Privacy Policy

1.Scope

This Privacy Policy applies to:

• Visitors to the CosX website
• Customers, prospects, and partners
• Users of CosX platforms, APIs, dashboards, AI systems, and services
• Business contacts and vendors

2.Roles Under GDPR

For the purposes of GDPR:

• CosX acts as a Data Controller for website and marketing data.
• CosX acts as a Data Processor when processing customer data under contractual services.
• Processing is governed by contractual agreements and Data Processing Addendums (DPAs) where applicable.

3.Information We Collect

4.Lawful Basis for Processing (GDPR Article 6)

CosX processes personal data on the following lawful bases:

• Contractual necessity
• Legitimate business interests
• Legal and regulatory compliance
• Consent, where required

5.Purpose of Processing

We process data to:

• Deliver contracted services
• Operate and secure platforms
• Communicate with clients and partners
• Improve products and services
• Meet legal, audit, and compliance obligations

6.Data Minimisation & Purpose Limitation

CosX follows ISO 27001 principles of:

• Collecting only necessary data
• Using data strictly for defined purposes
• Periodic review and deletion of unnecessary data

7.Data Security (ISO 27001 Alignment)

CosX implements appropriate technical and organizational measures including:

• Role-based access control (RBAC)
• Encryption in transit and at rest (where applicable)
• Secure cloud infrastructure
• Audit logging and monitoring
• Documented access provisioning and offboarding
• Incident response and escalation procedures

Security controls are reviewed periodically as part of the Information Security Management System (ISMS).

8.Data Retention

Personal data is retained only for as long as:

• Required to fulfill contractual obligations
• Necessary for legitimate business purposes
• Required under applicable laws

Retention schedules are documented internally.

9.Data Sharing & Sub-Processors

CosX may share data with:

• Cloud hosting and infrastructure providers
• Analytics and communication service providers
• Professional advisors (legal, audit, compliance)
• Authorities when legally required

All sub-processors are subject to confidentiality and data-protection obligations.

10.International Data Transfers

Where personal data is transferred outside the EU/UK:

• Appropriate safeguards are applied (e.g., SCCs)
• Transfers comply with GDPR Chapter V requirements

11.Data Subject Rights (GDPR Articles 12–23)

You have the right to:

• Access your personal data
• Rectify inaccurate data
• Request erasure ("right to be forgotten")
• Restrict or object to processing
• Request data portability
• Withdraw consent (where applicable)

Requests may be sent to: admin@cosx.ai

12.Cookies

CosX uses cookies for:

• Website functionality
• Analytics and performance measurement

You may manage cookie preferences via browser settings.

13.Data Breach Notification

In the event of a personal data breach:

• CosX will assess impact promptly
• Notify relevant authorities and customers where legally required
• Take corrective and preventive actions

14.Changes to This Policy

This Privacy Policy may be updated periodically. Material changes will be published on this page.

15.Contact