This Privacy Policy explains how COR Investment Management Ltd ("COR", "we", "us", "our") collects, uses, stores, and shares personal data in connection with its website and services. It is issued under the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.
Last updated: 2026-06-05.
1. Who we are (Data Controller)
COR Investment Management Ltd is the data controller for the personal data described in this notice. COR Investment Management Ltd is an appointed representative of 8AM Global Ltd, which is authorised and regulated by the Financial Conduct Authority (FRN 937456). COR Investment Management Ltd is entered on the FCA Register under reference number 1056199. Registered in England and Wales, company no. 17066425. Registered office: Highland House, Mayflower Close, Chandlers Ford, Hampshire, SO53 4AR.
Privacy contact: privacy@corim.co.uk. For postal correspondence, please use the address listed in our Contact page.
2. What personal data we collect
Depending on how you interact with us, we may collect:
• Identity data: name, professional role, employer name.
• Contact data: email address, telephone number, postal address.
• Investor data: self-declared investor classification (retail / professional / institutional / adviser) and any related acknowledgements.
• Enquiry / message content: the text you write in our forms and any documents you share.
• Technical data: IP address (truncated for analytics), browser type, device type, pages viewed, referrer URL, and UTM attribution parameters.
• Marketing preferences: your consent or opt-in state for our newsletter and for analytics and marketing cookies.
We do not knowingly collect any special-category data (Art 9 UK GDPR) or data relating to children under 18. The website is not directed at children.
3. Purposes and lawful basis
We process your personal data only for the following purposes, each on a specific lawful basis under Art 6 UK GDPR:
• Responding to enquiries (Art 6(1)(b) - performance of pre-contractual steps at your request; Art 6(1)(f) - our legitimate interest in operating our business).
• Providing investment services to existing clients (Art 6(1)(b) - performance of contract; Art 6(1)(c) - compliance with our FCA obligations).
• Sending the newsletter to subscribers who have completed double opt-in (Art 6(1)(a) - consent).
• Website analytics (Art 6(1)(a) - consent, via the cookie banner).
• Marketing measurement and attribution, including LinkedIn Insight Tag (Art 6(1)(a) - consent).
• Compliance with regulatory record-keeping (Art 6(1)(c) - legal obligation under SYSC 9 and the FCA Handbook).
• Detecting, preventing, and investigating fraud or misuse of the website (Art 6(1)(f) - legitimate interest in protecting our infrastructure).
4. Who we share your data with (recipients)
We share personal data only with service providers ("processors") acting on our behalf under written contracts:
Note: a CRM platform (HubSpot) is integrated into the website codebase but is not enabled at launch and does not currently receive any personal data. If we switch it on we will update this Privacy Policy first, re-issue notice, and add the associated UK-to-US transfer safeguards before any data is transferred.
• Resend (United States) - outbound transactional email (confirmation messages, enquiry receipts).
• Sanity (Ireland / United States) - content management system for our published content.
• Vercel (United States) - website hosting and serverless functions.
• Google Analytics (United States) - usage analytics, configured with IP truncation and only with your analytics-cookie consent.
• LinkedIn Marketing Solutions (Ireland / United States) - campaign attribution via LinkedIn Insight Tag, only with your marketing-cookie consent.
We do not sell personal data, and we do not share it with third parties for their own independent marketing purposes.
5. International transfers
Where personal data is transferred outside the UK to a country without a UK Adequacy Decision (in particular the United States), we rely on the UK International Data Transfer Agreement ("IDTA") or the EU Standard Contractual Clauses with the UK Addendum, executed with each processor.
Each transfer is supported by a Transfer Impact Assessment that documents the additional safeguards (encryption in transit, data-residency options where available, contractual restrictions on government access) in place to protect your rights.
6. How long we keep your data (retention)
• Enquiry submissions (in the firm's enquiries mailbox, forming the Art 5(2) audit trail): 24 months from the date of last interaction, then deleted or anonymised.
• Newsletter subscribers: until you unsubscribe, plus an additional 12 months in a suppression list to ensure you are not contacted again.
• Document-download leads: 24 months from the download date.
• Client records (where you become a client of the firm): minimum 5 years from the end of the client relationship, per FCA SYSC 9.
• Server / runtime logs that may incidentally contain personal data: 30 days at Vercel, after which they are purged.
• Compliance audit trail (consent timestamps, classification events): retained for the regulatory minimum (typically 5 years).
7. Your rights
Under the UK GDPR you have the right to:
• Access - request a copy of the personal data we hold about you (Subject Access Request, Art 15).
• Rectification - correct inaccurate or incomplete data (Art 16).
• Erasure - request deletion of your data, subject to our regulatory record-keeping obligations (Art 17).
• Restriction of processing - pause processing while a query is resolved (Art 18).
• Data portability - receive your data in a portable format (Art 20).
• Object - to processing based on legitimate interest, including direct marketing (Art 21).
• Withdraw consent at any time, where processing is based on consent. Withdrawal is as easy as consent - use the "Manage cookies" link in the footer for cookie consent, or the unsubscribe link in any marketing email.
To exercise any of these rights, email privacy@corim.co.uk. We will respond within one calendar month of receiving a valid request.
8. Right to complain to the ICO
If you are not satisfied with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Helpline: 0303 123 1113. Website: https://ico.org.uk.
9. Automated decision-making
We do not make any decisions about you using solely automated processing (including profiling) that produces legal or similarly significant effects within the meaning of Art 22 UK GDPR. Investment decisions affecting client portfolios are made by qualified individuals at the firm, not by algorithms in isolation.
10. Whether providing data is mandatory
Where we ask for personal data via a form, the form indicates which fields are required. If you choose not to provide required information we may not be able to respond to your enquiry, send the newsletter, or - where you are an existing client - perform the services you have contracted for.
11. Source of your data
We collect personal data directly from you when you submit a form, subscribe to the newsletter, request a document, or otherwise interact with the website. We do not purchase personal data from list brokers.
12. Changes to this notice
We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent revision. Material changes will be communicated to subscribers by email where appropriate.