Privacy Notice

Who we are

{{companyName}} is a company registered in {{registrationLocation}} with registered office at {{registeredAddress}}.

For the personal data covered by this Privacy Notice, StackTrack is the controller.

If you have questions about this Privacy Notice or about how we use personal data, you can contact us at:

• `dpo@servanamanaged.com`

• Data Protection Officer, {{companyName}}, {{registeredAddress}}

When this notice applies

This Privacy Notice applies when:

• you visit or interact with our website;

• you contact us about our services;

• we market our services to you;

• you or your organisation buy services from us;

• you work for, or represent, one of our customers, suppliers, or partners;

• you respond to surveys, reviews, or feedback requests.

This Privacy Notice should be read together with our Website Terms of Use and Cookie Policy.

Where we process personal data on behalf of a customer in the course of providing managed services, we generally act as a processor and that processing is governed primarily by the customer contract and applicable data processing terms.

Personal data we collect

Depending on how you interact with us, we may collect:

Website and technical data

• IP address

• browser type and version

• device type and operating system

• website usage data

• referral data

• cookie and similar technology data

Enquiry and contact data

• name

• business email address

• phone number

• company name

• job title

• details of your enquiry or correspondence

Customer relationship and commercial data

• contract contact details

• billing contact details

• order, quotation, and subscription records

• communication history

• account management records

• feedback and survey responses

Marketing data

• marketing preferences

• event registrations

• newsletter subscription details

• campaign engagement records, where used lawfully

Service-related contact and support data

• names and work contact details of customer personnel

• support requests and incident communications

• operational contact records

• access and authentication-related contact details where needed for service delivery

We may also receive personal data from third parties such as analytics providers, review platforms, referral partners, public business sources, or your employer or organisation.

How we use personal data and our lawful bases

We process personal data only where we have a lawful basis to do so.

To operate our website and keep it secure

We use website and technical data to operate, monitor, secure, troubleshoot, and improve our website.

Lawful basis:

• legitimate interests, namely running, securing, and improving our website and digital services.

To respond to enquiries and manage pre-contract discussions

We use enquiry and contact data to respond to questions, arrange demos, prepare quotations and statements of work, and communicate with prospective customers.

Lawful basis:

• steps taken at your request before entering into a contract;

• legitimate interests, namely managing business enquiries and sales opportunities.

To provide services and manage customer relationships

We use customer relationship and service-related contact data to onboard customers, manage accounts and subscriptions, administer contracts and renewals, provide support, manage incidents, and handle billing and payment administration.

Lawful basis:

• performance of a contract;

• legitimate interests, namely administering customer relationships and operating our business;

• legal obligation, where we must keep accounting, tax, or compliance records.

To send service communications

We use contact and account data to send account, support, security, service change, billing, and contract communications.

Lawful basis:

• performance of a contract;

• legitimate interests, namely ensuring effective service delivery and account management.

To send marketing communications

We may use contact and marketing data to send you information about our services, insights, events, and updates.

Lawful basis:

• consent, where required; or

• legitimate interests, where direct marketing is permitted by law and our interests are not overridden by your rights and interests.

To request reviews or feedback

We may use your name, business contact details, and details of the services you purchased to ask for feedback or reviews, including through a review platform such as Feefo where used.

Lawful basis:

• legitimate interests, namely measuring customer satisfaction and improving our services.

To comply with legal and regulatory obligations

We may use personal data to comply with legal obligations, respond to lawful requests, and establish, exercise, or defend legal claims.

Lawful basis:

• legal obligation;

• legitimate interests, namely protecting our legal rights and business interests.

Who we share personal data with

We may share personal data where necessary with:

• our employees, contractors, and group companies on a need-to-know basis;

• hosting, cloud, infrastructure, and IT service providers;

• CRM, ticketing, communications, and productivity tool providers;

• payment processors, accountants, auditors, insurers, and professional advisers;

• analytics, website, chat, messaging, and review platform providers;

• regulators, courts, law enforcement agencies, or other authorities where required by law;

• a buyer, investor, or successor organisation in connection with a merger, acquisition, financing, or business transfer.

We do not sell personal data.

International transfers

Some of our service providers or support functions may be located outside the UK, or may access personal data from outside the UK.

Where we transfer personal data outside the UK, we will ensure that a lawful transfer mechanism is in place, such as:

• UK adequacy regulations;

• the UK International Data Transfer Agreement;

• the UK Addendum to the EU Standard Contractual Clauses; or

• another lawful safeguard permitted by UK data protection law.

How long we keep personal data

We keep personal data only for as long as necessary for the purposes described in this Privacy Notice, including for legal, regulatory, tax, accounting, security, and operational reasons.

As a guide:

• website and analytics data is typically kept for short operational and reporting periods, subject to cookie settings and analytics configuration;

• enquiry data is kept for as long as needed to deal with the enquiry and for a reasonable follow-up period;

• customer and contract contact data is kept for the duration of the contract and for a reasonable period afterwards for record-keeping, legal, tax, and service management purposes;

• billing and financial records are kept for as long as required by applicable accounting and tax rules;

• marketing suppression records are kept as needed to ensure we respect opt-out requests.

Cookies and similar technologies

We use cookies and similar technologies for website operation, analytics, performance, support and chat, and user experience purposes.

Please see our Cookie Policy for more information, including how to manage your preferences.

Your rights

Depending on the circumstances, you may have the right to:

• be informed about how your personal data is used;

• request access to your personal data;

• request correction of inaccurate or incomplete personal data;

• request erasure of your personal data;

• request restriction of processing;

• object to processing carried out on the basis of legitimate interests;

• object to direct marketing;

• request transfer of your personal data where the right applies;

• withdraw consent at any time where we rely on consent.

Complaints

If you have concerns about how we use personal data, please contact us first and we will try to resolve the issue.

You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection matters.

Third-party websites

Our website may contain links to third-party websites, plug-ins, or services. We are not responsible for the privacy practices of those third parties and encourage you to read their privacy notices.

Changes to this notice

We may update this Privacy Notice from time to time to reflect changes in our services, legal obligations, or data processing practices.

The latest version should always be made available on our website together with the effective date.