Your data. Your rules. Fully compliant.

Last updated: May 2026 · Solicitor reviewed

1. Who We Are

Company	Datavacy Ltd
Company Number	17152498
Registered Office	Knight Road, Oxford, OX4 6DF
ICO Registration	ZC137164 (expires 29 April 2027)
UK Trade Mark	UK00004373201, Class 42
Email	hello@datavacy.co.uk

Datavacy Ltd acts as data controller for personal data processed under this Policy. Where customers store their own data in the platform, we act as data processor governed by our DPA.

2. Scope

This Policy applies to visitors to our website, customers and users of the Service, and individuals whose personal data we process in connection with our business.

3. Personal Data We Collect

Information you provide:

Full name, email address, telephone number, business name and details, account credentials, support communications.

Information collected automatically:

IP address, device identifiers, browser type and version, usage and activity data, log files and audit data.

Payment information:

Payments processed by Stripe. We receive transaction confirmations and billing details only — no card data is stored by us.

4. How We Use Your Data

Purpose	Legal Basis
Provide and manage the Service	Contract (Article 6(1)(b))
Manage user accounts	Contract (Article 6(1)(b))
Process payments	Contract (Article 6(1)(b))
Provide customer support	Contract / Legitimate Interests
Improve and develop the Service	Legitimate Interests (Article 6(1)(f))
Ensure security and prevent fraud	Legitimate Interests (Article 6(1)(f))
Send marketing communications	Consent / Soft opt-in (PECR)
Comply with legal obligations	Legal Obligation (Article 6(1)(c))

5. Marketing Communications

You will only receive marketing emails where you have consented or it is otherwise permitted by law. You may unsubscribe at any time via any email link or by contacting us directly.

6. Sharing Your Data

We may share your data with service providers (cloud hosting, payment processors, customer support platforms) who are contractually bound to process data only on our instructions. We may also disclose data where required by law. We do not sell personal data to third parties.

7. International Data Transfers

Where personal data is transferred outside the UK, we ensure appropriate safeguards including UK International Data Transfer Agreements (IDTA), adequacy decisions, and Standard Contractual Clauses.

8. Data Retention

Category	Retention Period
Account data	Contract duration + up to 6 years
Financial records	6–7 years (HMRC requirement)
Usage / analytics data	Up to 24 months
Support communications	Up to 3 years

9. Data Security

We implement appropriate technical and organisational measures including encryption in transit (TLS) and at rest, role-based access control, authentication and access logging, and monitoring and incident response procedures.

10. Your Rights Under UK GDPR

Contact us at hello@datavacy.co.uk to exercise any of the following rights. We will respond within 30 days.

• Access (Article 15) — obtain a copy of your personal data
• Rectification (Article 16) — correct inaccurate data
• Erasure (Article 17) — request deletion where no overriding basis applies
• Restriction (Article 18) — limit how we process your data
• Portability (Article 20) — receive data in machine-readable format
• Object (Article 21) — object to legitimate interests processing
• Withdraw consent — where processing is based on consent

11. Automated Decision-Making

We do not carry out automated decision-making that produces legal or similarly significant effects on individuals.

12. Children's Data

Our Service is not intended for individuals under 18. We do not knowingly collect personal data from children.

13. Third-Party Links

Our website may include links to third-party websites. We are not responsible for their privacy practices.

14. Complaints

Contact us at hello@datavacy.co.uk with any concerns. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk · 0303 123 1113.

15. Changes to This Policy

We may update this Policy from time to time. Material changes will be notified via email or within the Service.

16. Contact

Email: hello@datavacy.co.uk
Post: Datavacy Ltd, Knight Road, Oxford, OX4 6DF
Company No: 17152498

Last updated: March 2026 · Solicitor reviewed

1. About Datavacy

Datavacy is a SaaS compliance tool provided by Datavacy Ltd (Company No. 17152498), registered in England and Wales. Our platform helps small businesses understand and meet their data privacy obligations under UK GDPR.

2. Using Our Service

• You must be at least 18 years old and a business owner or authorised representative
• You are responsible for the accuracy of information you provide
• You must not misuse, reverse-engineer, or attempt to breach our systems
• One account per business unless agreed otherwise

3. Important Disclaimer

4. Subscription & Billing

• Paid plans are billed monthly or annually in advance
• You may cancel at any time — access continues until end of billing period
• Refunds are available within 14 days of initial purchase
• Prices may change with 30 days' notice

5. Free Trial

New users receive their first month free. No credit card required to start. We will never auto-charge without your consent.

6. Intellectual Property

All content, branding, and software is owned by Datavacy Ltd. UK Trade Mark: UK00004373201, Class 42. You may not copy, reproduce, or redistribute any part of our Service without written permission.

7. Limitation of Liability

To the extent permitted by law, Datavacy Ltd is not liable for any indirect, incidental, or consequential damages. Our total liability shall not exceed the amount you paid in the preceding 12 months.

8. Termination

We reserve the right to suspend or terminate accounts that violate these terms. You may close your account at any time by contacting us.

9. Governing Law

These terms are governed by the laws of England and Wales. Any disputes shall be subject to the exclusive jurisdiction of the English courts.

10. Changes to Terms

We may update these terms from time to time. We will notify you by email at least 14 days before any material changes take effect.

11. Contact

Email: hello@datavacy.co.uk
Post: Datavacy Ltd, Knight Road, Oxford, OX4 6DF
Company No: 17152498

Last updated: May 2026 · Solicitor reviewed

1. What Are Cookies?

Cookies are small text files placed on your device when you visit a website. They allow websites to recognise your device, store preferences, and improve functionality.

2. Legal Framework

Our use of cookies complies with UK GDPR and the Privacy and Electronic Communications Regulations (PECR). Where required, we seek your consent before placing non-essential cookies.

3. Types of Cookies We Use

Cookie Type	Purpose	Consent Required?	Duration
Strictly Necessary	Login, security, session management, fraud prevention	No — essential	Session / up to 12 months
Analytics	Measure site usage, improve performance, identify errors	Yes	Up to 24 months
Functional / Preference	Remember your choices, language, region settings	Yes	Up to 12 months
Marketing / Advertising	Deliver relevant ads, measure campaign effectiveness	Yes	Up to 24 months

4. Cookie Consent Management

When you first visit our website you will see a cookie banner. You can accept all cookies, reject non-essential cookies, or customise your preferences. You may change your preferences at any time via the cookie settings link on our website.

5. Legal Basis

Cookie Type	Legal Basis
Strictly necessary	Legitimate Interests
Analytics	Consent
Functional	Consent
Marketing	Consent

6. Third-Party Cookies

We may use third-party services that place cookies, including analytics providers and infrastructure providers. These third parties are required to comply with applicable data protection laws.

7. International Transfers

Where third-party cookies involve transfers of data outside the UK, we ensure appropriate safeguards are in place including UK IDTAs and adequacy decisions.

8. Example Cookies

Cookie Name	Type	Purpose	Duration	Provider
session_id	Necessary	Authentication	Session	Datavacy
__clerk_db_jwt	Necessary	Secure login session	Session	Clerk
pref_lang	Functional	Language preference	12 months	Datavacy
_ga	Analytics	Usage tracking	24 months	Google

9. Managing Cookies via Browser

You can control cookies through your browser settings — blocking or deleting existing cookies. Note that disabling strictly necessary cookies may impact core functionality.

10. Contact

Email: hello@datavacy.co.uk
Post: Datavacy Ltd, Knight Road, Oxford, OX4 6DF

Article 28 UK GDPR compliant · Solicitor reviewed · May 2026

1. Roles of the Parties

The Controller determines the purposes and means of processing personal data. Datavacy Ltd acts as the Processor, processing personal data solely on behalf of the Controller and only on documented instructions.

2. Scope of Processing

Subject matter	Provision of the Datavacy SaaS compliance platform
Data types	Names, contact details, business data, usage and technical data, any data uploaded by the Controller
Data subjects	Controller's employees, customers, and authorised users
Duration	For the duration of the Agreement and until deletion/return of data

3. Processor Obligations

• Process personal data only on documented instructions from the Controller
• Ensure all personnel are subject to confidentiality obligations
• Implement appropriate technical and organisational security measures
• Assist the Controller with compliance obligations under Articles 32–36 UK GDPR
• Maintain records of processing activities where required

4. Sub-processors

The Controller authorises use of sub-processors. Datavacy will maintain an up-to-date sub-processor list, notify the Controller of changes, and ensure sub-processors are bound by equivalent data protection obligations. Current sub-processors:

Provider	Purpose	Location	Safeguard
Railway	API hosting & database	USA	UK IDTA
Vercel	Frontend hosting	USA	UK IDTA
Clerk	Authentication	USA	UK IDTA
Stripe	Payment processing	USA / Ireland	UK IDTA / Adequacy
Resend	Email delivery	USA	UK IDTA
Cloudflare	DNS & CDN	USA / Global	UK IDTA

5. Security Measures

• Encryption of data in transit (TLS) and at rest
• Access control and authentication mechanisms
• Logging and monitoring of access
• Regular vulnerability testing
• Secure data storage environments

6. Data Breach Notification

Datavacy will notify the Controller without undue delay and within 72 hours of becoming aware of a personal data breach, including nature, categories affected, likely consequences, and measures taken.

7. Data Subject Rights

Datavacy will assist the Controller in responding to requests from data subjects. Datavacy will not respond directly unless authorised or legally required.

8. Audit Rights

Datavacy will make available information necessary to demonstrate compliance. The Controller may conduct audits with reasonable notice, no more than once per year, subject to confidentiality.

9. Deletion & Return of Data

Upon termination, Datavacy will delete or return all personal data at the Controller's choice, except where retention is required by law.

10. Governing Law

This DPA is governed by the laws of England and Wales.

Request a Signed DPA

Enterprise customers requiring a countersigned DPA should contact us at hello@datavacy.co.uk.

Got a question or partnership idea? We typically respond within one business day.

Perfect for sole traders and new businesses getting the compliance basics in place.