Privacy and cookie policy.

This site is operated by CIO Solutions LTD (Company No. 16179733). This notice explains what information I collect, why I use it, which service providers receive it, and the choices available to you. It includes the website cookie and analytics notice.

Who controls the data?

The data controller is CIO Solutions LTD. You can contact me at hello@interimcio.co.uk or write to C/O Pm+M, New Century House, Greenbank Technology Park, Challenge Way, Blackburn, Lancashire, BB1 5QB, United Kingdom. The related GDPR policy explains my wider data-protection approach.

Information you provide

• Enquiry details you submit through the contact form, including your name, email, company, phone number if supplied, referral source if supplied, and message.
• Newsletter signup details, normally your email address and any metadata needed to process the subscription.
• Booking information if you schedule a call through Google Workspace Appointment Schedules.
• A nickname and score if you choose to publish a result on the optional 404-page game leaderboard. The form asks you to use a nickname because the Top 10 is public.

Website and analytics information

The hosting service necessarily processes request information such as IP address, time, requested page, browser information, and security or diagnostic data. I also use Vercel Web Analytics and Google Analytics 4 to understand page views, referrers, broad location, device type, and whether the site is working well.

I use two separate forms of measurement. Vercel provides anonymous, cookieless page counting. Google Analytics provides more detailed measurement and follows the regional consent rules below.

• Anonymous Vercel page counting: enabled by default unless you object or send a recognised Global Privacy Control signal. It does not use cookies. Vercel receives the page path without query parameters, timestamp, referrer, broad location, and browser or device information. It creates a daily hash from the incoming request to estimate visitors; the hash resets after 24 hours and is not used to follow someone across days or websites.
• Limited Google Analytics: used by default only where the regional rules below permit it. No Google Analytics cookie or returning-visitor identifier is used. Google receives a page path without query parameters, page title, a sanitised referrer (the origin only for an external site), time, consent state, and limited browser or device signals. Google uses the IP address at collection time for routing and broad location, then discards it before Analytics data is logged.
• Google Analytics cookies allowed: after an affirmative choice, Google may set first-party _gacookies for up to six months to distinguish a browser and its sessions. This is pseudonymous analytics, not identified-user tracking. Advertising storage, Google signals, user-provided data, ads personalisation, and cross-site tracking remain disabled.
• All analytics off: selecting this option, or sending a recognised Global Privacy Control signal, prevents both Vercel and Google from sending further analytics events.

I use analytics only to produce aggregate statistics and improve this website—for example, to understand which pages are useful, how visitors reached them, and where navigation or performance needs work. I do not use it to make decisions about an individual, build advertising profiles, or identify visitors.

To prevent abuse of the contact, newsletter, and leaderboard endpoints, the server converts the request IP address into a truncated one-way hash and sends that hash to Upstash Redis for a short-lived rate-limit check. The raw visitor IP is not stored in Redis or included in enquiry emails.

Regional analytics choices

• All regions: anonymous Vercel page counting is enabled by default without cookies and can be turned off in one click. A recognised Global Privacy Control signal turns it off automatically.
• United Kingdom: limited cookieless Google Analytics is also enabled by default under the PECR statistical-purposes exception. Clear information and a free, one-click way to object are provided. Google Analytics cookies remain off unless you explicitly allow them.
• EEA and Switzerland: Google Analytics remains off until you explicitly allow its analytics cookies. Anonymous Vercel page counting continues without cookies unless you turn all analytics off.
• United States: limited cookieless Google Analytics is also enabled by default, with an immediate opt-out. California visitors receive the additional information below.
• Other or unknown locations: Google Analytics remains off until you explicitly allow its analytics cookies. Anonymous Vercel page counting continues without cookies unless you turn all analytics off.

The site uses Vercel’s coarse country and, for US requests, state header to select the appropriate privacy mode. The site does not store the raw IP address or exact location for this choice. IP location can be wrong, particularly when a VPN or corporate proxy is used, so you can open Privacy choices in the footer at any time.

Cookies and local storage

• privacy-preferences-v2 is a necessary local-storage entry that remembers your analytics choice and the broad privacy region in which you made it. The site asks again after 180 days.
• _ga and _ga_* are Google Analytics first-party cookies. They are created only after you choose Allow analytics cookies, expire after no more than six months, and are removed where possible if you later turn analytics off.
• interimcio-runner-highscore is a functional local-storage entry created only if you play the optional 404-page game. It remembers the best score on that browser until you clear site data. It is not used for analytics or advertising.
• Vercel Web Analytics does not create cookies or analytics local storage and is loaded for anonymous page counting unless you object. Limited Google Analytics does not create analytics cookies. The Google tag is not loaded in regions requiring opt-in unless consent has been given.

Purposes and lawful bases

I use enquiry data to respond to your message and, where relevant, discuss a potential engagement. Newsletter data is used to send the newsletter and manage unsubscribes. Booking data is used to schedule and prepare for calls.

A game nickname and score are used only to operate the optional public leaderboard. Short-lived, pseudonymous rate-limit records are used only to protect the forms and leaderboard from abuse.

Depending on the activity, the UK GDPR lawful basis is taking steps towards or performing a contract, consent, legal obligation, or legitimate interests in operating and securing the business. Anonymous Vercel page counting relies on legitimate interests in measuring and improving this website, is limited to aggregate statistics, uses no analytics cookies, and provides a simple objection mechanism. For limited UK Google Analytics, the storage/access rule is the PECR statistical-purposes exception and the UK GDPR basis for any transient personal-data processing is the same legitimate interest. Google Analytics cookies and marketing subscriptions rely on consent.

Who processes it

The site uses a small number of service providers: Vercel for hosting and analytics, Google for analytics and appointment scheduling, Resend for contact form email delivery, and Beehiiv for newsletter subscriptions. Upstash provides the Redis store used for short-lived rate limits and the optional game leaderboard. Google Analytics is configured as a processor: the Google products-and-services data-sharing setting, advertising features, user-provided data, and linked advertising uses must remain disabled. These providers process information under their contracts and applicable data-protection terms.

Google and some other providers may process information outside the UK or EEA. Where personal data is transferred internationally, I rely as appropriate on the provider’s data-processing terms, an adequacy arrangement, the EU standard contractual clauses, the UK addendum, or another approved transfer safeguard.

How long I keep it

Enquiries are kept for as long as needed to manage the conversation and any resulting client relationship; a non-client enquiry is normally reviewed for deletion after 24 months. Newsletter records are kept while you remain subscribed. After unsubscribe, a minimal suppression record may be retained so the opt-out continues to be honoured. Operational records may be retained where required for accounting, legal, or security reasons.

Google Analytics user-level and event-level retention is set to the shortest standard option, two months. Standard aggregate reports may remain available for longer. Vercel’s visitor hash lasts for 24 hours and the current free-plan Web Analytics reporting window is 30 days. Privacy choices are treated as valid for up to 180 days and are replaced or removed when the site is next visited. Contact and newsletter rate-limit hashes expire after about one hour; leaderboard rate-limit hashes expire after about one minute, and unused game-run identifiers after 30 minutes. Published game names and scores are removed after no more than 12 months or sooner if displaced from the retained Top 100.

Your rights

Depending on the law that applies, you may ask to access, correct, delete, restrict, or receive a copy of your personal data, and may object to processing or withdraw consent. You can unsubscribe from the newsletter using the link in each email. To make a request, email hello@interimcio.co.uk. Valid UK or EU data-rights requests are normally answered within one month, subject to any permitted extension, identity check, or legal exception. You can change analytics at any time through Privacy choices in the site footer.

United States and California privacy information

During the preceding 12 months, the site may have collected the following California categories: identifiers and professional information that a person submits; internet or electronic-network activity such as page views and browser type; and approximate geolocation. It may also receive a nickname and game score that the visitor asks to publish. Sources are the visitor, their browser or device, and the service providers named above. The business purposes are responding to requests, delivering subscriptions or bookings, operating the optional leaderboard, securing the service, and improving the website.

I do not sell personal information, share it for cross-context behavioural advertising, use sensitive personal information to infer characteristics, or knowingly sell or share information about people under 16. Google Analytics data sharing with Google products and services must remain disabled so Google acts as a service provider under its US State Privacy Laws terms.

The site does not offer a financial incentive for personal information and is directed to business audiences, not children under 13. Global Privacy Control is honoured across the United States as an instruction to turn optional analytics off, including where a state recognises it as a universal opt-out mechanism.

Where the CCPA applies, California residents may request access, deletion, or correction, receive information about collection and disclosure, and exercise applicable opt-out or limitation rights without discrimination. Send requests to hello@interimcio.co.uk. The same method is available for applicable rights under other US state privacy laws. An authorised agent may also use this address; reasonable evidence of authority and identity may be requested.

Complaints and changes

To make a data-protection complaint, email hello@interimcio.co.uk with “Privacy complaint” in the subject, or write to the correspondence address above. I will acknowledge the complaint within 30 days, investigate and keep you informed without undue delay, explain the outcome, and retain only the complaint record needed for accountability. You may also complain to the UK Information Commissioner’s Office at ico.org.uk or, where applicable, your local privacy regulator. I may update this notice when the site, providers, or legal requirements change; the date at the top shows the latest revision.