Controller and contact
Arctic Parade Ltd (company number 17033806), 9 Haigh Road, Huddersfield, England, HD3 2AE, operates CS Code and is the controller for website, account, commercial and support information. Our Information Commissioner’s Office registration reference is ZC126982; the official registration certificate is available from the ICO. Contact arran@cs-code.com for privacy questions or to exercise your rights.
Information we collect
- Account details: name, work email, organisation, role, authentication identifiers and access history.
- Enquiry and contract details: messages, buyer requirements, correspondence and billing records.
- Service data: organisation settings, memberships, audit events, release metadata and optional evidence documents.
- Technical data: IP address, user agent, request identifiers, security events and limited diagnostic logs.
Local-first release processing
The CLI processes repositories locally. Standard dashboard upload uses an explicit metadata allowlist and excludes source files, secret values, raw SBOMs, raw scanner reports and full file inventories by default. Customers control whether optional evidence documents are uploaded. See our Security page and Data Processing Agreement.
Purposes and lawful bases
- Contract: provide accounts, evidence workflows, support and paid services.
- Legitimate interests: secure and improve the service, respond to business enquiries, prevent misuse and maintain auditability.
- Legal obligation: accounting, taxation, lawful requests and data-protection compliance.
- Consent: optional non-essential analytics or marketing where consent is required.
Recipients and transfers
We share information only with authorised personnel, the customer organisation that controls an account, and vetted providers needed to operate the service. The current categories are listed on our Subprocessor list. Where information is transferred outside the UK, we use an adequacy regulation or appropriate safeguards such as the UK International Data Transfer Agreement or UK Addendum.
Retention
We keep information only for defined operational, contractual and legal periods. Default periods and deletion events are published in our Data retention schedule. Customers may configure shorter release-data retention where the product supports it.
Security
We use tenant-scoped access controls, role-based permissions, hashed credentials and tokens, audit logging, transport encryption in production, restricted administrative access, backups and data-minimising upload boundaries. No internet service can be guaranteed absolutely secure.
Your rights
Subject to applicable limits, you may ask for access, correction, erasure, restriction, portability, or object to processing. You may withdraw consent at any time. We aim to respond within one month. You may complain to the Information Commissioner’s Office at ico.org.uk.
Automated decisions and children
CS Code does not make solely automated decisions that produce legal or similarly significant effects about individuals. The service is intended for business users aged 18 or over.
Changes
We will update this notice when processing materially changes and will communicate material changes where appropriate.