Privacy Policy

Version 1.0 · Effective date: September 08, 2026

1. About this Privacy Policy

This Privacy Policy explains how your personal data are collected, used, shared, retained and protected in connection with the Site, and what rights you have. The Site is the Coridum website published at coridum.com and www.coridum.com, including its Knowledge section and the Tools published there.

This Privacy Policy does not apply to the device management application published at dm.coridum.com, to the measurements recorded by AirCheck devices, or to the Exposure Report service. Those are separate services with their own privacy notices. It also does not apply to websites operated by third parties which we link to from the Site.

The data categories used throughout this Privacy Policy are Contact Data, Usage Data and Technical Data, as defined in section 3. Terms which name parts of the Coridum knowledge system — Article, Glossary, Data Table, Dataset, Tool — are used in the meaning given to them on the Site itself and are not categories of personal data.

Personal data are processed in accordance with Federal Decree-Law No. 45 of 2021 Concerning the Protection of Personal Data of the United Arab Emirates and, where it applies to you, the General Data Protection Regulation (EU) 2016/679 and other mandatory data-protection legislation of your country of residence.

2. Who is responsible for your data

The controller of the personal data described in this Privacy Policy, and the operator and publisher of the Site, is:

Codeset Group FZE, Al Shmookh Business Center, One UAQ, UAQ Free Trade Zone, Umm Al Quwain, United Arab Emirates, licence no. 3859, e-mail coridum@coridum.com.

Data Protection Officer (Federal Decree-Law No. 45 of 2021 of the United Arab Emirates): Morin Wambui Muriuki, contact: coridum@coridum.com.

Coridum products and services are distributed in other regions through affiliated companies. Those companies are not controllers of the personal data collected through the Site; where you enter into a contract with one of them, you will receive separate information about the processing of your data at that time.

3. What data we collect and how

We keep the collection of personal data on the Site to a minimum. There is no user account on the Site, nothing is sold on it, and we do not buy personal data about you from third parties. All the data described below you either give us yourself, or they are generated when your browser requests a page. Depending on how you use the Site, we may collect the following categories:

Contact Data — your e-mail address, and any name, organisation and message you choose to give us when you write to us or use a contact form on the Site, together with our replies and the rest of that correspondence.
Usage Data — records of how the Site is used: the pages you view, the time and the duration of your visit, the links you follow, the website or search engine you arrived from, your device type, operating system, browser and screen size, your approximate location at the level of country and city, and the randomly generated identifier which analytics cookies store in your browser, as described in section 5.
Technical Data — the data processed by our hosting provider whenever your browser requests a page: your IP address, the address requested, the date and time of the request, the response code, and the user-agent string of your browser.

We do not collect special categories of personal data through the Site. We do not ask you about your health, and the Site has no field in which health information is requested. You should not send us information about your health through the Site; if you nevertheless include such information in a message to us, we will use it only in order to answer you, and we will delete it once the matter has been dealt with.

We do not collect payment-card details on the Site, because no payment is made on the Site.

Providing your e-mail address is necessary in order to receive an answer to an enquiry. If you do not provide it, we cannot answer you. Everything else you enter is optional and is entirely up to you.

4. Why we use your data and on what legal basis

We use your personal data for the following purposes, on the following legal bases:

(a) answering your enquiry and conducting the correspondence which follows from it — Contact Data — legal basis: steps taken at your request before entering into a contract, and our legitimate interest in dealing properly with the matters people bring to us;
(b) measuring how the Site is used, which pages and which subjects are read, and improving the content, the structure and the performance of the Site accordingly — Usage Data — legal basis: our legitimate interest in understanding and improving the Site;
(c) delivering, operating and securing the Site, and detecting and preventing attacks, abuse and fraud — Technical Data — legal basis: our legitimate interest in a secure and available website;
(d) complying with legal obligations, and establishing, exercising or defending legal claims — any of the categories above, to the extent necessary — legal basis: compliance with a legal obligation, and our legitimate interest in defending our rights.

We may also use data which have been aggregated or irreversibly anonymised, so that they no longer identify you, for statistical purposes and for the development of the Site and of our services. Anonymised data are no longer personal data.

We do not sell your personal data, we do not use the Site for advertising or for advertising profiling, and we do not combine Usage Data or Technical Data from the Site with the measurements recorded by AirCheck devices or with data held in the application at dm.coridum.com.

5. Cookies and similar technologies

The Site is a static website and uses two kinds of cookies and similar technologies.

Strictly necessary technologies, without which the Site cannot be delivered to you securely and correctly. They do not require your consent.
Analytics cookies, set by Google Analytics 4, which we use to count visits and to see which pages are read. They store a randomly generated identifier in your browser, which allows us to recognise a returning browser; that identifier is not linked to your name or to your e-mail address. IP addresses are truncated before they are stored, so that the full address is not retained. Google Analytics is operated on the Site without advertising features, without Google Signals and without the sharing of data for advertising purposes.

You can refuse or delete cookies in your browser settings at any time, or install the Google Analytics opt-out browser add-on published at tools.google.com/dlpage/gaoptout.

The Site does not use advertising cookies, cross-site tracking, social-media plug-ins, device fingerprinting or data brokers.

6. Who we share your data with

We do not sell your personal data and we do not make your personal data available to third parties for those parties' own purposes. We share personal data only with the following categories of recipients:

Cloudflare, Inc., which hosts and delivers the Site and operates the domain name service for coridum.com, and which therefore processes Technical Data;
Google Ireland Limited, which provides Google Analytics 4 and Google Search Console, and which therefore processes Usage Data;
H COM, s.r.o., which provides our business e-mail service, and which therefore processes the messages you send to us and Contact Data;
professional advisers and auditors, and, where we are legally required to do so, competent authorities.

All of these recipients act on our documented instructions under a written data-processing agreement, or under an equivalent legal obligation. Any third party with whom we share your personal data is contractually required to provide the same or an equal protection of your data as stated in this Privacy Policy. A current list of our processors is available on request at coridum@coridum.com.

7. International transfers

We are established in the United Arab Emirates, and our processors are established in the United Arab Emirates, in the European Economic Area and in the United States. Your personal data may therefore be transferred outside the country in which you live.

Where personal data are transferred out of the European Economic Area, or to a country which does not provide an adequate level of protection under the applicable data-protection law, the transfer takes place on the basis of appropriate safeguards, in particular the Standard Contractual Clauses approved by the European Commission, or another lawful transfer mechanism. You can request a copy of the safeguards applied by writing to coridum@coridum.com.

8. How long we keep your data

Contact Data: for as long as is needed to deal with your enquiry, and for up to three years afterwards, so that later correspondence on the same matter can be understood; longer only where a legal obligation or a legal claim requires it.
Usage Data in Google Analytics: fourteen months from your last activity, after which they are deleted automatically. Aggregated reports, which no longer identify a browser or a device, may be kept without a time limit.
Technical Data in server logs: only for a short period, as retained by our hosting provider, except where an individual record is kept longer in order to investigate a security incident.
Records of the requests you make to us: for as long as is necessary to demonstrate our compliance, and for the duration of the applicable limitation periods.

Data which have been irreversibly anonymised may be kept without a time limit, as they no longer identify you.

9. Your rights

Subject to the conditions of the applicable law, you have the right to: obtain confirmation of whether we process your personal data and access to those data; have inaccurate data corrected; have your data deleted; obtain a copy of the data you provided to us in a structured, commonly used and machine-readable format and have them transferred to another controller; restrict or object to certain processing, including processing based on our legitimate interests; withdraw any consent you have given, at any time and without this affecting the lawfulness of processing carried out before the withdrawal; and not be subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you.

You can exercise these rights by writing to coridum@coridum.com. We answer within the period required by the applicable law, and at the latest within one month.

You also have the right to lodge a complaint with the UAE Data Office or, where the General Data Protection Regulation applies to you, with the supervisory authority of your country of residence. In the Slovak Republic this is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava.

10. Security

We apply technical and organisational measures appropriate to the risk. The Site is served over encrypted connections only, it is a static website with no visitor database behind it, access to the accounts through which the Site and its analytics are administered is limited to those who need it, and our security measures are reviewed regularly. No method of transmission over the internet and no method of storage is completely secure, and we cannot guarantee absolute security.

If a personal data breach occurs which is likely to result in a risk to your rights, we will notify the competent authority and, where required, you, in accordance with the applicable law.

11. Automated processing and the nature of the content on the Site

We do not make decisions about you by automated means which produce legal effects concerning you or which similarly significantly affect you, and we do not profile you on the Site.

The Knowledge section of the Site publishes Articles, Glossary entries, Data Tables and Tools concerning indoor air quality and its effects. That content is general information, based on published scientific literature and on the standards and limits cited on each page. It is not adapted to you, it does not use any personal data of yours, and it does not constitute medical advice, diagnosis or treatment.

12. Children

The Site is not directed at children. We do not knowingly collect personal data of persons under 16 years of age, or under the higher age set by the law of your country where that applies. If we become aware that we hold such data without the consent of a holder of parental responsibility, we will delete them without undue delay. If you believe that a child has provided us with personal data, please write to coridum@coridum.com.

13. Links to other websites

The Knowledge section links to sources operated by third parties, such as scientific databases, standardisation bodies and public authorities. Those websites are not covered by this Privacy Policy and have their own privacy policies. Once you follow an external link, the processing of your data is no longer under our control.

14. Changes to this Privacy Policy

We may update this Privacy Policy, in particular where the Site, our processors or the applicable law change. Where a change materially affects you, we will inform you in advance on the Site or, where we have your contact details, by e-mail. The current version is always published on the Site, together with its effective date.

15. How to contact us

Controller: Codeset Group FZE, Al Shmookh Business Center, One UAQ, UAQ Free Trade Zone, Umm Al Quwain, United Arab Emirates, licence no. 3859, e-mail coridum@coridum.com.

Data Protection Officer: Morin Wambui Muriuki, coridum@coridum.com.