Last updated: 26 January 2026, 12:00 (UK time)

We value your privacy highly. This Privacy Policy explains how Concrete Canvas Ltd (“we”, “us”, “our”) collects, uses, stores and shares personal data when you use https://www.concretecanvas.com and its subdomains (“our websites”), or when you interact with us in other ways (for example at trade events, on our webinars).

We will never sell, rent out or trade personal data that we capture directly from you or about you.

Who we are

Data Controller: Concrete Canvas Ltd
Cowbridge Road, Talbot Green, CF72 8HL, United Kingdom

Contact:
Marketing preferences / requests: [email protected]
Privacy enquiries: [email protected]

Information we collect

We may collect and process the following categories of personal data:

1) Information you provide to us

This includes information you submit through our websites, portals or via direct communications, such as:
• Name, email address, telephone number
• Company name, job title, sector, location
• Enquiry details and any information you choose to provide

2) Website forms and lead management (Gravity Forms → Force24 → Salesforce)

When you submit a form on our websites, we collect your data using Gravity Forms. Form submissions are then:
• Fed into Force24 for marketing automation, email campaigns and lead scoring; and
• Automatically updated into Salesforce (“our CRM”) once lead scoring criteria are met (or as otherwise configured).

3) Data obtained in person (trade events and meetings)

A significant proportion of our first-hand data is collected when we meet people at trade events, conferences and meetings (for example by exchanging business cards or scanning badges where permitted). This information is then entered into our CRM as potential leads.

4) Information collected automatically

When you browse our websites, we may collect:
• Usage Data (e.g., pages visited, time on site, device/browser information, IP address, approximate location)
• Cookie identifiers and similar tracking data (where permitted)

5) Survey and training interactions

If you complete a survey or use our training platform (e.g., CC Academy), we may collect the information you submit and activity needed to provide those services.

6) Data purchased from selected market intelligence partners

We may also obtain business contact data from selected market intelligence partners, such as:
https://www.barbour-abi.com
https://www.globaldata.com
https://www.insights-global.com

Where we do so, we use that information in line with applicable data protection law (including providing appropriate privacy information and respecting opt-outs).

How we use your information

We use personal data for the following purposes:
• To respond to enquiries and provide information you request
• To manage relationships with prospects, customers and partners
• To send relevant marketing communications (where permitted)
• To build and improve our website, content and services
• To run surveys, training and customer programmes
• To measure performance of campaigns and website activity

Legal basis for processing

We may process personal data where:
• You have provided consent (where required)
• Processing is necessary for performance of a contract or steps prior to entering into a contract
• Processing is necessary to comply with a legal obligation
• Processing is necessary for our legitimate interests (e.g., B2B relationship management, improving services, appropriate direct marketing), except where overridden by your rights

Where we rely on legitimate interests for marketing, you can object at any time (see “Your rights” below).

Force24 (Direct marketing and email communications)

We use Force24 to send email campaigns and automated correspondence (and to manage marketing preferences, reporting and lead scoring). You can unsubscribe at any time using the link in our emails, or by contacting us.

We may also contact you if we reasonably believe there is a legitimate interest in doing so (for example, where you have an existing relationship with us, are in a relevant professional role, or have interacted with our content), always subject to your right to opt out.

Salesforce (our CRM)

We use Salesforce as our Customer Relationship Management (“CRM”) system. Salesforce is where our contact and account data is stored and managed securely to support sales, customer service, partner management and reporting.

• We do not share personal data outside of our organisation for third parties’ own marketing purposes.
• Specific customer information may be shared between our Sales Team and our Sales Partners who market, sell and distribute our products globally where necessary so they can deal with customers directly (for example, where a partner is responsible for supply, installation, service, or support). In these cases, we only share what is relevant and appropriate for the purpose.

Social media and targeted campaigns

From time to time, we run marketing campaigns on social media platforms. These campaigns may target specific:
• Demographics
• Professions / job roles
• Companies or industry sectors
• Geographic locations (e.g., users based in a particular country/region)
• Web activity (e.g., based on your search and browsing history)

Depending on the campaign, platforms may process your data to deliver ads, measure performance, and build audiences (including remarketing). You can manage ad preferences through the relevant platform settings and through our cookie consent tools (where applicable).

How we protect your personal information

We have implemented measures designed to safeguard personal information, including:
• Vendor due diligence where third parties process personal data on our behalf
• Limiting collection to what is strictly necessary
• Using SSL encryption and secure technologies for transmission beyond internal networks
• Destroying and/or deleting personal information when no longer needed
• Regular risk assessments and risk treatment planning
• Written security policies and procedures
• Staff training and confidentiality commitments
•Up-to-date software and safeguards

Cookies, analytics and advertising

Cookies
Our websites use cookies and similar technologies. Please see our Cookie Policy for details of what we set, why we set it, and how to change cookie settings.

Analytics
We use Google Analytics to understand how our websites are used. Google Analytics presents information in aggregated form (e.g., trends and usage patterns). You can opt out via Google’s opt-out tool and/or our cookie consent controls.

Advertising and remarketing
We may use remarketing services (including Google, Meta, LinkedIn and X) to show ads to people who have interacted with our website or content. These services may use cookies, pixels, or similar technologies, subject to your consent choices and platform settings. (See “Remarketing” in the Third-Party Service Providers section below.)

Information retention

We retain personal data only for as long as needed for the purposes for which it was collected, including meeting legal, regulatory, accounting or reporting requirements.

In most cases, if no contact has been made for four (4) years or more, your data will usually be deleted from our systems.
However, we may contact you beforehand if we believe there may be a legitimate interest in doing so (for example, where your role is still relevant to our products/services or where there is an ongoing business context). You can opt out at any time.

Sharing your information

We may share personal data:
• Internally with relevant teams (e.g., marketing, sales, customer support)
• With Sales Partners who market, sell and distribute our products globally where necessary so they can deal with customers directly (for example, where a partner is responsible for supply, installation, service, or support). In these cases, we only share what is relevant and appropriate for the purpose.With vetted service providers who process personal data on our behalf (see below)
• Where legally required (e.g., to comply with legal obligations, respond to lawful requests, or prevent fraud)
• In connection with a business transaction (e.g., merger, acquisition, sale of assets), subject to appropriate safeguards

International transfers

We may transfer personal data outside the UK/EEA (for example, where a supplier processes data internationally, or if a user makes contact from a location outside of this region or where our Sales Partner is based outside the UK/EEA). Where this happens, we use appropriate safeguards and measures where required.

Children’s privacy

Our websites are intended for a general audience and are not designed for children. If we learn we have collected personal data from someone under 18, we will take appropriate steps to delete it and/or only use it to respond that they cannot use our services.

Your rights

Depending on your location and applicable law (including UK GDPR), you may have rights such as:
• Access to your personal data
• Rectification of inaccurate data
• Erasure (the “right to be forgotten”) in certain circumstances
• Restriction of processing
• Data portability (where applicable)
• Objection to processing (including direct marketing)
• Withdrawal of consent (where processing is based on consent)
• The right to lodge a complaint with the ICO (UK) or your local regulator

Exercising your rights

Email: [email protected]
Post: Concrete Canvas Ltd, Cowbridge Road, Talbot Green, CF72 8HL, United Kingdom

You may also submit a request via the online form on our Contact page.

To verify your identity, we may request:
• Name
• Email address

We usually respond within 30 days. If we need longer, we will explain why. We may refuse requests where lawful exceptions apply, and we will provide reasons.

Third-party websites

Our websites may link to third-party sites. We are not responsible for their content or privacy practices. Please review their privacy policies before providing personal data.

Do Not Track

Some browsers provide “Do Not Track” (“DNT”) settings. Our websites do not currently respond to DNT signals.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post changes on our websites and update the “Last updated” date above.

Third-Party Service Providers

In addition to cookies and tracking technologies described in our Cookie Policy, we use the following service providers. Each has its own privacy policy.

Contact management and messaging

Force24

Force24 is a marketing automation platform used for email campaigns, automated correspondence, lead scoring, segmentation and marketing reporting.
Personal Data collected/processed: first name, last name, email address, company, job title (where provided), location, subscription status, interaction data (e.g., email opens/clicks) and related marketing preference data.
Place of processing: United Kingdom (and other locations depending on Force24’s sub-processors, where applicable).

Salesforce

Salesforce is our CRM where contact and customer relationship data is stored and managed securely for sales, partner coordination, service and reporting.
Personal Data collected/processed: first name, last name, email address, company, job title (where provided), location, relationship history, relevant communications and engagement history, and account/customer context.
Place of processing: EU/EEA (and other locations depending on Salesforce configuration and sub-processors, where applicable).

Learning, surveys and forms

LearnDash

LearnDash is used to create and deliver online training courses (including the CC Academy) for customers, partners and contractors.
Personal Data collected/processed: name, email address, organisation (where provided), login/account details, course enrolment and completion progress, and activity related to course delivery.
Place of processing: United Kingdom/EU/EEA (and other locations depending on hosting and configuration).

SurveyMonkey

SurveyMonkey is used to create and run customer and stakeholder surveys.
Personal Data collected/processed: survey responses and any contact details you choose to provide (and technical data such as device/browser information, depending on survey settings).
Place of processing: United States (and other locations depending on SurveyMonkey sub-processors, where applicable).

Gravity Forms

Gravity Forms is used to collect information you submit through forms on our websites. Submissions are used to respond to enquiries and to feed relevant data into Force24 and Salesforce.
Personal Data collected/processed: name, email address, telephone number (where provided), company, job title (where provided), location, enquiry details and form metadata.
Place of processing: United Kingdom/EU/EEA (depending on our website hosting and configuration).

File sharing and infrastructure

Nextcloud (https://www.ccportal.co.uk)

Nextcloud is used for secure file sharing and collaboration, linked to our secure server environment via https://www.ccportal.co.uk.
Personal Data collected/processed: user name, email address (where accounts are created), access logs, and files/metadata you upload or access.
Place of processing: United Kingdom.

WebBox
WebBox is our web developer and may have controlled access to systems required to maintain and support our websites.
Personal Data collected/processed: limited technical data and (where necessary) access to form submissions and website systems strictly for support, maintenance and troubleshooting.
Place of processing: United Kingdom.

Looker Studio
Looker Studio is used for analytics and reporting dashboards (e.g., marketing and website performance).
Personal Data collected/processed: aggregated reporting data and, where configured, online identifiers and usage data.
Place of processing: United States (and other locations depending on Google’s processing, where applicable).

Remarketing

Facebook Custom Audience (Meta Platforms, Inc.)

Facebook Custom Audience is a remarketing and behavioural targeting service connecting activity on our websites with the Facebook advertising network, including use of email lists for remarketing.
Personal Data processed: email address.
Place of processing: United States.

Google Ads (Google LLC)

Google Ads is an advertising service that allows us to display ads and measure effectiveness, including remarketing.
Personal Data processed: email address; Usage Data.
Place of processing: United States.

LinkedIn Matched Audiences (LinkedIn Corporation)

LinkedIn Matched Audiences is a remarketing and behavioural targeting service connecting our websites with LinkedIn’s advertising network, including use of email lists and/or online identifiers.
Personal Data processed: email address; Usage Data.
Place of processing: United States.

X (Twitter) Tailored Audiences (X Corp.)

X Tailored Audiences is a remarketing and behavioural targeting service connecting our websites with the X advertising network, including use of email lists and/or online identifiers.
Personal Data processed: email address; Usage Data.
Place of processing: United States.

Definitions

Personal Data (or Data): Any information that identifies or could identify a living individual, directly or indirectly.
Usage Data: Information collected automatically from our websites and systems, which may include IP address, device identifiers, browser type, pages visited, time spent on pages, referral URLs, form interactions, and related technical diagnostics.
User: The individual using our websites (unless otherwise stated).
Data Subject: The person to whom the personal data relates.
Data Processor: An organisation that processes personal data on behalf of the Data Controller.
Data Controller (or Owner): The organisation that determines how and why personal data is processed. For our websites, this is Concrete Canvas Ltd.
Cookies: Small data files stored on your device that help websites function and may support analytics and advertising.
CRM (Customer Relationship Management): A system used to store and manage customer and prospect information, communications, relationship history and sales/service activity.
Marketing Automation: Technology used to deliver and measure marketing communications and journeys (e.g., emails and workflows), manage preferences, segment audiences, and automate actions based on behaviour or criteria.