Privacy Policy

This policy explains what we do with personal information across everything Cornerstone Solutions & Services Ltd does: our website, our online shop, our consultancy and auditing work, our training, the Cornerstone platform we host for clients, the contracts we issue, the confidential reporting channels we run, and our mobile apps, SchenGain and EuroVisa.

It is written to be read, not just to sit in a footer. If anything in it is unclear, ask us and we will explain it properly.

1. Who we are and how to contact us

Cornerstone Solutions & Services Ltd is a UK company providing quality and compliance consultancy, auditing, training, compliance software and compliance documentation to manufacturers and their supply chains.

For anything to do with your personal information, including any of the rights in section 19, contact:

We are not required to appoint a Data Protection Officer and we have not appointed one. Robert Low is accountable for data protection in the business.

If you are unhappy with how we have handled your information you can complain to the Information Commissioner’s Office at ico.org.uk/make-a-complaint, by calling 0303 123 1113, or by writing to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. We would much rather you came to us first so we can put things right.

2. What this policy covers, and what it does not

This policy covers:

• the website at cornerstonesolutions.uk, including the shop, the free calculators and resources, learner and reseller areas, support tickets and the contract portal;
• the Cornerstone compliance platform, whether you are on a free trial or a paid subscription;
• our consultancy, internal auditing, verification and advisory services;
• training we deliver, both our own courses and courses we deliver as an Approved Training Partner or Academy trainer;
• documentation and document kits we sell or personalise;
• the confidential reporting channels we host for client sites;
• our SchenGain and EuroVisa Android apps.

This policy does not cover:

• other organisations we work alongside that operate independently of Cornerstone, including Apex Global Quality, which is a separate business with its own privacy arrangements;
• BRCGS, which is an independent organisation and its own data controller for the courses, qualifications and registrations it administers. Where you book a BRCGS Academy course, BRCGS handles your booking and your certification record under its own privacy policy;
• your own employer’s handling of your information, where you are using the Cornerstone platform or a confidential reporting channel that your employer has arranged;
• third party websites we link to.

3. When we are the controller and when we are the processor

This distinction matters, because it changes who you go to about your information.

We are the controller, deciding why and how information is used, for: our own website visitors, enquiries and marketing, our shop customers, our own training delegates, our own client relationships, our contracts, our supplier records, and our own working papers from consultancy and audit work.

We are a processor, acting on a client’s instructions, for: the content a client puts into the Cornerstone platform we host for them, and the reports submitted through a confidential reporting channel registered by a client site. In those cases the client organisation is the controller. If you are an employee of one of our clients and you want to exercise your rights over data held in those systems, contact your employer first. If you contact us instead, we will point you to them and let them know, unless doing so would undermine the anonymity of a confidential report.

Where we act as a processor we do so under a written data processing agreement that reflects Article 28 of the UK GDPR. Clients can request a copy of our standard terms at any time.

4. Visitors to our website

You can browse most of cornerstonesolutions.uk, including our articles and our free calculators, without telling us who you are.

What we collect automatically. Our web server records standard technical information each time a page is requested: your IP address, the date and time, the page requested, the referring page, and your browser and device type. This is ordinary server logging, it is how the site is kept available and secure, and we do not use it to build a profile of you.

Analytics. We use Google Analytics, connected through the Google Site Kit plugin, to understand which pages are read and how people find us. Google Analytics sets cookies and processes a truncated version of your IP address. We do not use Google Analytics for advertising, we have not enabled Google Signals or advertising features, and we do not link analytics data to any account you hold with us. Section 20 lists the cookies and tells you how to refuse them.

Fonts. Some pages load typefaces from Google Fonts. When this happens your browser connects to Google’s servers and Google receives your IP address as part of that request.

Free calculators and resources. Our AQL calculator, Julian date code tool, weights and measures calculator, barcode checker and SG cup calibration tool run in your browser. The values you type into them are not sent to us and are not stored.

Reviews and testimonials. Where we publish a review or testimonial that names a person or a company, we do so with that person’s agreement, and we will remove it on request.

5. Enquiries, demos and free trials

Contact forms

Our contact form asks for your name, business, email address, telephone number, the subject of your enquiry and your message. All of it goes into an email to us. We use a honeypot field to catch spam rather than a CAPTCHA, so nothing about you is sent to a third party in order to check you are a real person.

Booking a demo or an activity

Demos, calls and other activities are booked through our own scheduling system on this website. When you book we collect your name, email address, company, the date and time you have chosen, your time zone and anything you tell us in the booking notes, and we use them to hold the appointment and prepare for it.

There is no third party booking service involved. The scheduler is ours, it runs on our own UK infrastructure, and nothing about your booking is passed to anyone outside Cornerstone.

Free trials of the platform

When you start a 30 day free trial we collect the details you give us at signup, which will include your name, work email address, company name and the login credentials you set. We use these to create and support your trial instance, to help you get value out of it, and to follow up with you about whether you want to continue. No payment card is required for a trial and we do not ask for one.

If you do not convert to a paid subscription, we delete the trial instance and the data inside it. See section 17 for how long we wait first.

Marketing

We may email existing customers about services closely related to something they have already bought from us, relying on the soft opt-in permitted by the Privacy and Electronic Communications Regulations. Every such email has an unsubscribe link and we act on unsubscribes promptly. We do not send unsolicited marketing to people who have only made an enquiry, and we do not buy marketing lists.

6. Buying documents and courses from our shop

Our shop sells downloadable documentation kits, templates and course places. It runs on WooCommerce.

What we collect. Your name, billing address, email address, telephone number, company name where you give one, your order details, and where relevant your VAT number. If you create an account we also hold your username, password in hashed form, and your order history.

Payment. Card payments are processed by Stripe. Your card details are entered directly into Stripe’s systems and are never seen, handled or stored by us or by our website. We receive only confirmation that a payment succeeded or failed, along with the card type and last four digits so we can match a payment to an order and handle refunds. Stripe is an independent controller of the payment data it collects for its own fraud prevention and regulatory obligations.

Invoices and accounts. We keep order and invoice records to meet our obligations under UK tax and company law.

Personalised documents. Where you ask us to personalise a document kit with your company details, we use the information you send us for that purpose only, and we do not reuse your company content in products sold to anyone else.

7. Training and learner records

We deliver training in more than one capacity, and who holds your record depends on which one applies.

Courses run by Cornerstone

For our own courses, including those we run as an Approved Training Partner, we collect the delegate’s name, email address, job title, employer, any accessibility or dietary requirements you tell us about, attendance, assessment results and the certificate issued. We use these to run the course, to assess competence, to issue and verify certificates, and to meet the record keeping requirements of the scheme owner. Where a scheme owner such as BRCGS requires us to submit delegate details and results so a certificate or qualification can be issued, we do so, and BRCGS becomes an independent controller of that record.

Where you tell us about an accessibility requirement so we can make an adjustment, we use it only to make that adjustment, we do not record any more detail than we need, and we delete it once the course has finished.

Courses run by the BRCGS Academy

Where BRCGS books the course and I attend as the trainer, BRCGS is the controller. It handles the booking, the delegate list, the materials and the certification, and its own privacy policy applies. We see the delegate list in order to teach, and we do not keep it afterwards beyond the attendance record the Academy requires.

Delivery platforms and recordings

Remote training is delivered and, where the course design requires it, recorded. Recordings made on the Cornerstone platform are held on our London servers. Where a course is delivered through BRCGS Educate, that platform is operated by BRCGS and its terms apply to any recording or learner tracking within it.

We tell delegates before a session begins if it is going to be recorded, and why. If you do not want to appear in a recording you can keep your camera off and use the chat rather than your microphone, and that will not count against you. We use Google Meet as our approved video confrencing system.

Learner accounts on our website

Where you register as a learner on our site, we hold your account details, your course enrolments, your progress, your quiz and assessment results and your certificates, so you can access your learning dashboard and so we can evidence completion.

8. Consultancy, auditing and advisory work

When we carry out consultancy, internal audits, verification, label review, technical file work or advisory work for a client, we inevitably come into contact with information about people who work there.

What we see and record. Typically: the names, job titles and contact details of the people we work with; signatures and approvals on documents; training and competence records; records of who carried out or checked a task; and information contained in nonconformities, complaints and investigations. Where we take photographs on site as audit evidence, we photograph process, product and premises. We avoid photographing identifiable individuals, and where a person is unavoidably in shot we will crop or blur them unless the image itself is the evidence and the client has agreed to it.

Sensitive material. Occupational health records, fitness to work assessments, return to work records and personnel files may be shown to us as evidence that a control is working. Where that happens, we look at what we need to see in order to verify the control, we record the fact that the evidence was seen and found adequate, and we do not copy the underlying record or transcribe medical detail into our reports. Section 13 covers this in more detail.

Our working papers. We keep our own audit notes, reports and correspondence as the record of the professional service we provided. We are the controller for those, on the basis of our legitimate interest in being able to evidence and defend our work.

Confidentiality. Everything we see on a client site is treated as confidential and is not disclosed to anyone else, other than as required by law or as set out in section 11 where a serious unaddressed product safety or legality concern arises.

9. The Cornerstone platform

The Cornerstone platform is our compliance software. We host it for clients on our own servers, and we act as the client’s processor for everything inside it.

Where it is hosted. On DigitalOcean infrastructure in the London (LON) region, in the United Kingdom. We do not host client instances outside the UK.

What tends to be in it. The client decides, but in practice a platform instance holds user accounts and login credentials, names and job titles, competence and training records, records of who raised, approved or closed an item, visitor and contractor records including arrival and departure times and vehicle details, supplier and customer contact details, and audit, nonconformance and complaint records that may name individuals. Some clients also store photographs.

What we do with it. We host it, back it up, keep it secure, support it and fix it. Our staff access client data only when it is needed to provide support, to investigate a fault, or to keep the service secure and running, and that access is logged. We do not use client data for our own purposes, we do not mine it, we do not sell it and we do not use it to train artificial intelligence models.

Backups. Instances are backed up so a client can be restored after a failure. Backups are held in the same UK region as the live system.

If you are an employee of a client. Your employer decides what goes into the platform and how long it stays there. Your rights are exercised through them.

Reseller and partner portal

Where you access the platform as a reseller or partner, we hold your account details, your client list and the commercial records of the arrangement between us, and we use them to administer that relationship.

Support tickets

When you raise a support ticket we collect your name, contact details, the instance concerned and whatever you tell us about the problem, including any screenshots or files you attach. Please avoid attaching more personal data than the problem needs. We use tickets to resolve the issue and to spot recurring faults.

10. Contracts and the visa portal

Contracts issued through our website

We issue and hold client contracts, quotations and agreements inside our own website rather than posting paper around. You reach your contract through a private link containing a unique identifier, and in some cases through a login.

When you view, accept or sign a contract we record the identifier of the link used, your name and email address, the date and time of each view and of acceptance, and the IP address the acceptance came from. That record exists for one reason: it is the evidence that the agreement was made, by whom and when. We keep it for as long as the contract could still be enforced or disputed.

Please treat your contract link as confidential, because anyone holding it can view that contract.

11. Confidential reporting channels

We provide confidential reporting channels free of charge so that client sites can meet the confidential reporting requirement in the BRCGS Standards. This section matters, so please read it carefully.

If you are making a report

The reporting form is anonymous by design. We do not ask for your name. We do not record your IP address. We do not set tracking cookies on the reporting page. There is no analytics on it. We have deliberately built it so that we cannot identify you, and neither can your employer.

Two things follow from that, and you should know them before you submit anything:

• Anything you type into the report is stored as you wrote it. If you put your own name, or the name of a colleague, into the free text, that information will be there. Only include what is needed to explain the concern.
• Your employer’s senior management contact can reply to you through the system without ever knowing who you are, so it is worth checking back for a response.

Who reads it. Reports go to the senior management contact registered by your site. We act as the processor holding the report on that site’s behalf. Cornerstone staff may access reports for support and service oversight, and that access is logged.

One exception you should be aware of. Where a report raises a serious concern about product safety or legality and it appears not to have been addressed, we may refer the matter to the relevant certification body or regulatory authority. We would refer the substance of the concern. We could not identify you to them even if we wanted to, because we do not hold your identity.

Protected disclosures. Nothing in this policy or in the service affects your rights under the Public Interest Disclosure Act 1998, or your ability to report a concern directly to a prescribed person or regulator instead of, or as well as, using this channel.

If you are registering a channel for your site

To set a channel up we collect your company name, your site or plant name, the standard you are certificated to, and the name and email address of your senior management contact. We use these to create the channel, to send new report notifications, to provide the dashboard, and to contact you about the service. Your senior management contact is named in the staff notice we generate, so that your people know who receives reports.

The service is provided free of charge and as-is, which is set out on the registration page and in our terms. Your organisation remains the controller of the reports and is responsible for assessing them, recording the outcome and retaining the evidence its certification requires.

12. Our mobile apps

This section is the privacy policy for our Android apps, SchenGain and EuroVisa, and is referenced from their Google Play listings. Neither app sends us any of your information.

SchenGain

What the app stores on your device. SchenGain helps you track days spent in the Schengen area against the 90 days in any 180 day rule. To do that it stores, in the app’s own storage on your phone: the traveller name or names you enter, date of birth, and your entry and exit dates and the countries they relate to.

What we receive. Nothing. The app does not transmit your entries to us or to anyone else.

Permissions. The app does not request access to your location, your contacts, your camera or your microphone. Notification are required for notifying users.

Analytics, crash reporting and advertising. The app contains no advertising, no third party analytics and no crash reporting SDK.

Backups. If you have Android backup switched on, your device may include app data in your own Google account backup. That is a function of your phone and your Google account, it is controlled by your Android settings, and we have no access to it.

Deleting your data. Because everything is on your device, you delete it yourself: clear the app’s data from Android Settings, or uninstall the app. Both remove everything permanently. There is no data held by us to request deletion of.

Children. SchenGain is a travel tracking tool intended for adults and is not directed at children.

Questions about the app. Email robert.low@cornerstonesolutions.uk.

EuroVisa

EuroVisa helps you organise an application for the Spanish or Portuguese digital nomad visa. It is designed so that we never receive your information. There is no account, no signup and no login, and no server to sync to.

What the app stores on your device. Your answers to its questions, the dates and progress you record, the names and relationships of anyone applying with you, and any documents you attach, for example a passport, a certificate or a bank statement. They are kept only in the app’s own storage on your phone. Documents are encrypted on the phone with a key held in your phone’s secure hardware.

What we receive. Nothing. The app does not transmit your information to us or to anyone else.

Camera and files. When you take a photo in the app, your phone’s camera app takes it and hands it to EuroVisa, which removes any location information embedded in it and encrypts it. The app does not request the camera permission itself. When you upload a file, the app keeps its own encrypted copy and no link to the original.

When information leaves your phone. Only when you choose: “Export my data” and “Download pack” write a file to a place you pick, and “Share” hands a file to an app you pick. A file you export is not encrypted, and the app tells you so.

Permissions. The app does not request access to your location, your contacts, your camera or your microphone. It asks for notifications only if you turn reminders on; reminders are calculated and shown on your phone.

Analytics, crash reporting and advertising. The app contains no advertising, no third party analytics and no crash reporting SDK.

Backups. Documents and the key that encrypts them are excluded from Android backup and device-to-device transfer, so they are not copied to your Google account backup.

Purchases. EuroVisa Pro is bought through Google Play, which processes the payment under Google’s own privacy policy. The app learns only whether Pro has been bought on your Google account.

Deleting your data. “Delete all data” in the app’s Settings removes everything it holds, including every document and the key that encrypted them. Uninstalling the app does the same. There is no data held by us to request deletion of.

Children. EuroVisa is intended for adults. A child’s name and relationship may be recorded by an adult applying on their behalf; it stays on that adult’s phone.

Questions about the app. Email robert.low@cornerstonesolutions.uk.

13. Special category and criminal offence information

Most of what we handle is ordinary business information. Occasionally something more sensitive appears, and we want to be straight about where and why.

Where it can arise:

• occupational health, fitness to work and sickness absence evidence shown to us during an audit or consultancy visit, which is health data;
• accessibility or dietary requirements a delegate tells us about so we can make an adjustment for a course;
• free text inside a confidential report or a client’s nonconformance record, which can contain allegations about a named individual, and occasionally information amounting to criminal offence data under Article 10 of the UK GDPR;
• client records in the platform that a client has chosen to store, where the client decides what is held and why.

How we handle it. We do not seek it out. We record the minimum needed for the purpose, and in audit work we generally record that evidence was seen and found adequate rather than copying the underlying detail. Access is restricted to those who need it. It is deleted on the ordinary retention schedule or sooner.

Our conditions for processing it. Where we handle special category data as a controller we rely on Article 9(2)(b) of the UK GDPR, employment and social protection obligations, or Article 9(2)(f), the establishment, exercise or defence of legal claims, and the corresponding conditions in Schedule 1 to the Data Protection Act 2018. Where criminal offence data arises in a confidential report we handle it under Schedule 1 Part 2 paragraph 10 of that Act, preventing or detecting unlawful acts. We maintain an Appropriate Policy Document as required by Schedule 1 Part 4, and a copy is available on request.

14. Our lawful bases

We have to have a lawful basis for everything we do with personal information. Here is the honest map of ours.

What we are doing	Our lawful basis
Responding to your enquiry or demo request	Legitimate interests: answering people who ask us things, and taking steps at your request before entering a contract
Supplying documents, courses, consultancy, audits or the platform to you	Performance of a contract with you, or steps at your request before entering one
Running a free trial	Steps taken at your request before entering a contract
Keeping invoices, order records and VAT records	Legal obligation under tax and company law
Issuing and evidencing contracts, including the IP address and timestamp of acceptance	Legitimate interests: proving that an agreement was made and by whom
Analytics cookies on the website	Consent, given through the cookie banner
Marketing emails to existing customers about similar services	Legitimate interests, with the soft opt-in under PECR and an unsubscribe in every message
Site security, server logging, spam prevention and fraud prevention	Legitimate interests: keeping the service available, secure and free from abuse
Keeping our audit and consultancy working papers	Legitimate interests: evidencing and, if needed, defending the professional service we provided
Delegate records and certificates required by a scheme owner	Performance of a contract, and legitimate interests in meeting scheme requirements
Health or other special category information seen during audit work	Article 9(2)(b) or 9(2)(f) UK GDPR, with the Schedule 1 conditions in section 13
Content inside a client’s platform instance or confidential reporting channel	We act as processor. The client sets the lawful basis
Data in the SchenGain and EuroVisa apps	Not applicable. We do not receive or process any of it

Where we rely on legitimate interests we have considered whether our interest is outweighed by your rights, and we will explain our reasoning to you on request. Where we rely on consent, you can withdraw it at any time and that will not affect anything done before you withdrew it.

15. Who we share information with

We do not sell personal information and we do not share it for anyone else’s marketing. We do share it with the suppliers below, each of which acts as our processor under contract unless stated otherwise.

Who	What for	Where the data sits
DigitalOcean	Hosting the Cornerstone platform and client instances	London, United Kingdom
GoDaddy	Hosting cornerstonesolutions.uk, the shop and the contract portal	London, United Kingdom
Stripe	Card payment processing. Stripe is also an independent controller for its own fraud and regulatory purposes	EU and USA
Google (Analytics and Site Kit)	Website analytics	EU and USA
Google Fonts	Serving typefaces to your browser	EU and USA
GoDaddy	Business email, and live remote training delivery	London, United Kingdom
BRCGS	Delegate registration, certification and qualification records for BRCGS courses. BRCGS is an independent controller	United Kingdom
Our accountant	Bookkeeping, VAT and statutory accounts	United Kingdom

We will also disclose information where we are legally required to, for example to a regulator, a court or HMRC, and in the limited circumstances described in section 11 concerning unaddressed product safety or legality concerns. If the business is ever sold or merged, personal information would transfer to the buyer, who would be bound by this policy until they told you otherwise.

We keep the list above current. If you want to know exactly who processes your information at a given moment, ask us and we will tell you.

16. Sending information outside the UK

Client data in the Cornerstone platform stays in the UK. Data in the SchenGain and EuroVisa apps never leaves your device unless you choose to export or share it.

Some of the suppliers in section 15, notably Stripe, Google and Calendly, are based in or route data through the United States. Where personal information is transferred outside the UK we rely on the UK’s adequacy regulations where they apply, or on the International Data Transfer Agreement, or on the UK Addendum to the European Commission’s Standard Contractual Clauses, together with a transfer risk assessment. You can ask us for details of the safeguard used for any particular transfer.

17. How long we keep things

We keep information for as long as we need it, and no longer. In practice:

What	How long
Enquiries that do not become work	24 months from your last contact with us
Customer records, orders, invoices and VAT records	7 years from the end of the financial year they relate to
Contracts and the evidence of their acceptance	7 years after the contract ends, or 13 years where it was executed as a deed
Consultancy and audit working papers and reports	The life of the engagement plus 6 years
Training records, assessments and certificates	5 years, or longer where the scheme owner requires it
Training recordings	3 Months
Free trial instances and their contents	Deleted 30 days after the trial ends if you do not subscribe
Live platform instances	For the term of the subscription. After it ends we make an export available for 30 days, then delete the instance and purge it from backups on the ordinary backup cycle
Confidential reports	Held for the client site until the client deletes them or closes the channel, then deleted
Support tickets	3 years from closure
Website server logs	90 days
Google Analytics data	14 months
Marketing list entries	Until you unsubscribe, and we then keep a suppression record so we do not email you again by mistake

Where something is due for deletion but is caught up in a backup, it stays in that backup until the backup expires on its normal cycle, and it is not restored into live use in the meantime.

18. How we keep information secure

• Everything is served over HTTPS, and data in transit is encrypted.
• Platform instances are hosted on UK infrastructure with access restricted to named administrators, and passwords are stored hashed, never in readable form.
• Administrative access is protected by strong, unique credentials and multi-factor authentication where the service supports it.
• Access to client data is on a need to know basis and support access is logged.
• We keep systems patched and we take regular backups, held in the same UK region as the live data.
• We do not process card details ourselves, so there are none to lose.
• Confidential reporting is built so that it does not capture identifying information in the first place, which is the strongest protection available for a reporter.

No system is perfectly secure. If a breach happens that is likely to result in a risk to people’s rights and freedoms, we will report it to the ICO within 72 hours of becoming aware of it, and we will tell affected people directly where the risk is high. Where we are acting as a processor we will tell the client controller without undue delay so they can meet their own obligations.

If you think you have found a security problem in our website, our platform or our apps, please tell us at robert.low@cornerstonesolutions.uk. We will not pursue anyone who reports a genuine issue to us responsibly.

19. Your rights

Under UK data protection law you have the right to:

• be told what we do with your information, which is what this policy is for;
• get a copy of the personal information we hold about you;
• have it corrected if it is wrong or incomplete;
• have it deleted, where we no longer have a good reason to keep it;
• restrict what we do with it while a concern is being sorted out;
• receive it in a portable format, or have it sent to another provider, where we hold it by consent or under a contract and it is processed by automated means;
• object to processing based on our legitimate interests, and to object to direct marketing at any time, which we will always honour;
• withdraw consent at any time where consent is what we relied on.

How to use them. Email robert.low@cornerstonesolutions.uk or write to the address in section 1. Tell us what you want and enough for us to find your records. We may ask you to confirm your identity, because we do not want to hand your information to someone else. It is free, and we will respond within one month. If your request is complex we may take up to a further two months, and we will tell you within the first month if that is going to happen and why.

Two limits worth knowing. If your information sits inside a client’s platform instance or a client’s confidential reporting channel, we are the processor and we will pass your request to that client rather than acting on it ourselves. And because SchenGain and EuroVisa hold nothing on our side, there is nothing for us to give you, correct or delete.

You can also complain to the ICO, using the details in section 1. Doing so does not stop you asking us to fix things as well.

20. Cookies and similar technologies

A cookie is a small file a website asks your browser to store. Some are needed to make a site work at all. Others, like analytics, are not, and the law says we need your permission before we set those.

Cookies we use

Cookie	Set by	Purpose	Type	Expires
PHPSESSID	Our website	Keeps your session together as you move between pages	Strictly necessary	End of session
wordpress_logged_in_*, wp-settings-*	Our website	Keeps you logged in and remembers your interface settings. Only set if you have an account with us	Strictly necessary	Session to 1 year
woocommerce_cart_hash, woocommerce_items_in_cart, wp_woocommerce_session_*	WooCommerce	Remembers what is in your basket and keeps your checkout working	Strictly necessary	Session to 2 days
Stripe cookies (__stripe_mid, __stripe_sid)	Stripe	Processes your payment and detects fraudulent transactions	Strictly necessary	Session to 1 year
_ga, _ga_*	Google Analytics	Counts visits and tells us which pages are read, using a randomly generated identifier	Analytics, consent required	13 months
Calendly cookies	Calendly	Only set if you open the booking widget, to run the booking	Functional	Varies, see Calendly’s policy

Strictly necessary cookies are set without asking, because the site cannot do what you asked of it without them. Everything else is set only if you agree.

The confidential reporting pages

No analytics and no tracking cookies run on the confidential reporting form. This is deliberate.

Managing cookies

You can change your choice at any time through the cookie settings link in the footer, and you can delete or block cookies in your browser settings. Blocking strictly necessary cookies will stop parts of the site, particularly the shop and any logged in area, from working.

21. Children

Our services are sold to businesses and are aimed at people working in them. We do not knowingly collect information about children, and none of our services are directed at them. If you believe a child has given us personal information, tell us and we will delete it.

22. Automated decision making

We do not make decisions about you by automated means alone, and we do not profile you. Where our platform calculates a score, a sampling plan or a risk rating, that is a tool for a person to use, and a person makes the decision.

23. Changes to this policy

We review this policy at least every two years, and whenever we change what we do with personal information. The next scheduled review is September 2028. The version number and dates are at the top of the page. If we make a significant change we will say so on the website, and where the change affects an existing client or subscriber we will tell them directly.

---

Cornerstone Solutions & Services Ltd, 11 Orion Drive, Norwich, Norfolk, NR5 0WB. Company number 13682285. VAT 455358864. ICO registration ZB310445.
See also our Terms and Conditions.