Privacy

Certified in the Claude Partner Network Microsoft Solutions Partner ISO 27001 ISO 9001 Independent since 1999

Last updated 16 October 2026

Cardonet respects your privacy. This page explains what we collect on cardonet.ai, what we do with data in the AI work we deliver, and how you can get any of it back or removed.

The short version

This website uses one set of optional analytics cookies, from Google Analytics, and none of them are set until you agree. Refusing takes one click, the same click agreeing takes, and if you refuse your browser never contacts Google at all. We do count visits with our own analytics, which sets no cookies and which you can still switch off. If you fill in a form, book a time or send an email, we use what you tell us to reply to you and nothing else.

In the AI work we deliver, your data stays yours. You decide what goes in. We act on your instructions, we write down where data goes before anything moves, and we do not use your data to train anyone's models.

Who we are

cardonet.ai is Cardonet's AI practice. Cardonet has been independent since 1999 and holds ISO 27001 and ISO 9001 certification.

For data collected through this site and through AI work, the data controller is Cardonet Consultancy Limited, company number 06263199, VAT number GB 912 2507 59, registered at 7 Stean Street, London, E8 4ED.

We have not appointed a Data Protection Officer, because we are not required to under Article 37 of the UK GDPR. Responsibility for data privacy sits with the Managing Director.

The main Cardonet sites, cardonet.co.uk and cardonet.com, have their own privacy policy. This page covers cardonet.ai and the AI services described on it.

Cookies and analytics

We use Google Analytics to understand how the site gets used. Our cookie policy names every cookie, says which company sets it and how long it lasts. We do not run advertising measurement on this site. If that changes, we will add each company to this page and to the cookie policy, and ask you again before anything new is set.

Nothing optional is set until you say yes. You get asked once, in a panel at the bottom of the page. Accept all and Reject all sit side by side as the same size button. Neither box is ticked in advance.

Reject means we do not load Google Analytics. Your browser never fetches it, so there is no version of it running with tracking switched off or told to behave. If you say no, Google hears nothing from your browser.

You can change your mind on any page. Use Cookie settings in the footer. If you withdraw consent we delete the analytics cookies and reload the page without Google Analytics.

Our lawful basis for the analytics cookies is your consent. For the one cookie that records your choice, it is our legal obligation, since we have to be able to show what you agreed to.

Our own analytics is different, and sits outside all of that. We run Matomo on our own servers with cookies switched off, so it stores nothing on your device and there is nothing to consent to. Our basis there is legitimate interests, held to a set of conditions we publish: your IP is masked, nothing leaves the UK, it does not follow you across other sites, we keep it 14 months, we respect Do Not Track, and you can opt out in one click on the cookie policy. The cookie policy sets all of that out.

What loads from other companies

Separately from cookies, two things happen when a page loads here that you should know about, because they happen before any consent question:

• Animation library. The scroll and icon animation loads from Cloudflare's public CDN, which sees your IP address.
• Server logs. Our web server records requests, including IP addresses, so we can keep the site running and spot abuse. We delete those logs once we no longer need them for security.

The typefaces on this site are hosted here, so no font request goes to another company. We can remove the animation library's request by hosting that file ourselves too.

When you get in touch

The contact form asks for your name, your work email address, your company, roughly how many people work there, and which conversation you want. You can also tell us what is going on with AI in your business, what is driving the timing and who else would be involved. Only your name, email and company are required.

What you send is emailed to the person at Cardonet who handles that conversation, with your address as the reply address, so the answer comes from a person. It is not kept on the web server. To stop abuse, the form counts submissions from each address for ten minutes, holding the address only as a salted hash and clearing the record within about a day.

We use what you send to reply, to answer your question and to keep a record of the conversation. Our lawful basis is legitimate interests, because you contacted us about our services. If you ask us a question, we need to be able to answer it.

We do not sell your details, and we do not pass them to anyone for their own marketing.

When you book a time

The Book a review buttons on this site open a calendar on our main site, cardonet.co.uk, which runs on Microsoft Bookings. To book, you give the details its form asks for, such as your name and email address, and anything you choose to add about what you want to discuss. Microsoft Bookings passes them to our Microsoft 365, where the people who will hold the call can see them, and sends you a confirmation.

Cardonet Consultancy Limited is the controller for your booking details, as for everything else on this page. We use them to hold the call and to prepare for it. Our lawful basis is legitimate interests, because you asked to talk to us. If the conversation goes nowhere, we delete them once it is clearly over. If it becomes work, they become part of the client record. Microsoft handles them for us under our contract with it. While you are on the booking page you are on cardonet.co.uk, so that site's own privacy and cookie policies apply there too.

The Briefing

If you sign up for the Briefing, we send you our writing on AI governance and adoption. Our lawful basis is your consent, and we ask you to confirm it: the form takes your email address and sends you a link, and nothing goes on the list until you open it. If you do not open it within seven days, the link stops working and your address goes on no list.

The list holds your address, when you confirmed and the token behind your unsubscribe link. Every email carries that link, and you can also email us to stop. Unsubscribing removes your address from the list altogether.

Client data during Track, Build and Trackside

When you engage us, we hold the details we need to run the work: names, work contact details, job roles and notes about your systems and your decisions. Our lawful basis is performance of our contract with you.

We keep this in our CRM and helpdesk, in systems covered by our ISO 27001 certification. Access is limited to the people working on your account.

Your data in AI systems we build

Read this part twice because the roles matter.

You are the controller of your own data. When we build or run an AI system for you, we act as your processor. We act on your documented instructions, under a written agreement that sets out what we may and may not do.

You decide what goes in. Part of the point of the Govern phase is deciding that deliberately rather than by accident. The permissions review that follows Track exists for exactly this reason: to check what the system can reach before it reaches it. It is never optional.

Your data is not training data. We do not use your data, your prompts or your outputs to train models. We only put them through provider plans whose terms exclude training on them, and we check that before anything goes in.

Prompts and outputs are records. What goes into a system and what comes out may be logged, so that a decision can be explained later. We agree with you up front what is logged, who can see it and how long it is kept. Where those logs contain personal data, your own retention rules apply.

When work ends, you choose whether your data comes back to you or is deleted. We confirm in writing when deletion is done.

Automated decision-making

We do not make automated decisions about you, and we do not profile you, in the sense Article 22 of the UK GDPR means.

For systems we build for you, you are the controller, so the Article 22 duties are yours. We will tell you when a design would create an automated decision with legal or similarly significant effects, and we build human review into the design rather than leaving it as an afterthought. That is the whole argument of the Govern phase.

Why we process data and on what basis

• To reply to you and run our services. Performance of a contract, or legitimate interests where no contract exists yet.
• To send you the Briefing. Your consent.
• To run the optional analytics. Your consent, given through the cookie panel and withdrawable at any time.
• To count visits with our own cookieless analytics. Legitimate interests, on the conditions set out in the cookie policy, and you can opt out.
• To record what you agreed to. Legal obligation.
• To keep our systems secure and our records straight. Legitimate interests.
• To meet our legal, tax and accounting duties. Legal obligation.
• To defend a legal claim. Legitimate interests.

How long we keep things

• Contact requests that go nowhere. Deleted once the conversation is clearly over.
• Bookings that go nowhere. The same: deleted once the conversation is clearly over. A booking that becomes work is kept as part of the client record.
• Client records. For the life of the engagement, then as long as our legal, tax and professional duties require.
• Briefing subscribers. Until you unsubscribe, which removes you from the list.
• Form abuse counters. About a day.
• Server logs. As long as we need them for security.
• Your cookie choice. We ask again after about six months.
• Google Analytics cookies. Two years, as the cookie policy sets out.
• Our own analytics data. 14 months.
• Client data inside systems we run for you. Under the retention rules you set.

Who else sees your data

We use suppliers to run our business, and some of them process data on our behalf. Each one is under a written contract that binds them to our instructions and to appropriate security.

Our own analytics goes to nobody: Matomo runs on our servers, so those requests come to us and stop there.

If you agree to the optional cookies, Google receives data about your visit, for Google Analytics 4. Nobody else does.

In the AI work we deliver, the model providers are Anthropic, Microsoft and Google. Which of them is involved in your work is decided with you during Govern, and we tell you before anything goes in.

For our business more generally, the categories are our CRM and marketing platform, our helpdesk, our email and file storage, and our hosting.

We also disclose data where the law requires it, and to our professional advisers where we need advice.

Sending data outside the UK

Cardonet works with clients around the world. Most of them are in the UK, Europe and North America, and we have an office in West Hollywood as well as London. Some data therefore moves outside the UK.

Where it does, we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, or on the UK-US data bridge where the receiving company is certified under it. In each case we check that the receiving party can meet it.

Google and the AI model providers named above are United States businesses. Agreeing to the analytics cookies means data reaching the United States, which is one of the reasons they are optional and switched off by default.

For AI work specifically, where your data is processed is a deliberate design decision. If it has to stay in a particular jurisdiction, say so during Govern and we will build to that.

How we protect it

We hold ISO 27001 for information security and ISO 9001 for quality management, and both are independently audited. Every member of our team is screened to BS7858:2019 and DBS checked. Access to client data is limited to the people who need it.

No system is perfectly secure. If a breach affects your data and creates a risk to you, we will tell you, and we will tell the ICO where we are required to.

Your rights

You can ask us to:

• Tell you what we hold. We will confirm what we have and give you a copy.
• Correct it. If something is wrong, we will fix it.
• Delete it. We will, unless we are legally required to keep it.
• Restrict what we do with it. We will hold it and stop using it.
• Send it somewhere else. We will provide it in a machine-readable format.
• Stop processing it. You can object, and you can withdraw consent at any time.

Email hello@cardonet.com or write to the Managing Director, Cardonet, 7 Stean Street, London, E8 4ED. We reply within one calendar month, as the UK GDPR requires. There is no charge.

If we get it wrong, you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first so we can put it right.

If your request concerns data inside a system we run for you as processor, send it to the client who controls that data. Tell us as well, and we will help them answer it.

Children

This is a site for businesses. We do not knowingly collect data about anyone under 16. If you think we have, tell us and we will delete it.

Links to other sites

Where we link out, that site's own privacy policy applies. We have no control over what other people do with your data.

Changes to this page

We review this page regularly and will update it when our practice changes. The date at the top tells you when it last changed.

Contact

Email hello@cardonet.com. If you would rather write, the address is the Managing Director, Cardonet, 7 Stean Street, London, E8 4ED.