Privacy Policy

This Privacy Policy explains how PrivyNet Ltd ("PrivyNet", "we", "our", "us") collects, uses, and protects your personal data.

• Legal Name: PrivyNet Ltd

• Registered in: England and Wales

• Company Number: 16aboratoryXXX (Companies House)

• Registered Office: [Your registered address]

• Contact Email: privacy@privynet.co.uk

For the purposes of UK GDPR, PrivyNet Ltd is the data controller for account information, website data, and service-related personal data described in this policy.

Where you use our Infrastructure-as-a-Service (IaaS) offerings to process your own customers' or users' data, you act as the data controller for that content, and we act as a data processor on your behalf (see Section 10: Customer Content).

We collect the following categories of personal data:

Account Information:

• Name / Company Name: Used to identify your account.

• Email Address: Used for account login, authentication, and essential service communications.

Payment & Billing Information:

• All payment card processing is handled securely by Stripe. We do not store or process card numbers ourselves.

• We retain billing metadata such as invoice identifiers, payment status, consumption thresholds, and Stripe customer IDs for accounting and service delivery purposes.

Technical & Log Data:

• IP Addresses: Logged when you access our services for security, abuse prevention, and troubleshooting.

• Login Timestamps & Session Data: We record when you log in and out for security auditing.

• Device & Browser Information: User-agent strings and similar technical identifiers collected automatically.

• API Logs: If you use our APIs, we log request metadata (timestamps, endpoints accessed, IP addresses) for security and debugging.

Support Communications:

• If you contact our support team, we retain the content of those communications (which may include personal data you provide) to resolve issues and improve our services.

Service Usage Data:

• Usage records tied to your account for billing, capacity planning, and service improvement (e.g., bandwidth consumption, resource allocation).

We process your personal data under the following lawful bases:

Contract (UK GDPR Article 6(1)(b)):

• To provide, maintain, and administer your account and our services.

• To authenticate users and manage access.

• To process payments and manage invoices.

• To send essential service communications (e.g., service updates, security alerts, billing notifications).

Legitimate Interests (UK GDPR Article 6(1)(f)):

• Platform security: Detecting, preventing, and responding to security incidents, fraud, and abuse.

• Service improvement: Analysing usage patterns to improve reliability, performance, and features.

• Troubleshooting: Diagnosing and resolving technical issues.

• Business operations: Internal record-keeping and administration.

We have conducted legitimate interests assessments for these purposes and concluded that our interests do not override your rights and freedoms, given the nature of the data and our security safeguards.

Legal Obligation (UK GDPR Article 6(1)(c)):

• Retaining financial and billing records as required by UK tax, accounting, and company law.

• Responding to lawful requests from law enforcement or regulatory authorities.

We do not currently send marketing communications. If this changes in the future, we will seek your consent and update this policy accordingly.

We implement robust security measures to protect your information:

• Encryption at Rest: All personal data is stored in encrypted form within our databases.

• Encryption in Transit: Data is transmitted securely using TLS 1.2 or higher (HTTPS).

• Access Controls: Access to personal data is restricted to authorised personnel on a need-to-know basis.

• Authentication Security: We use secure password hashing, and authentication tokens (JWTs) are stored with HttpOnly, Secure, and SameSite cookie attributes.

• Infrastructure Security: Our services are hosted on Microsoft Azure, which maintains comprehensive security certifications including ISO 27001, SOC 2, and more.

• Monitoring: We monitor our systems for security threats and anomalies.

While we take extensive precautions, no system is completely secure. We encourage you to use strong, unique passwords and to notify us immediately if you suspect any unauthorised access to your account.

We retain your personal data in accordance with the following schedule:

Account Data (name, email, preferences):

• Retained for as long as your account remains active.

• Upon account closure or deletion request, we will delete or anonymise this data within 90 days, unless we are required by law to retain it longer.

Billing & Financial Records:

• Retained for 6 years after the transaction date, as required by UK tax and accounting regulations (e.g., HMRC requirements).

Security & Audit Logs (IP addresses, login events, API logs):

• Retained for up to 180 days for security monitoring, incident investigation, and abuse prevention.

• May be retained longer if related to an ongoing security investigation or legal matter.

Support Communications:

• Retained for up to 3 years after resolution to assist with recurring issues and service improvement, unless you request earlier deletion.

Customer Content (data you process using our IaaS services):

• Deleted in accordance with your instructions and our Data Processing Agreement. Upon service termination, customer content is deleted within 30 days unless otherwise agreed.

We use the following third-party service providers who may process personal data on our behalf:

Microsoft Azure (Infrastructure & Hosting):

• Purpose: Cloud hosting, compute, storage, networking, and related infrastructure services.

• Data processed: All service data, including account information, logs, and customer content.

• Location: UK and EU data centres (UK South, UK West, West Europe).

• Safeguards: Microsoft's Data Protection Addendum, ISO 27001, SOC 2, and other certifications.

• Privacy: https://privacy.microsoft.com/

Stripe (Payment Processing):

• Purpose: Processing invoice payments and managing billing.

• Data processed: Payment card details (processed directly by Stripe), billing address, email, transaction records.

• Role: Stripe acts as a data processor for payment processing on our behalf. For certain fraud prevention and regulatory compliance activities, Stripe may act as an independent data controller.

• Privacy: https://stripe.com/privacy

We maintain Data Processing Agreements (DPAs) with our sub-processors to ensure they provide adequate protections for your personal data. We regularly review our sub-processors' security and compliance practices.

A current list of sub-processors is available upon request by contacting privacy@privynet.co.uk.

Your personal data is primarily stored and processed within the United Kingdom and European Economic Area (EEA).

However, some of our sub-processors (such as Stripe and Microsoft) may transfer data to, or access data from, countries outside the UK/EEA, including the United States, for support, infrastructure redundancy, or service delivery purposes.

Where international transfers occur, we ensure appropriate safeguards are in place:

• UK International Data Transfer Agreement (UK IDTA): We rely on the UK IDTA or the UK Addendum to the EU Standard Contractual Clauses, as applicable.

• Adequacy Decisions: Where the UK government has made an adequacy decision for a destination country, transfers may rely on that decision.

• Vendor Agreements: Our sub-processors (Microsoft, Stripe) have committed to appropriate data transfer mechanisms in their terms of service and DPAs.

You may request more information about international transfers and the safeguards in place by contacting privacy@privynet.co.uk.

Under UK GDPR, you have the following rights regarding your personal data:

• Right of Access: Request a copy of the personal data we hold about you (a "Subject Access Request").

• Right to Rectification: Request correction of inaccurate or incomplete personal data.

• Right to Erasure: Request deletion of your personal data ("right to be forgotten"), subject to legal retention requirements.

• Right to Restriction: Request that we restrict processing of your data in certain circumstances.

• Right to Data Portability: Request a copy of your data in a structured, commonly used, machine-readable format.

• Right to Object: Object to processing based on legitimate interests. We will cease processing unless we have compelling legitimate grounds.

• Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time (this does not affect the lawfulness of prior processing).

To exercise any of these rights, contact us at privacy@privynet.co.uk. We may need to verify your identity before processing your request.

We will respond to valid requests within one month. In complex cases or where we receive a high volume of requests, we may extend this by up to two additional months, and we will inform you if this is necessary.

Right to Lodge a Complaint:

If you are not satisfied with how we handle your personal data or your request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

• Website: https://ico.org.uk/

• Helpline: 0303 123 1113

We encourage you to contact us first so we can try to resolve your concerns.

We take data security seriously and have procedures in place to detect, investigate, and respond to personal data breaches.

In accordance with UK GDPR:

• Regulator Notification: Where a breach is likely to result in a risk to the rights and freedoms of individuals, we will notify the Information Commissioner's Office (ICO) without undue delay and, where feasible, within 72 hours of becoming aware of the breach.

• Individual Notification: Where a breach is likely to result in a high risk to your rights and freedoms, we will notify you directly without undue delay, providing information about the nature of the breach and steps you can take to protect yourself.

Not all security incidents constitute reportable breaches. We assess each incident on a case-by-case basis in accordance with ICO guidance.

PrivyNet uses cookies and similar technologies as follows:

Essential/Strictly Necessary Cookies:

• Authentication Tokens: We store JSON Web Tokens (JWTs) in cookies to maintain your authenticated session. These cookies use HttpOnly, Secure, and SameSite attributes for security.

• Session Management: Cookies that maintain your session state while using our services.

• Account Preferences: Storing your preferences (e.g., theme, language) for a consistent experience.

These technologies are strictly necessary for the operation of our services and cannot be disabled.

What We Do NOT Use:

• We do not use cookies or similar technologies for advertising purposes.

• We do not use third-party analytics or tracking cookies (e.g., Google Analytics).

• We do not use social media tracking pixels or cookies.

Local Storage:

We may use browser localStorage or sessionStorage for client-side application state (e.g., UI preferences). This data remains on your device and is not transmitted to our servers except where necessary for service functionality.

If our use of cookies or storage technologies changes in the future (e.g., if we add analytics), we will update this policy and implement appropriate consent mechanisms.

When you use PrivyNet's Infrastructure-as-a-Service (IaaS) offerings, you may process personal data belonging to your own customers, users, or third parties through our infrastructure.

For such Customer Content:

• You are the Data Controller: You determine the purposes and means of processing that data.

• We are the Data Processor: We process Customer Content solely on your instructions and in accordance with our Data Processing Agreement (DPA).

Our Commitments as a Processor:

• We do not access, use, or disclose Customer Content except as necessary to provide the services you have requested, to comply with your instructions, or as required by law.

• We implement appropriate technical and organisational measures to protect Customer Content.

• We will assist you in responding to data subject requests and other obligations under UK GDPR, as set out in our DPA.

If you require a Data Processing Agreement, please contact privacy@privynet.co.uk or refer to our standard DPA available in your account settings.

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors.

When we make changes:

• Significant Changes: We will notify you via email (to the address associated with your account) and/or by posting a prominent notice on our website before the changes take effect.

• Minor Changes: For minor clarifications or updates that do not materially affect your rights, we may update the policy without individual notice.

The "Last Updated" date at the top of this policy indicates when it was last revised. We encourage you to review this policy periodically.

Continued use of our services after changes take effect constitutes your acknowledgement of the revised policy. If you do not agree with the changes, you should discontinue use of our services and close your account.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Email: privacy@privynet.co.uk

• General Support: support@privynet.co.uk

We aim to respond to all enquiries within 5 business days.

For data protection rights requests (access, rectification, erasure, etc.), please email privacy@privynet.co.uk with the subject line "Data Rights Request" and include sufficient information to verify your identity and locate your account.