Privacy Policy

This Privacy Policy sets out the data processing practices carried out on any information we collect from visitors to our website, people who use our services, job applicants and our current and former employees and any person who contacts 23red either electronically or by traditional means. If you have any requests concerning your personal information or any queries with regard to these practices please contact our Financial Controller at Please note that all data thus captured will be used and held in accordance with the requirements of the EU General Data Protection Regulation (GDPR).

Visitors to our websites

When someone visits we use a third party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. We do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way which does not identify anyone. We do not make, and do not allow Google to make, any attempt to find out the identities of those visiting our website.

Use of cookies

A cookie is a small piece of information sent by a web server to a web browser, which enables the server to collect information from the browser.  Find out more aboutcookies on

Most browsers will allow you to turn off cookies.  If you want to know how to do this please look at the menu on your browser, or look at the instruction on  Please note however that turning off cookies will restrict your use of our website.

To opt-out of cookies please go to our cookies page.

Visitors to our office

Our office at 20 Northdown Street is monitored by CCTV cameras for security reasons only.  These are strictly in communal and external areas.  Footage can be accessed by our Landlord, Squire and Partners, and the other corporate building tenants, Manifesto Growth Limited and Remedium Partners Limited.  Footage will automatically be erased after one month. 

People who contact us via social media

If you send us a private or direct message via social media we will store your message for three months.  Your information will not be shared with any other organisation.

Should we engage with you in response to your message, your information will be held as appropriate. 

People who email us

We collect information from visitors to this website via a direct email link on our Connect webpage. We collect your details when you email us with an enquiry.  We will only process these collected details for the purpose of dealing with your enquries and requests.  Emails will only be stored for 6 months, unless otherwise responded to for recruitment or business relationship purposes.

We use Mimecast to protect our email traffic.  We monitor any emails sent to us which are received through Mimecast, including file attachments, for viruses and malicious software.  Please be aware that you have a responsibility to ensure that any email you send it within the bounds of the law.

Job Applicants and Employees

23red is the Data Controller for the information you provide during the process unless otherwise stated. 

All the information you provide during the process will only be used for the purpose of processing your application, or to fulfil legal or regulatory requirements if necessary. 

Should you apply for a job or send your CV in and are unsuccessful in gaining employment with us, we will keep your application, CV and interview notes for a period of 7 months (unless we request to keep on file for future opportunities).

Any applications which are successful will be kept on file for the duration of your employment plus 7 years. 

We use several third parties to service our HR function, which are listed below along with links to their privacy policies.

People HR – Internally used HR records system

Royal London – Pension fund administrator

Wealthcare – Employee benefit administrator

MEC Medical – Employee benefit administrator

Health Assured – Employee benefit provider

Legitimate Interests

We have a number of lawful reasons that mean we can use (or 'process') your personal information. One lawful reason is something called 'legitimate interests'. Broadly speaking Legitimate Interests means we can process your personal information if:

  • We have a genuine and legitimate reason, and

  • We are not harming any of your rights and interests.

Such reasons may include for instance:

  • Where we have a shared business interest, including our partnership marketing work

  • To identify and prevent fraud

  • To enhance the security of our network and information systems

Whenever we process data for these purposes, we will ensure that we always keep your Personal Data rights in high regard and take account of these rights.  You have the right to object to this processing if you wish, and please contact if you wish to do so.  Please bear in mind that if you object, this may affect our ability to carry out tasks above for your benefit.

Subject access requests

You have the right to see what personal data we hold about you. To obtain a copy of the personal information we hold about you, please write to us at:

Data Compliance

23red, 20 Northdown Street, London, N1 9BG


We will not share your data with third parties unless we are obliged to disclose personal data by law, or the disclosure is ‘necessary’ for purposes of national security, taxation and criminal investigation, or we have your consent.

Other websites

Our website may contain links to other websites that are outside our control and are not covered by this Privacy Policy.  If you access other sites using the links provided, the operators of these sites may collect information from you that will be used by them in accordance with their privacy policy, which may differ from ours.


Please note that this privacy policy is subject to change from time to time.  It was last updated in May 2018.