Privacy & GDPR Policy

1. About this notice

This privacy notice explains how Activi-Business (“Activi-Business”, “we”, “us” or “our”) collects, uses, stores and protects personal data when people visit our website, create an account, subscribe to or use our services, contact us, or otherwise interact with us.

For personal data that Activi-Business collects for its own purposes — for example account, subscription, support and website administration data — Activi-Business acts as a data controller.

Businesses using Activi-Business may upload or create information about their own clients, staff and contacts. For that information, the subscribing business will generally decide why and how the information is used and will generally be the controller; Activi-Business will generally process that information on the business's instructions as its processor. Each subscribing business remains responsible for its own privacy notices, lawful bases, retention decisions and marketing compliance.

2. Information we may collect

• Account and identity information, such as name, business name, username and account identifiers.
• Contact information, such as email address, telephone number and business contact details.
• Subscription and billing information, including plan, payment status, invoices and transaction references. Payment-card details may be handled by our payment provider rather than stored directly by us.
• Workspace content supplied through the service, such as client records, documents, files, forms, emails, tasks, calendar entries, quotes, invoices and account records.
• Team and access information, including roles, permissions and activity associated with an account.
• Support and correspondence information when you contact us.
• Technical, security and usage information needed to operate, protect and improve the service, such as device/browser information, logs and authentication events.
• Cookie and similar technology information where applicable and permitted.

Some customers may choose to store information that is particularly sensitive. Customers must ensure they have an appropriate lawful basis and any additional legal condition required before putting such data into Activi-Business.

3. Why we use personal data

Depending on the circumstances, we may use personal data to provide and administer accounts and subscriptions; authenticate users and manage permissions; provide requested workspace features; process billing; provide support; maintain security, prevent misuse and investigate incidents; comply with legal obligations; maintain business records; improve the reliability and functionality of the service; and send service communications.

Where a business chooses to use client email automation or marketing features, that business is responsible for ensuring its communications are lawful and for respecting opt-outs and marketing preferences.

4. Lawful bases

Where Activi-Business is the controller, the lawful basis depends on the activity. We may rely on performance of a contract where processing is necessary to provide a subscribed or requested service; legal obligation where the law requires processing; legitimate interests where necessary for proportionate business, security, fraud-prevention, service-management or improvement purposes and those interests are not overridden by individual rights; and consent where consent is required or is the appropriate basis.

Where consent is used, it may be withdrawn at any time. Withdrawal does not make processing carried out before withdrawal unlawful.

5. Client email automation and marketing

Activi-Business may provide tools allowing subscribing businesses to create their own email templates, reminders, birthday messages, offers and other automations. The subscribing business controls the content, recipients, timing and purpose of those communications.

Businesses must distinguish service communications from direct marketing, record appropriate marketing preferences, honour objections and unsubscribe requests, and obtain consent where required. Activi-Business does not grant a business permission to market to an individual merely because that person's details are stored in the platform.

6. Sharing information and service providers

We may use carefully selected service providers to operate Activi-Business, including hosting, database/storage, authentication, email-delivery, payment, security and technical service providers. They may process personal data only as necessary to provide their services to us and subject to appropriate contractual and security arrangements.

We may also disclose information where required by law, to protect legal rights or security, in connection with professional advice, or as part of a lawful business restructuring or transfer.

We do not sell personal data to advertisers.

7. International transfers

Some service providers may process information outside the UK. Where UK data protection law requires safeguards for an international transfer, we will use an appropriate lawful transfer mechanism and any supplementary measures required for the circumstances.

8. Data retention

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including providing the service, maintaining appropriate business and financial records, resolving disputes, enforcing agreements, meeting legal requirements and maintaining security.

Retention periods may differ by data type. Subscribing businesses are responsible for setting and applying appropriate retention periods to the personal data they control within their workspace. When an account or workspace is closed, some information may remain for a limited period in backups, audit/security records or where retention is legally required.

9. Security

We use organisational and technical measures intended to protect personal data against unauthorised access, alteration, disclosure, loss or destruction. These may include authentication, role-based access controls, encryption where appropriate, access restriction, logging and secure service providers. No online service can guarantee absolute security, so customers should also protect passwords, user accounts and authorised staff access.

10. Your data protection rights

Depending on the circumstances, UK data protection law may give you rights to be informed about processing; request access to your personal data; ask for inaccurate data to be corrected; request erasure; request restriction; object to certain processing, including direct marketing; receive certain data in a portable format; and raise concerns about certain automated decision-making.

Some rights are subject to legal conditions and exemptions. If your request relates to data entered into Activi-Business by one of our subscribing businesses, you should normally contact that business first because it is generally the controller of that information. We will assist our business customers with relevant data-subject requests where required.

11. Cookies and similar technologies

We may use strictly necessary technologies to provide security, authentication, sessions and core website functionality. If we introduce non-essential analytics, advertising or similar tracking technologies that require consent, they should not be activated until the visitor has made the required choice. Information about the technologies actually in use should be made available through our cookie information/consent controls.

12. Children

Activi-Business is designed as a business workspace and is not intended as a consumer service directed at children. A business that chooses to process children's personal data through its workspace is responsible for ensuring that processing is lawful, fair, transparent and appropriately protected.

13. Changes to this notice

We may update this notice as Activi-Business develops or where legal, regulatory or operational requirements change. The current version will be published on this page with its latest update date.

14. Contact and complaints

Questions, requests or concerns about Activi Business privacy practices can be sent to activi-businessdata@outlook.com.

You also have the right to complain to the UK Information Commissioner's Office (ICO) if you have concerns about how your personal information has been handled. We would welcome the opportunity to address your concern first.