SimpliSite Privacy Policy
Draft for solicitor review. Not yet in force.
Last updated: [date]
This policy explains how [Simplinet Ltd] trading as SimpliSite ("we") uses personal data about people who visit our website, sign up for or use the SimpliSite service, or contact us. It covers data where we decide why and how it is used (where we are the "controller").
Where a SimpliSite subscriber stores information about their own customers, staff and contacts inside the service, that subscriber is the controller and we process it on their instructions under our Data Processing Agreement. If you are one of those people, contact the business that uses SimpliSite.
Who we are
[Simplinet Ltd], company number [number], [address]. Data protection contact: [privacy@simplisite.co.uk]. We are registered with the Information Commissioner's Office under number [ICO number].
What we collect and why
| Data | Where it comes from | Why we use it | Legal basis |
|---|---|---|---|
| Name, email, organisation, role | You, at sign-up or invitation | Create and run your account, send service messages | Contract |
| Billing name, address, VAT number, last four card digits | You, via Stripe. Full card details are held by Stripe, never by us | Take payment, issue invoices, comply with tax law | Contract, legal obligation |
| Sign-in records, IP address, device and browser, MFA status | Automatically | Security, fraud prevention, troubleshooting | Legitimate interests |
| Usage of the service (pages, features, actions) | Automatically | Improve the product, support you, measure adoption | Legitimate interests |
| Support messages and emails | You | Answer your questions, keep a record | Contract, legitimate interests |
| Marketing preferences | You | Send product news if you opt in | Consent (you can withdraw at any time) |
| Website analytics | Cookies, if you accept them | Understand how the site is used | Consent |
We do not sell personal data and we do not use it for automated decisions with legal or similarly significant effects.
Who we share it with
- Sub-processors who host and run the service on our behalf: Supabase (database and file storage, London), Vercel (application hosting), Stripe (payments), Resend (transactional email), Sentry (error reporting). Each is bound by a contract requiring them to protect your data.
- Xero and other integrations, only where you connect them yourself.
- Professional advisers, regulators and authorities where the law requires it.
- A buyer of our business, if we sell or transfer it, on the same terms.
International transfers
Your data is stored in the United Kingdom. Some sub-processors provide support from outside the UK; where that involves a transfer we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
How long we keep it
- Account and usage data: for the life of the subscription and 90 days after cancellation, then deleted (backups expire within a further [30] days).
- Billing records: six years after the transaction, as required by HMRC.
- Support correspondence: three years.
- Marketing consent records: until you withdraw consent, plus a record of the withdrawal.
Your rights
You can ask us to access, correct, delete or restrict your personal data, to receive it in a portable form, and to object to processing based on legitimate interests. Write to [privacy@simplisite.co.uk]. We respond within one month. You can also complain to the Information Commissioner's Office at ico.org.uk.
Cookies
The application uses strictly necessary cookies to keep you signed in. The marketing website sets analytics cookies only if you accept them in the banner. Details are in the cookie notice on the website.
Changes
We will post changes here and, for material changes, email account owners at least 30 days in advance.