Privacy policy

1. Who we are

This policy explains how Corelane handles personal data when you visit corelane.uk, contact us, or work with us as a client. Corelane is the trading name of CORELANE LTD.

We apply the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Questions about this policy or your data can be sent to the e-mail address above.

2. Controller and processor roles

We play two different roles depending on the data involved.

When we are a controller

We decide how and why personal data is used for our own business: enquiries and correspondence, contact details of people at client and prospective client businesses, contracts, invoicing and supplier records. This policy mainly describes that processing.

When we are a processor

When a client gives us access to their advertising accounts, analytics properties, CRM exports or customer lists (for example, lists uploaded for Customer Match or custom audiences), we process that personal data only on the client's documented instructions, as a processor under Article 28 of the UK GDPR. In those cases the client is the controller, and our obligations are set out in a written data processing agreement (DPA) signed before access is granted. The DPA covers confidentiality, security, use of sub-processors, assistance with data subject requests, breach notification, and deletion or return of data at the end of the engagement.

If you are a customer of one of our clients and want to exercise your rights over data held in their accounts, please contact that business directly. If you contact us, we will pass your request to them without delay.

3. Data we collect

As a controller we collect the following categories of personal data, almost always about people acting in a business capacity:

• Contact data: name, job title, business name, work e-mail address, telephone number.
• Correspondence: the content of e-mails, call notes, meeting recordings where everyone has agreed to recording, and messages in shared workspaces.
• Enquiry and engagement data: the services or packages you ask about, the information you share about your business, budgets and goals, proposals, statements of work and the history of our engagement.
• Order and billing data: the package or retainer you order, its price, invoicing contact, billing address, VAT number, payment status and records of payments received. We do not collect or store card details; payments are made by bank transfer or through your bank.
• Account access data: the user names or e-mail addresses used to grant us access to your advertising and analytics accounts. We do not ask for your passwords.
• Supplier data: contact and payment details of freelancers and suppliers we work with.

We receive this data directly from you, from colleagues at your business who introduce you, or from public business sources such as Companies House and your company website. This website has no forms: if you e-mail us using a link on the site, we receive what you choose to write.

As a processor we may also handle data contained in client accounts, such as audience lists, hashed e-mail addresses, conversion data and campaign reports. That data belongs to the client and is handled under the DPA described in section 2.

4. Purposes and lawful bases

We only use personal data where we have a lawful basis under Article 6 of the UK GDPR:

Where we rely on legitimate interests, we have balanced our interests against yours and concluded that the processing is expected in a business relationship and has minimal impact on privacy. You can ask us for details of that assessment and object at any time (see section 10).

We do not use personal data for automated decision-making that has legal or similarly significant effects on you, and we do not sell personal data.

5. Sharing with third parties

We share personal data only where needed for the purposes above:

• Our sub-processors and service providers: e-mail and office software, file storage, video calls, project management and accounting tools. They act on our instructions under written contracts.
• Advertising platforms and analytics providers: for example Google (Google Ads, Google Analytics, Merchant Center), Microsoft Advertising, Meta, TikTok and LinkedIn. When we upload audience lists or conversion data on a client's instructions, these platforms act either as the client's sub-processor or as separate controllers under their own terms, depending on the product. Their use of data is governed by their own privacy policies, and the client remains responsible for having a lawful basis and giving notice to its customers.
• Freelance specialists: designers, video editors or analysts working on your project under confidentiality and data protection terms.
• Professional advisers: accountants, lawyers and insurers, under duties of confidentiality.
• Authorities: HMRC, regulators, courts or law enforcement where the law requires it.
• Business transfers: a buyer or successor if our business is sold or reorganised, under equivalent protections.

We keep a list of the sub-processors used for client work, which is available to clients on request and attached to our DPA.

6. International transfers

Some of our providers and the advertising platforms store or access data outside the United Kingdom, including in the European Economic Area and the United States. When personal data leaves the UK we make sure one of the following safeguards applies:

• the destination is covered by UK adequacy regulations, including the UK Extension to the EU-US Data Privacy Framework for certified US organisations;
• the ICO's International Data Transfer Agreement (IDTA), or the International Data Transfer Addendum to the EU Standard Contractual Clauses (UK Addendum), is in place, supported by a transfer risk assessment;
• another exception permitted by UK law applies to a specific transfer.

You can ask us for more information about the safeguards used for a particular transfer.

7. How long we keep data

At the end of a retention period we delete data securely or anonymise it so it can no longer identify you.

8. Security

We use technical and organisational measures appropriate to the risk, including:

• access to client ad and analytics accounts through named user accounts with the lowest permission level the task needs, never shared passwords;
• two-factor authentication on every business system that supports it;
• encrypted devices, encrypted storage and transport, and regular updates;
• customer lists uploaded only in hashed form where the platform supports it, and never stored on personal devices;
• removal of our access to client accounts at the end of each engagement;
• confidentiality obligations for everyone who works with us.

If a personal data breach is likely to result in a risk to people's rights, we report it to the ICO within 72 hours and, where required, tell the people affected. Where we act as a processor, we notify the client without undue delay.

9. Cookies

This website does not set cookies, does not use analytics or advertising tags, and does not store anything in your browser. The pages are plain files served by our hosting provider, which may keep short-term server logs (such as IP address, time of request and browser type) for security and to keep the site running, on the basis of legitimate interests.

If we ever add cookies or similar technologies that are not strictly necessary, we will ask for your consent first and update this policy.

10. Your rights

Under the UK GDPR you have the following rights, subject to certain conditions and exemptions:

• Access: to get a copy of the personal data we hold about you.
• Rectification: to have inaccurate or incomplete data corrected.
• Erasure: to have your data deleted where there is no good reason for us to keep it.
• Restriction: to ask us to pause the use of your data, for example while accuracy is checked.
• Portability: to receive data you gave us in a structured, machine-readable format, or have it sent to another organisation, where processing is based on consent or contract and carried out by automated means.
• Objection: to object to processing based on legitimate interests, and to stop direct marketing at any time without giving a reason.
• Withdrawing consent: where we rely on consent, to withdraw it at any time.

To use any of these rights, e-mail [email protected]. We may need to confirm your identity. We reply within one month, which can be extended by up to two further months for complex requests, in which case we will tell you why. There is normally no fee.

11. Withdrawing consent

Where we rely on your consent, you can withdraw it at any time by e-mailing [email protected] or by using the opt-out link in any marketing e-mail. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it, and it does not affect processing based on other lawful bases, such as performing a contract.

12. Complaints and the ICO

If you are unhappy with how we have handled your data, please contact us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection:

13. Age restriction

Our services are offered to businesses only and are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a child has sent us personal data, please contact us and we will delete it.

14. Changes to this policy

We review this policy regularly and update it when our services, providers or the law change. The date at the top of the page shows when it was last updated. Where changes are significant, we will tell current clients by e-mail.

Last updated: 21 October 2026.