Privacy Policy

• There is one form on this site, and it asks for four things. Nothing you send is stored in a database.
• We count visits with Google Analytics, and only if you accept the cookie bar.
• We see your IP address when you submit the form, and use it only to stop one sender flooding it.
• We never sell your information, run advertising pixels, build profiles, or make automated decisions about you.
• You can ask us to show, correct or delete what we hold by emailing info@coterium.com.

Coterium is an IT services company headquartered in Accra, Ghana. We are the data controller for the information described in this policy, which means we decide why it is collected and what happens to it. For any question about this policy, or to exercise any of the rights set out below, email info@coterium.com.

Our processing is subject to Ghana’s Data Protection Act, 2012 (Act 843). Where we handle information about people in the European Union or the United Kingdom, we also apply the standards of the GDPR.

What you give us

This website has one form: the contact form. When you submit it, we receive:

• Your name — so we know who we are replying to. Up to 100 characters.
• Your email address — so we can reply. Up to 254 characters.
• A subject line — optional, if you choose to add one. Up to 200 characters.
• Your message — whatever you choose to tell us. Up to 5000 characters.

We do not ask you to create an account, and there is nothing else on this site that collects information from you directly.

What we receive automatically

Like any website, this one cannot serve you a page without your browser telling our host where to send it. When you submit the contact form, our code reads your IP address from the request. Our hosting provider separately records ordinary request metadata — the path you requested, your browser’s user agent, the region that served you, and the response status.

What is stored on your device

Only the items below, and the two cookies appear only after you accept them:

• coterium.consent.analytics (Local storage) — Remembers whether you accepted or rejected analytics, so we do not ask again on every page. Lasts until you clear your browsing data.
• _ga (Cookie) — Tells one browser apart from another, so two visits from you are not counted as two people. Lasts two years.
• _ga_<id> (Cookie) — Holds the state of your current visit. Lasts two years.

A public contact form with no login is an open door, so two quiet measures sit behind it. We would rather describe them than let you discover them.

A submission counter. When you submit the form, we read your IP address from the request and count how many submissions have come from it. Five in ten minutes is the limit; past that, the form replies asking you to try later. The counter lives in memory on the server that handled your request, holds nothing but a count and an expiry, is never written to a database, and disappears within ten minutes. Your IP address is written to our logs only in the moment a limit is actually hit.

A hidden field. The form contains a field that is invisible to you and left empty by every real browser. Automated scripts tend to fill in every field they find. If that field arrives with anything in it, we discard the submission and return an ordinary success response, so the script learns nothing. If you use a screen reader or an unusual browser and ever find yourself filling it in, your message will be silently dropped — email us directly and we will fix it.

Our lawful basis for both is our legitimate interest in keeping a public, unauthenticated form usable. We considered the effect on you: the data involved is minimal, it is not used to identify or profile anyone, it is discarded within minutes, and without these measures the form would not survive contact with the open internet.

• Name, email address, optional subject and message — Reading your enquiry, replying to it, and keeping a record of the exchange. Lawful basis: Your consent, given when you submit the form; and, where your enquiry is about engaging us, the steps taken at your request before entering a contract.
• IP address and request metadata — Counting submissions so one sender cannot flood the form, and keeping the site available. Lawful basis: Our legitimate interest in keeping a public, unauthenticated form usable and free of abuse.
• Analytics measurement data — Counting visits and seeing which pages people read, in aggregate. Lawful basis: Your consent, given through the cookie bar.

You are never required to use the form. Our email address and phone number are published on this site if you would rather reach us directly, and nothing is withheld from you for choosing that route.

We use Google Analytics 4 to count visits and see which pages people read, so that we know whether this site is doing its job. It is the only analytics tool we run, and we read it in aggregate — we are looking at totals and trends, not at you.

No cookies are set until you allow it. On your first visit, a bar at the bottom of the screen asks you to accept or reject analytics cookies. Until you choose Accept, Google Analytics stores nothing on your device and has no way to recognise you on a later visit. Our lawful basis for these cookies is your consent.

One thing we would rather state plainly than bury: the analytics script itself is fetched from Google on every visit, and a single anonymous signal is sent even if you reject. Google receives your IP address and basic browser information as part of that request. It carries no identifier, it cannot be tied to you or to your other visits, and Google Analytics 4 does not log or store IP addresses — yours is used briefly to derive an approximate location, then discarded.

Google acts as our processor for this and handles the data on servers in the United States. We deny Google’s advertising signals outright, so nothing collected here is used for advertising, remarketing or personalisation, and we have not connected this site to any Google advertising product.

Changing your mind

Select Cookie Settings at the bottom of any page to bring the bar back and change your answer. Rejecting takes effect immediately. Your choice is kept under coterium.consent.analytics in your browser’s local storage rather than in a cookie, so clearing your browsing data will make the bar appear again.

We keep the number of parties involved deliberately small. Each one acts on our instructions under a contract, and none of them may use your information for their own purposes:

• Vercel — Hosts the site and runs the code that receives your submission. Handles the data in the United States. Certified under the EU-US Data Privacy Framework; ISO 27001 and SOC 2 Type II audited.
• Resend — Turns your submission into an email and delivers it to our inbox. Handles the data in the United States. Certified under the EU-US Data Privacy Framework and its UK Extension; SOC 2 audited; publishes a data processing addendum and a sub-processor list.
• Google — Provides Google Analytics 4, and only if you accept analytics cookies. Handles the data in the United States. Certified under the EU-US Data Privacy Framework; contracted under Google's data processing terms.
• Our email provider — Stores the resulting message in the inbox the Coterium team reads. Handles the data in the United States. Contracted under that provider's data processing terms.

We do not sell your personal information, we do not share it with anyone else for their own purposes, and we do not disclose it to anyone beyond the parties above unless the law requires it of us.

If delivery fails

If the email cannot be delivered, our server records that the failure happened, along with your name, your email address, any subject line and the length of your message, so that we can still get back to you rather than losing your enquiry silently. The content of your message is never written to these logs.

Third-party assets

Every font, logo and image on this site is served from our own domain, so no content delivery network learns your IP address merely because you opened a page. Google, through the analytics script described above, is the only third-party origin this site contacts.

The providers listed above operate in the United States, so information you send us leaves Ghana. Act 843 permits this where the receiving country or recipient affords an adequate level of protection, and the GDPR requires an approved safeguard for the same transfer.

We rely on our providers’ certification under the EU-US Data Privacy Framework, backed by the standard contractual clauses in their data processing agreements where a provider or a particular transfer falls outside that certification. You can ask us for the details of the safeguard applying to any specific transfer.

• Enquiries that do not lead to an engagement — kept for 12 months. Long enough to pick up a conversation that went quiet, short enough not to hoard messages we will never act on.
• Correspondence connected to work we go on to do — kept for the engagement, then six years. The limitation period for contract claims in Ghana under the Limitation Act, 1972 (NRCD 54).
• Server request logs held by our host — kept for from one hour to a few days, never beyond 30 days. Set by our hosting plan; we do not extend it.
• The submission counter that holds your IP address — kept for 10 minutes. The length of the rate-limit window; it lives in memory and is never written to a database.
• Analytics measurement data — kept for 14 months. The retention period set on our Google Analytics property.

These are the periods we work to. You can ask us to delete your information sooner, and we will unless we are required to keep it.

• The site is served over HTTPS only, with strict transport security, so your submission is encrypted in transit.
• A strict content security policy limits what the page is permitted to load or contact, which is why the only external origin is the analytics script you consented to.
• There is no database and no login. Submissions are turned into an email and are not persisted by this site at all.
• Fonts and logos are hosted by us rather than pulled from a third-party network, so opening a page exposes you to nobody.
• Access to the inbox is limited to the members of the Coterium team who need it.

No website can promise perfect security, and we will not pretend otherwise. What we can say is that we hold as little as possible, for as short a time as possible, which is the most reliable protection there is.

You can ask us to act on any of the following:

• Access — Ask us for a copy of the personal information we hold about you.
• Rectification — Have anything inaccurate corrected, or anything incomplete filled in.
• Erasure — Ask us to delete what we hold, where we have no reason to keep it.
• Restriction — Ask us to pause using your information while a question about it is resolved.
• Objection — Object to processing we carry out on the basis of our legitimate interests.
• Portability — Receive what you gave us in a common, machine-readable format, or have it sent onward.
• Withdrawing consent — Withdraw consent at any time, without affecting anything done before you withdrew it.
• Complaining — Take the matter to a data protection regulator.

Email info@coterium.com and we will respond within one month. There is no fee. We may ask you to confirm your identity before we act, so that we do not hand your information to somebody else. Because everything we hold comes from a form you filled in yourself, these requests are usually simple for us to action.

If you think we have handled your information badly, tell us first — most things are quicker to fix directly. If that does not resolve it, you can complain to a regulator.

In Ghana, that is the Data Protection Commission: Information Services Department, Third Floor, Accra, GA-076-8230. You can reach the Commission at info@dataprotection.org.gh or +233 25 630 1533, and file a complaint through dataprotection.org.gh.

If you are in the European Union or the United Kingdom, you may complain to the supervisory authority in your own country instead — in the UK, the Information Commissioner’s Office.

If personal information held by us or by one of our providers is exposed, we will investigate it, do what we can to contain it, and record what happened. Where the breach is likely to put your rights at risk we will notify the relevant regulator, and where the risk to you is high we will tell you directly and describe what you can do about it. Where the GDPR applies, we notify within 72 hours of becoming aware of the breach. Act 843 requires notification to the Commission as soon as reasonably practicable, and we treat the same 72-hour window as our target.

We do not make decisions about you by automated means, and we do not profile you. A person reads every enquiry that reaches our inbox. The submission counter described above is a volume check, not an assessment of you, and it never produces a decision that affects your rights.

This website is aimed at businesses and working developers. It is not directed at children, and we do not knowingly collect information from anyone under 18, which is how Act 843 defines a child. If you believe a child has sent us something, email us and we will delete it.

If we change how this website handles personal information, we will update this page and change the date at the top. Where a change meaningfully affects what we do with information you have already given us, we will say so clearly rather than rely on you noticing a new date. Our Terms of Service cover your use of the site itself.

Questions about this policy, or about anything we hold, go to info@coterium.com, or to Coterium, Accra, Ghana.