Privacy notice

Who we are

CAFiL is a research lab in the Department of Engineering, School of Science & Technology, City St George’s, University of London, Northampton Square, London EC1V 0HB. City St George’s, University of London is the controller of the personal data described in this notice. It is registered with the Information Commissioner’s Office under number Z8947127.

You can contact the university’s Data Protection Officer at dataprotection@citystgeorges.ac.uk. This notice covers the lab’s website and work; the university’s own privacy notices, published on its website, cover its wider activities.

What we collect

• When you contact us through a form or by email: your name and email address; your organisation, role, sector or type of organisation if you give them; what you are getting in touch about and your message; any files you choose to attach (PhD enquiries only); the page you wrote from, the language of the page, and a record that you ticked “I have read the privacy notice” (the wording and the date).
• When you register interest in an event, a programme or becoming an Associate: the same details, plus the events, themes or programme you are interested in and any profile link you give.
• Extended data packs: reports are free to download without giving any details. Where a report comes with an extended data pack, we ask first for your name, email address and, if you wish, your organisation.
• Updates and Agentic Finance Monthly: your email address, the date you signed up and confirmed, and where you signed up.
• Profiles on this website: if you accept an invitation to be listed, the details and photograph you send us and your agreement to publish them.
• Working with us: if you become a partner, client, member, student, speaker or event contact, the contact details and records of our dealings that we need to work together.
• Visits to the website: statistics about how the website is used (see “Visitor statistics” below) and the technical records our server keeps for security.

Each form marks the details it needs. You do not have to give us your details, but without them we may not be able to answer your enquiry or register your interest.

If someone else gives us your details, for example a colleague who registers you for an event, we tell you when we first contact you.

Why we use it, and our lawful basis

• Responding to your enquiry and taking any steps you ask for before working with us. Lawful basis: our legitimate interests in answering the people who contact us, or steps taken at your request before entering into a contract.
• Managing our relationships with partners, clients, members, students and event contacts. Lawful basis: performance of a contract where we have one with you; otherwise our legitimate interests in running the lab’s relationships.
• Keeping a record of our contact with you, so that we can follow up on collaboration, events, research and business development. Lawful basis: our legitimate interests in building lasting working relationships. You can object at any time.
• Running events, programmes and services, including registrations, attendance and the arrangements they need. Lawful basis: performance of a contract, or our legitimate interests, or our public task as a university where the activity is part of teaching or research.
• Sending updates and Agentic Finance Monthly. Lawful basis: your consent, which you give by ticking the optional box on a form, or by signing up, and then confirming by email. Every email has a link to unsubscribe, and you can withdraw your consent at any time.
• Statistics and improving the website and our services. Lawful basis: our legitimate interests in understanding how the website is used, with the safeguards described below.
• Research and statistics, using anonymised or aggregated data wherever possible. Lawful basis: our public task as a university, or our legitimate interests, with safeguards appropriate to research.
• Legal, regulatory, audit and security purposes, including keeping the website and our systems secure, preventing abuse and keeping records we are required to keep. Lawful basis: legal obligation, or our legitimate interests in protecting our systems and the people who use them.

Our forms ask you to tick “I have read the privacy notice”. This confirms that you have seen this notice; it is not the lawful basis for using your details, which is set out above. The separate box for updates and Agentic Finance Monthly is optional and unticked, and ticking it is your consent to receive them.

We do not sell personal data. We do not send marketing emails without your consent. We do not use your data for purposes that are incompatible with those above, and we do not make decisions about you by automated means alone.

Visitor statistics

We count visits with Matomo, which runs on our own server, so the information stays with us. It sets no cookies and stores nothing on your device. To count a visit, our statistics script reads basic details from your browser that do not identify you, such as the screen size, the local time and the light or dark display, and uses them only for statistics. Before anything is stored, your IP address is shortened by two bytes (for example, 203.0.113.7 becomes 203.0.0.0), and the approximate country, region and city are worked out from the shortened address.

Matomo keeps a record of each visit, with the shortened address and no name, for 13 months, and then deletes it; after that we keep only totals. We see information such as the pages visited, how far pages are read, searches on this website, downloads, links followed, the referring website or campaign, the language and theme of the page, and the type of device and browser. We do not collect age, gender or interests, and we do not follow you across other websites.

You can stop your visits being counted at any time with “Count my visit in statistics” in Cookie settings, at the foot of each page. If your browser sends a Global Privacy Control or Do Not Track signal, the website does not count your visit.

When an enquiry arrives, the website also looks up the sender’s approximate country from the shortened IP address. Only the country is kept with the enquiry, so that we can count enquiries by country; the address itself is not kept.

Security and server records

Our web server records technical details of each request, including the IP address, to keep the website secure and to stop abuse. Our forms are protected against spam without cookies and without other companies’ services.

Who handles your data for us

Our website and statistics run on our own server. We share personal data with the following service providers only so that they can provide their services to us, under contracts that require them to protect it:

• Hostinger (Hostinger International Ltd, Cyprus) provides the server, which is located in the United Kingdom.
• Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg) delivers the emails the website sends, such as acknowledgements and notifications to our team, through Amazon Simple Email Service in its London region.
• Namecheap (Namecheap, Inc., United States) forwards emails sent to our cityagenticfinance.org addresses to the lab’s mailbox, until the lab’s own mail server is in place.

Some content from other websites loads only when you ask for it. The map on our Contact page comes from OpenStreetMap when you choose to show it, and videos hosted on YouTube or Vimeo load only when you press play. These services then receive your IP address and handle it under their own privacy policies; YouTube (Google) and Vimeo are based in the United States.

Within City St George’s, your details are seen only by the people who need them for the purposes above. We may also disclose personal data where the law requires it.

International transfers

Our server is in the United Kingdom, and Amazon sends our emails from its London region. Some of our providers are based outside the UK, as listed above, and their staff or systems may handle personal data from there, for example when they forward email or provide support. Where that happens, we make sure the transfer is covered by UK adequacy regulations or by appropriate safeguards, such as the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, as UK data protection law requires.

How long we keep it

We may keep your details after we have answered an enquiry, for the purposes described above, for as long as is reasonably necessary. We then delete them or make them anonymous. Visit records in our statistics are deleted after 13 months; we keep only totals. You stay on our mailing list until you unsubscribe.

Your rights

You have the right to ask for a copy of your personal data, and to ask us to correct it, delete it, restrict how we use it or give it to you in a portable format. You can object at any time to our use of your data based on legitimate interests or public task, and you can always object to direct marketing. Where we rely on your consent, you can withdraw it at any time; this does not affect what we did before. To use any of these rights, email hello@cityagenticfinance.org or the university’s Data Protection Officer at dataprotection@citystgeorges.ac.uk.

Complaints

If you are unhappy with how we have handled your data, please tell us first so that we can put it right. You can also complain to the Information Commissioner’s Office: ico.org.uk/make-a-complaint or 0303 123 1113.

Changes to this notice

We will update this notice when our practices change. The date below shows when it last changed.

Current version: October 2026