Privacy Policy

We respect your privacy and are committed to protecting your personal data. This Privacy Policy will inform you as to how we look after your personal data when you visit our website (kocho.co.uk), regardless of where you visit it from, and tells you about your privacy rights and how the law protects you.

We keep this Privacy Notice under review and will reflect any updates or changes to practice within this Privacy Notice. This Notice was last reviewed on 28^th July 2025.

1 Important information and who we are

1.1 Purpose of this Privacy Policy

(a) This Privacy Policy aims to give you information on how we collect and process your personal data through your use of the website, including any data you may provide through the website when you:

• register with us
• register for any of our events or resources
• fill out our online contact form
• correspond with us
• purchase a product or service

(b) This website is not intended for children, and we do not knowingly collect data relating to children.

(c) It is important that you read this Privacy Policy together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you, so that you are fully aware of how and why we are using your data. This Privacy Policy supplements the other notices and is not intended to override them.

1.2 Controller

(a) Kocho is the controller and responsible for the Kocho website.

(b) Where recruitment is concerned, Kocho is a controller of personal data under the Data Protection Act 2018 (“DPA”) and the UK General Data Protection Regulation (“GDPR”) for all activities related to job applications and the recruitment process.

(c) We have appointed a Group Data Protection Officer (DPO) who is responsible for overseeing questions in relation to this Privacy Policy. If you have any questions about this Privacy Policy, including any requests to exercise your legal rights, please contact the DPO using the following details:

Group Data Protection Officer
Email: [email protected]

(d) You have the right to make a complaint at any time to the Information Commissioner’s Office, the UK supervisory authority for data protection issues (ico.org.uk) or to any equivalent body in the relevant jurisdiction (collectively, the “ICO”). We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

1.3 Changes to the privacy notice and your duty to inform us of changes

(a) It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

1.4 Third-party links

(a) This website may include links to third-party websites, plugins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave the website, we encourage you to read the privacy policy of every website you visit.

2 The data we collect about you

2.1 Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

2.2 We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• “Identity Data” includes first name, maiden name, last name, username or similar identifier, , title, , photographs, job title,.
• “Contact Data” includes billing address, residential address, delivery address, email address, work address, social media handles, telephone numbers.
• “Financial Data” includes bank account details.
• “Transaction Data” includes details about payments to and from you and other details of products and services you have purchased from us.
• “Technical Data” includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plugin types and versions, operating system and platform, full ‘Uniform Resource Locators’ clickstream to, through and from the Site (including date and time), and other technology on the devices you use to access the Site.
• “Profile Data” includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses, products you viewed or searched for; page response times; download errors; length of visits to certain pages; and page interaction information (such as scrolling, clicks, mouse-overs, and methods used to browse away from the page).
• “Usage Data” includes information about how you use the Site, products, and services.
• “Marketing and Communications Data” includes your preferences in receiving marketing from us and our third parties, and your communication preferences. Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we may have to cancel a product or service you have with us, but we will notify you if this is the case at the time.

3 How your personal data is collected

3.1 We use different methods to collect data from and about you including through:

(a) Direct interactions. You may give us your Identity Data, Contact Data and Financial Data by filling in forms or by corresponding with us by post, phone, email or otherwise . This includes personal data you provide when you:

• apply for our products or services
• register for any of our events
• create an account on the website
• request marketing to be sent to you
• promotion or survey
• give us some feedback

(b) Automated technologies or interactions. As you interact with the Site, we may automatically collect Technical Data about your equipment, browsing actions, and patterns. We collect this personal data by using cookies, server logs, and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies. See also section 4.7 below for further details.

(c) Third parties or publicly available sources. We may receive personal data about you from various third parties and public sources such as analytics providers; search information providers; advertising networks; technical, payment and delivery services; data brokers or aggregators; and publicly available sources, such as Companies House and the Electoral Register based inside the EU.

Please email [email protected] to find out more about the various third parties and public sources from which we may receive personal data about you.

4 How we use your personal data

4.1 We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform the contract we are about to enter into or have entered into with you.
• Where it is necessary for our legitimate interest (or those of a third party) and your interests and fundamental rights do not override those interests.
• Where we need to comply with a legal or regulatory obligation.

Please email [email protected] to find out more about the types of lawful basis that we will rely on to process your personal data.

4.2 Promotional messages from us

(a) We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising.

(b) We may use your Identity Data, Contact Data, Technical Data, Usage Data and Profile Data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you.

(c) You will receive marketing communications from us if you have requested information from us, have purchased goods or services from us, or if you provided us with your details when you downloaded content or registered for an event. In each case, if you have not opted out of receiving that marketing.

See also section 5 below for further details about how long we keep your data.

4.3 Opting out

(a) You can tell us or third parties not to contact you with updates and information regarding our products and services by following the unsubscribe instructions on any communications sent to you.
You also have the right to withdraw consent to marketing at any time by emailing [email protected].

(b) Where you opt out of receiving marketing messages, this will not apply to data provided to us that we need to use to provide a purchased product or service, or mandatory communications relating to agreed products or services.

Please Note: Opting out does not preclude you from submitting forms on our website – e.g. to sign up for a webinar. As a result of you taking this action, some communications will be triggered even if you have chosen to opt out of marketing previously, so that we can meet the request you have made by submitting the form (e.g. to provide a join link to the webinar).

4.4 Profiling, segmentation and targeting

(a) The information you provide may also be used for profiling, segmentation and targeting purposes via our CRM and/or marketing automation platform.

This enables us to personalise your experience and improve business performance – for example, by helping to determine which content you may find most relevant, so that we can direct you to more of this and to less of the information that you find less useful.

Typical uses include dividing our database into sub-groups based on shared characteristics, lead nurturing and automatically triggered communications.

You also have the right to withdraw consent to this profiling by emailing [email protected].

4.5 Analysing the use of our website

(a) To better understand how users access and use our website, both on an individual and aggregated basis, we use:

• HubSpot – to track individual activities and interactions.
• Google Analytics – aggregated and de-identified information on audience, acquisition, behaviour and conversions.

This data is collected and analysed with the intention of improving the user experience and the performance of our website.

4.6 Understanding marketing/campaign performance

(a) We use the following platforms to understand how our marketing activities are performing:

• HubSpot – including email performance metrics.
• Microsoft Teams – for webinar/event attendance data.
• Google Analytics – including acquisition source.
• LinkedIn – including performance metrics.

(b) Data may be aggregated and analysed to create business intelligence which will enable us to report on performance and make better informed decisions about future activities.

4.7 Cookies

(a) We, or third-party service providers we use, may automatically collect and store information about your visits and interactions with our site in collective or aggregated data that does not identify you specifically , but is automatically received and recorded by us through the use of “cookies.”

(b) A cookie, also known as an HTTP cookie, web cookie, or browser cookie, is used by our web site to communicate certain information to and from your browser and the website.

This will include:

• Browser
• Language
• Device ID
• Operating System
• Device Name and Model
• Location (e.g. Country or City)
• Pages viewed
• Links clicked
• Time of visit
• Length of visit
• Referring URL/web page

(c) Cookies cannot be programmed, cannot carry viruses, and cannot install malware on your computer. Learn more about cookies on our Cookie Policy page.

(d) You may refuse the use of cookies by selecting the appropriate settings in your browser .

Most browsers will allow you to see what cookies you have and delete them from particular or all websites.

Be aware that any preference you have set will be lost if you delete all cookies.

For more information on how to modify your browser settings to block or filter cookies, see aboutcookies.org or cookiecentral.com/faq/.

4.8 Clear GIFs, pixel tags and other technologies

(a) Clear GIFs are tiny graphics with a unique identifier, similar in function to cookies, which are embedded invisibly on web pages. We or our service providers may use clear GIFs, in connection with our site to track your activities and compile statistics about usage of our site (e.g. web or social media analytics).

For example, we use HubSpot to deliver our email communications. We gather statistics around email opening and clicks using industry standard technologies including clear gifs to help us monitor and improve performance.

4.9 Change of purpose

(a) We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

(b) If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

(c) Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

5 How long we keep your information

5.1 As long as you keep engaging with us, we will retain your personal information under legitimate interest for as long as we consider there is value to you and to us of maintaining contact, unless you ask us to delete it sooner.

Contacts are only kept in our marketing database if they are showing signs of engagement (i.e. an email open) This means we will stop emailing you if we haven’t seen engagement from you in over 24 months. From this point you will be considered an inactive or ‘non-marketing’ contact. If you re-engage with us (by submitting a form on the website for example), you will be re-added to our mailing list and will start to receive emails again. Note: if your contact details are updated in our CRM this may also trigger a sync back to our mailing list, although we will endeavour to prevent this happening and/or remove you if/when we become aware.

Non-marketing contacts are typically retained for 24 months before being permanently deleted from our marketing database if no further engagement is received.

6 Who we might share this information with

6.1 We may disclose your information to vendors, service providers or agents who perform functions on our behalf and enable us to:

• Fulfil requests for information
• Host content and assets
• Receive and send communications
• Update our records and marketing lists
• Generate reports
• Analyse data

Third-party platform providers include:

• HubSpot: Marketing automation platform.
• Salesforce/Kimble: CRM system.
• Google Analytics: Web analytics.
• LinkedIn: Insights Tag (i.e. advertising).
• BigQuery: data warehouse (ingests Google Analytics data).
• Looker Studio: customisable reports/dashboards (Google Analytics/BigQuery data)

6.2 Kocho staff

(a) To enable us to respond to your enquiries and contact you with relevant offers, your personal information will be disclosed to our employees, including sales and marketing personnel.

Our employees will only use your information to the extent necessary to perform their functions.

6.3 Business transfers

(a) In the event that we undergo re-organisation (including rebranding) or if we are acquired by/merge with another company, you agree that any personal information we hold about you may be transferred to that re-organised entity or third party.

6.4 Legal authorities

(a) We may disclose personal information if required to do so by law, court order or for the purposes of prevention of fraud or other crime, or if we believe that such action is reasonably necessary to protect and defend the rights, property or personal safety of Kocho, the Kocho website or its visitors.

6.5 Aggregate and de-identified information

(a) We may disclose aggregate or de-identified information about our users to third parties for marketing, advertising, research or similar purposes.

6.6 Event sponsors and partners

(a) We may disclose personal information from event registrations to sponsors and partners, where an interest has been expressed in their services.

7 Kocho’s privacy policy concerned with recruitment

7.1 Purpose

(a) For Kocho to operate its recruitment process, we need to process personal information about candidates and job applicants. The organisation is committed to being transparent about how it collects and uses data in line with data protection obligations. The purpose of this section is to inform you how we will use and protect personal information provided by candidates.

(b) Except as set out in this Notice, or as required by law, your personal data will not be provided to any third party without your prior written consent.

(c) Our email address for all recruitment purposes is [email protected] and our phone number is (0800 044 5009).

7.2    The data we collect about you for recruitment purposes

a) Your personal data will be held by Kocho. This will include information within your application and any additional information about you that you provide, or that is provided by others as part of the recruitment process. This includes the following:

• Your application form and any attached correspondence; the content of any emails, letters and telephone calls (which may be recorded) and any conversations.
• Your name, address and contact details including telephone number and email address.
• Details of your education history, employment history (including absence information), your qualifications, skills and experience.
• Information about your current levels of remuneration, including benefit entitlements, notice periods.
• Any information we receive from referees or from other organisations such as agencies.
• Any information related to credit checking and criminal activity.
• Information for your entitlement to work in UK.
• If you have a disability or there are other factors that Kocho needs to take into account in the recruitment process, including the need to make reasonable adjustments to the process to meet your requirements.

b) Special categories and criminal information

• Some personal information is defined as “special categories” data (for example information related to ethnic origin, political opinions, religious beliefs, physical/mental health). Data may also be required in relation to, criminal proceedings and offences. We may request this type of information as part of the recruitment process for the purposes of Equal Opportunities Monitoring or for carrying out Disclosure and Barring Service (DBS) checks.
• If we do request this sensitive information, where appropriate, we will ask for your explicit consent to the processing of this information; and ensure such information is treated confidentially.

c) References

• Successful candidates will be asked to provide references and other background check information, such as proof of right to work, credit and other financial history checks, and sometimes criminal records checks.
• We will seek references only once an offer of employment has been made and we will obtain your consent before we contact your referee. It is your responsibility to ensure the referee is aware you have provided us with their details and is happy for you to do so and that they are happy to be contacted by us.

7.3    Submitting your personal data

a) Kocho collects information in a variety of ways, for example through application forms, CVs, obtained from your passport or any other identity documents, or information collected through interviews or other forms of assessment.

b) By submitting your personal data and application for employment, you:

• Declare you have read, understood and freely accept the statements provided in this Privacy Notice.
• Declare the information provided is complete and accurate to the best of your knowledge.
• Understand that deliberate omissions and incorrect information may lead to your application being rejected.
• Allow Kocho to process the information contained in your application and any other information you may provide separately as part of the recruitment process in support of your application.
• And for successful candidates, authorise Kocho to make any reference checks, credit and criminal checks that are considered as necessary for your application.

7.4    How we handle your personal data during the recruitment process

a) While processing your application we may contact you by post, email, telephone or text message using the contact details you provided. During the recruitment process we may research comments and opinions via publicly available social media platforms such as LinkedIn, Twitter and Facebook. Your personal data you provide as part of the recruitment process will only be held and processed for the purpose of the recruitment/ selection process and in connection with subsequent employment/ placement.

b) Kocho has a legitimate interest in processing personal data during the recruitment process and keeping records for the process. Processing data from the recruitment process allows us to manage the recruitment process, assess the suitability of the candidate for employment and to decide whether to make an offer of employment.

c) In the event of your application being successful (resulting in an offer of employment and your acceptance of that offer), the personal information collected by Kocho during the recruitment process will be held in recruitment and HR systems, and emails or other IT systems for the duration of your employment, subject to the Kocho Privacy Notice for Employees.

d) In the event your application was unsuccessful, your personal information will be held on our system for a period of up to 6 months. The purpose of the retention of this personal data is that it might be accessed or re-used in future recruitment processes or in relation to subsequent applications for employment made by you and to respond to statutory reporting requests. At the end of the period as stated above, or once you withdraw consent, your data will be deleted and destroyed.

7.5    Sharing your personal data

a) Where your application for employment with us is via a recruitment agency, we will share your details with them.

b) If you are successful in your application and we make a search via a credit reference agency in assessing your application, we will keep a record of the search whether or not the results are successful or not. Our search results are used for purposes related to money laundering and debt. You have the right to request this information from the credit reference agency.

7.6    Who has access to your data?

a) Your information will be shared internally for the purpose of the recruitment exercise. This includes members of the People and recruitment teams, interviewers and managers involved in the recruitment process.

7.7    What if you do not provide personal data?

a) You are under no statutory, or contractual obligation to provide personal data to Kocho during the recruitment process.

b) However, if you do not provide this information, it might affect our ability to process your application properly, or even at all.

8 Your rights to access, amend or delete the information we hold

8.1 We have taken reasonable steps to help protect the information we collect from loss, misuse, unauthorised access, disclosure, alteration, and destruction. These include training and awareness programmes for all staff and appropriate technical measures such as encryption of laptops, enforcement of strong password controls and virus and malware detection.

We do not transfer information outside the EEA.

9 Your rights

9.1    You have a number of rights with regard to your personal data. You have the right to:

• Request a copy of the personal data that we hold about you.
• Correct or delete your personal data.
• Restrict, suspend, or pause the processing of your personal data, if, for example, it is wrong and needs to be changed.
• Object to the processing of your personal data, as well as in certain circumstances the right to data portability.

9.2    If you have provided consent for the processing of your data you have the right to withdraw that consent at any time. This will not affect the lawfulness of the processing before your consent was withdrawn.

9.3      Requests will be dealt with wherever possible within one month of receipt.

9.4      To make a request for personal information Kocho holds about you, please contact:

Group Data Protection Officer, Kocho
[email protected]