Privacy notice
What we collect, why, and what you can do about it.
We sell governance advice, so it would be poor form to be vague about our own. This notice covers the website and our client work.
Last updated 6 September 2026
Who is responsible
The data controller is Vicerta Corporation Limited, trading as Cursoria Consulting, a company registered in England & Wales under number 15954721, registered office Petersham Dr, Orpington, Kent, BR5 2QF.
For anything in this notice, write to hello@cursoriaconsulting.com.
This website sets no cookies
There is no analytics, no tracking pixel, no advertising tag and no cookie banner, because there is nothing to consent to. We do not know who visits this site or which pages they read.
What we collect, and when
- When you send an enquiry
- Your name, email address, school or organisation, and whatever you write in the message.
- When you apply for a Twilight Session
- Your name, role, school, email address, school type, approximate staff numbers, whether you publish an AI position, your preferred timing, who approves the spend, and any context you add.
- When you book a call
- Your name, email address and chosen time, handled by our booking provider.
- During a paid engagement
- Working contact details for the people involved, and the material you choose to share with us through the Client Hub.
We do not ask for special category data, and we ask schools not to send us pupil personal data. If it is unavoidable for a piece of work, it is governed by a separate written agreement rather than by this notice.
Why we are allowed to hold it
- Legitimate interests
- Replying to an enquiry you sent us, and following up on a conversation you started. You can object at any time and we will stop.
- Contract
- Delivering a session, an audit or a programme you have engaged us for, and invoicing it.
- Legal obligation
- Keeping accounting records, which is why invoice data outlives everything else here.
- Consent
- Sending you our newsletter, if you asked for it. Withdrawing is one click and does not affect anything else.
How long we keep it
- An enquiry that goes nowhere
- Deleted within 12 months.
- An enquiry that becomes a conversation
- Kept for the duration, then 24 months.
- Client records
- 6 years after the engagement ends, for accounting and professional indemnity.
- Newsletter subscription
- Until you unsubscribe.
Who else touches it
We use a small number of providers to run the business. Each acts on our instructions, and none of them sells or profiles your data.
- Vercel
- Hosts this website.
- Resend
- Delivers form submissions to our inbox.
- Zoho
- Our business email.
- Cal.com
- Booking and calendar.
- Supabase
- Powers the Client Hub, hosted in the EU (London region).
Some of these providers operate outside the UK. Where they do, transfers rely on the UK International Data Transfer Addendum or adequacy regulations. We do not sell personal data or share it for advertising, ever.
Your rights
Under UK GDPR you can ask us for a copy of what we hold, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, object to our use of it, or ask for it in a portable format. Email us and we will answer within one month, usually the same week.
If we get it wrong, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would rather you told us first, but it is your right either way.
Changes
If this notice changes materially we will date the new version and tell anyone it affects. We will not quietly widen it.