Privacy

Last updated 19 May 2026

This page explains what information we collect when you visit cc8.co.uk, why we collect it, and what your rights are. We try to keep this short and free of legalese.

What we collect from site visitors

When you visit a page on this site, we record:

• The page you visited and the page that referred you to us
• Your approximate location (country, region, city) and the organisation associated with your IP address — typically your internet provider, or your employer's network if you're visiting from an office
• Your browser type, language, viewport size and approximate time spent on the page
• A salted, one-way hash of your IP address — we never store the raw IP itself

For ordinary site visits we do not use cookies for tracking, we do not run third-party advertising trackers, and we do not attempt to identify you as an individual.

If you sign in to the Concaten8 portal

The portal (at /portal) is an authenticated area for Concaten8 staff. If you have a portal account, we additionally process:

• Your identifiers — email address, display name, and role assignments.
• Authentication data — a salted password hash (never the password itself) and, for accounts that use it, a time-based one-time-password (TOTP) secret, stored encrypted at rest. Accounts that sign in via Microsoft Entra ID do not have a local password.
• Session cookies — a secure, HttpOnly cookie named cc8_access carrying a short-lived JSON Web Token so we can keep you signed in across pages. A short-lived cc8_sso_state cookie is used only during the Microsoft sign-in flow to prevent request forgery.
• Activity logs — sign-in attempts (successful and failed), MFA verification, SSO settings changes, IP address, user agent and timestamp. We use these to detect abuse and to satisfy our security obligations.

Our lawful basis for processing portal data is contract (we need it to provide you with access to the portal) and legitimate interest (keeping the service secure). Portal account data is kept while your account is active and for up to 12 months after it is closed, after which it is deleted. Activity logs are retained for up to 12 months.

Why we collect it

We use this information to understand which pages are useful, where visitors come from, and which businesses are showing interest in our services. This helps us improve the site and reach out to potential clients in a relevant way. Our lawful basis under UK GDPR is legitimate interest: running and improving a small business website.

Microsoft Clarity

We also use Microsoft Clarity to record anonymised session replays and heatmaps so we can see how the site is actually used and fix problems. Clarity does not identify you personally. You can read Microsoft's privacy notice here.

How long we keep visit data

Visit data is retained for up to 12 months and then deleted. The hashed IP address cannot be reversed back to your real IP. Portal account data is covered by the section above.

Your rights

Under UK GDPR you have the right to ask what information we hold about you, request that it be deleted, or object to our processing of it. Because we don't store identifying personal data, in most cases there will be nothing for us to return — but if you'd like us to exclude your IP from future logging, just email us and we'll add it to our ignore list.

Contact

Questions about this page? Email info@cc8.co.uk.