complain to the Information Commissioner's Office, the UK regulator.

When what we collect or who handles it changes, this page changes with it, and the date at the top moves. If a change affects portal clients, we will email them about it.

Get in touch with any question about it.