Privacy and cookies
This website is operated by Ovett & CxO. This policy explains what personal data we collect through the site, why, and the choices you have.
What we collect
We collect two kinds of information:
- Things you send us. If you contact us by email, WhatsApp, LinkedIn or the booking link, we use what you send only to respond to your enquiry and, if we work together, to manage that engagement.
- How the site is used, if you agree. With your consent, Google Analytics records which pages are visited, roughly where visitors are (country or city level), the device and browser used, and how people arrived at the site. We use this only to understand which content is useful.
We don’t sell personal data, use it for advertising, or combine analytics data with anything you send us.
Cookies
Apart from the sign-in cookie used by the client portal (below), the site sets no cookies unless you choose “Accept analytics” in the cookie banner. If you accept, Google Analytics sets these cookies:
| Cookie | Set by | Purpose | Expires |
|---|---|---|---|
_ga | Google Analytics | Distinguishes one visitor from another | 2 years |
_ga_0LC7F0FTCY | Google Analytics | Keeps track of the current visit | 2 years |
ovett_portal | Ovett & CxO | Keeps you signed in to the client portal. Strictly necessary, so no consent is asked for. Only set when you sign in. | When you close your browser, or after 30 minutes without activity |
Your choice is remembered in your browser’s local storage, not in a cookie, so we don’t ask on every page. We ask again after 12 months. You can change your choice at any time using , also in the footer of every page. Choosing “Reject” stops analytics and removes its cookies.
Client portal
Clients and their named colleagues can sign in to a private portal to follow their engagement. It is by invitation only. For each person it holds:
- Account details: name, work email, organisation and role in the engagement.
- Sign-in details: your password is stored only as a one-way hash, and your recovery codes the same way. Passkeys are stored only as public keys, so your fingerprint, face or device PIN never leaves your device. The secret for your authenticator app is stored so codes can be checked.
- Security records: sign-ins, failed attempts and IP addresses, used to protect accounts and investigate misuse.
- An audit log of every change made in the portal, with who made it and when, so the engagement record can be relied on.
- Engagement content: the plan, checklists, RACI, decisions, risks, deferrals and departures. Documents are not stored in the portal; they stay in your organisation’s own systems.
We use this to deliver the engagement under our contract with your organisation, and to keep the portal secure. Portal access ends 30 days after the engagement’s final readout. Engagement records and the audit log are then kept with our other client engagement records, as set out below. The portal is hosted by our web host, Hostinger, which processes this data on our behalf.
Lawful basis
We use analytics only with your consent, which you can withdraw at any time. We run the client portal to perform our contract with your organisation and in our legitimate interest in keeping it secure. We handle enquiries on the basis of our legitimate interest in replying to people who contact us, or to take steps towards a contract you’ve asked about.
Third-party services
- Google Analytics (Google Ireland Ltd and Google LLC) processes analytics data on our behalf. Data may be transferred to the United States under the safeguards Google provides. Analytics data is kept for 14 months, then deleted.
- Google Fonts supplies the site’s typeface. Your browser requests it from Google’s servers, which means Google receives your IP address. Google Fonts doesn’t set cookies.
- Links to other sites, including news headlines, LinkedIn, GitHub, WhatsApp and the booking page, are run by those organisations under their own privacy policies.
How long we keep data
Enquiries that don’t lead to work are deleted within 12 months. Records of client engagements are kept for as long as needed for legal and accounting purposes.
Your rights
Under UK GDPR, you have the right to access, correct or delete personal data we hold about you, to object to or restrict how we use it, and to withdraw consent at any time. To exercise these rights, contact chris@ovett.co.uk.
If you’re unhappy with how we’ve handled your data, you can complain to the Information Commissioner’s Office at ico.org.uk.
Last updated: October 2026