Privacy notice

1.Who we are

Cursive is the trading name of Plump Ltd, a company registered in England and Wales (company number 06248023). Our registered office is Suite 2e, Swinegate Court East, Swinegate, York YO1 8AJ.

This notice explains how we collect and use personal data, and your rights under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

Plump Ltd is registered with the Information Commissioner’s Office (ICO) under registration number CSN4057975.

Contact for data protection matters: Rob Colley, director, data protection lead, at [email protected], or by post to the address above marked “Data protection”. We are not required to appoint a statutory Data Protection Officer, but this person is responsible for how we handle personal data.

2. When we are a controller and when we act for clients

We are the controller for personal data we use to run our own business: enquiries, client and supplier contacts, recruitment, marketing and our website.

When we build or maintain websites for clients, the client is usually the controller of any personal data held in its systems. Where our work gives us access to that data, we act as a processor. We then process it only on the client’s documented instructions, under a written contract that meets UK GDPR Article 28, and never for our own purposes.

Our clients generally host their own websites and infrastructure. Many engagements, such as software upgrades carried out in our own development environments, involve no access to live personal data at all. Where we do need access, we agree its scope with the client in advance and use test or anonymised data wherever possible.

The client’s own privacy notice explains how it uses personal data on its services. This notice covers only the data Cursive controls.

3. What personal data we collect

Contact and identity: Name, job title, organisation, work email, phone number
Business relationship: Correspondence, meeting notes, call recordings (with notice), proposals, contracts, project communications
Financial: Billing contacts, invoices and payment records (normally organisational, not personal)
Account and access: Usernames and access logs for systems we give clients or suppliers access to, such as project boards and code repositories
Marketing: Newsletter subscription status, email opens and link clicks, event attendance
Website: IP address, device and browser type, pages visited and referring site, collected through cookies where you consent (Section 11)
Recruitment: CV, cover letter, interview notes, references, right-to-work checks for successful candidates

We do not set out to collect special category data, such as health information, or criminal offence data. If you share it with us, for example to request a reasonable adjustment, we use it only for that purpose.

4. Where we get personal data from

From you, when you contact us, sign up for our newsletter, work with us, attend an event or apply for a job.
From your organisation, when colleagues introduce you or name you as a project contact.
From publicly available and commercial sources, such as organisation websites, LinkedIn, Companies House and data providers such as Lusha. We use these to identify relevant contacts at organisations we think may benefit from our services. When we first contact you this way, we tell you where we got your details and how to opt out.
Automatically, from our website and email tools, as described in Section 11.

5. Why we use personal data and our lawful bases

Responding to enquiries and preparing proposals: Legitimate interests (running and growing our business); contract, where you ask us to take steps before entering one
Delivering services and managing client and supplier relationships: Contract, or legitimate interests where the contract is with your organisation rather than you
Invoicing, accounting and tax records: Legal obligation
Business-to-business marketing and outreach to work contacts: Legitimate interests; you can object at any time
Email newsletters to individual subscribers: Consent
Website analytics and non-essential cookies: Consent
Keeping our systems and client work secure, including access logs: Legitimate interests; legal obligation where security law applies
Recruitment: Steps before entering a contract; legal obligation for right-to-work checks
Establishing, exercising or defending legal claims: Legitimate interests

Where we rely on legitimate interests, we have balanced our interests against yours. You can ask us for details of that assessment. We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects.

6. Who we share personal data with

We do not sell personal data. Within Cursive, only staff who need personal data for their role can access it.

We use the following suppliers, who process personal data on our behalf as processors. Each is bound by a contract requiring it to act only on our instructions, keep the data confidential and secure, and not use it for its own purposes.

Protonmail: Email
Google Workspace: Email, calendars and documents
Dropbox: File storage for project and business documents
GitHub: Source code hosting and version control
Zoom: Calls and online meetings
Trello and Notion: Project management, internal notes and newsletter sign-up
Attio: Client and contact relationship management
Lusha: Business contact data for outreach
Float and Xero: Time tracking, resource planning and accounting
Buffer: Scheduling social media posts
Google Analytics and Google Tag Manager: Website analytics, with your consent
Cookiebot: Recording cookie consent
Cloudflare: Website security and performance

We may also share personal data with:

professional advisers, such as accountants, lawyers and insurers, who are bound by confidentiality
freelancers and partner agencies working on a project, under a written contract with equivalent data protection terms
HMRC, regulators, the police or courts, where the law requires it or to protect our legal rights
a buyer or successor, if our business is sold or restructured, under equivalent protections

7. International transfers

Some of our suppliers store or access data outside the UK. When that happens, we make sure one of these safeguards applies:

the destination has UK adequacy regulations, such as the EEA
the recipient is certified under the UK Extension to the EU-US Data Privacy Framework
we use the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, with a transfer risk assessment

You can ask us for details of the safeguard that applies to a particular transfer.

8. How long we keep personal data

We keep personal data only as long as we need it for the purpose we collected it for, then delete or anonymise it.

Enquiries that don't lead to work: 2 years from last contact
Client and supplier contracts and project records: 6 years after the engagement ends, to meet limitation periods
Financial and tax records: 6 years from the end of the financial year they relate to (HMRC requirement)
Marketing contacts: Until you unsubscribe or object, or 2 years without engagement, then removed
Unsuccessful job applications: 12 months after the role is filled
Website analytics: 14 months, as configured in Google Analytics
Client personal data we process as a processor: Deleted or returned at the end of the engagement, as the client instructs

If you unsubscribe or object to marketing, we keep a minimal suppression record so we don't contact you again.

9. How we keep personal data secure

We use technical and organisational measures appropriate to the risk, including:

multi-factor authentication on email, file storage, code repositories and business systems
encrypted laptops and devices, with access removed promptly when staff or contractors leave
access limited to the people who need it, and source code held in private repositories
using test or anonymised data in development wherever possible, rather than copies of live client data
choosing suppliers with recognised security standards and data protection terms

Cursive is working towards Cyber Essentials and Cyber Essentials Plus certification.

If a personal data breach occurs, we will notify the ICO within 72 hours where the law requires it, and tell affected individuals without undue delay where there is a high risk to them. When we act as a processor, we notify the client without undue delay and support its response.

10. Your rights and how to complain

Under UK data protection law you have the right to:

be informed about how we use your personal data
access a copy of your personal data
have inaccurate data corrected
have your data erased, in some circumstances
restrict how we use your data, in some circumstances
data portability, where we rely on consent or contract and process data automatically
object to processing based on legitimate interests, and to direct marketing at any time
withdraw consent at any time, where we rely on it
not be subject to decisions based solely on automated processing that significantly affect you

To exercise any of these rights, contact [email protected]. There is normally no charge. We will respond within one month, which we may extend by up to two further months for complex requests; if so, we will tell you why. We may ask you to confirm your identity.

If your request concerns data we process for a client, we will pass it to that client promptly and help it respond.

Complaints. If you are unhappy with how we have handled your personal data, please contact us first at [email protected]. We will acknowledge your complaint within 30 days and tell you the outcome without undue delay. You also have the right to complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint, helpline 0303 123 1113, or Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

11. Cookies and marketing

Our website uses cookies that are strictly necessary for it to work and to remember your cookie choices. We set analytics cookies, through Google Analytics and Google Tag Manager, only if you accept them in our cookie banner, which is managed by Cookiebot. You can change or withdraw your consent at any time using the “Renew or change your cookie consent” link in the site footer.

Our emails may record whether they are opened and which links are clicked, so we can see what readers find useful. Every marketing email includes an unsubscribe link, and you can opt out at any time by emailing [email protected].

12. Changes to this notice

We review this notice at least annually and when our processing changes. The current version is always at cursive.works/privacy.

Last updated: 12/10/2026