Personal data is anything that points to a person
Names, emails, phone numbers, home addresses, bank details, contracts, ID documents, photos and videos of someone, notes about them. If it's about a person who could be identified, it counts.
We hold data on creators, brand contacts, prospects and each other. The same rules apply to all of it.
Approved places only
- The hub (hub.cortexca.com): creators, deals, money, and bank details through the hub's bank details form.
- CCA Google Drive: contracts, briefs, content, in the right shared folder.
- Your CCA Gmail, for conversations.
- Personal email, personal Google accounts or personal cloud storage
- Notes apps or screenshots on your own phone
- Downloads left sitting in your Downloads folder or on your desktop
- Pasting creator details into tools CCA hasn't approved (including free AI tools)
Six habits
- Only what we need. Don't collect or keep details "just in case".
- Bank details never travel by email or DM. If a creator sends them that way, point them to the hub form and tell Edric, so the stray copy can be dealt with.
- Share files with named people, not "anyone with the link".
- Check the "To" line before you press send. Autocomplete causes most mistakes.
- Lock your screen when you step away, and use two-step login on your CCA account.
- Ask first before sharing anything about a creator with a brand beyond what the deal needs.
When someone asks about their data
Anyone can ask what we hold about them (a "subject access request"), or ask us to correct or delete it. We have one month to respond.
If you get one: don't reply yourself. Forward it to Edric the same day. It doesn't have to use any special words: "can you send me everything you have on me" counts.
Tell us within the hour
Wrong recipient, a lost or stolen laptop or phone, a hacked account, a folder shared publicly by mistake. Tell Edric or Reece straight away, even if you're not sure it matters.
Some leaks have to be reported to the Information Commissioner's Office (the ICO, the UK data regulator) within 72 hours, so every hour counts. You will never be in trouble for reporting a mistake quickly. Hiding one is the only thing that makes it worse.
Client secrets and your own social media
- Briefs, launches, fees and campaign results are confidential until the brand makes them public. Many of our contracts say so in writing.
- Never share one creator's fee or deal terms with another creator.
- On your own social media: no posts about unreleased campaigns, and nothing about a creator's private life or health that they haven't made public themselves.
- AI tools: only use the ones CCA has approved, and never paste in contracts, bank details or health information.
Check what stuck
Questions are picked at random from a bigger set. If you don't pass, re-read the sections it names and try again: you'll get different questions.