Privacy Policy

Voltware Solutions Ltd ("we", "us", "our") is committed to protecting the privacy and security of individuals who use our software, platforms, and digital services. This Privacy Policy explains what personal data we collect, how we use it, how we protect it, and the rights available to individuals under the UK GDPR and the Data Protection Act 2018. "Personal data" means any information that identifies you or can reasonably be linked to you, such as your name, contact details, or device information.

1. Scope of This Notice

This notice applies to personal data we collect and control ourselves - for example, through our website, when you register for access to a Voltware platform, or when you contact us for support.

This notice does not apply to personal data that our clients enter into a Voltware-hosted platform about their own customers, employees, suppliers, or other contacts (for example, information submitted through a form a client has built, or a record a client's administrator has created). Where this applies, that client is the data controller, and Voltware Solutions Ltd processes that data solely as a service provider, under the client's instructions and our contract with them. If you have provided personal data to an organisation that uses one of our platforms, please contact that organisation directly to find out how they handle your data.

If you provide us with personal data relating to someone else, you must ensure you are authorised to do so.

2. Information We Collect

We collect only the minimum information necessary to operate our software and deliver our services effectively.

2.1 Information You Provide

This may include:

• Name and contact details
• Account registration information
• Business or organisational details
• Support requests or communication with our team
• Files, images, or digital signatures you upload or submit through our platforms - for example when completing a form or updating your profile

2.2 Information Collected Automatically

We may process limited technical data automatically when you access our services, including:

• Device and browser information
• Operating system details
• Basic diagnostic and performance data
• IP addresses (processed only for essential technical and security purposes)

We do not use IP addresses to identify individuals, track behaviour across websites, or create user profiles.

2.3 Information from Third Parties

We may receive information from:

• Hosting and infrastructure providers
• Authentication or integration partners

All third-party data is processed in accordance with UK GDPR requirements.

3. How We Use Your Information

We process personal data only when we have a lawful basis to do so.

3.1 Lawful Bases for Processing

• Legitimate Interests - ensuring security, preventing misuse, maintaining system performance
• Contractual Necessity - providing software services you have requested
• Consent - for any optional features that require it, such as marketing communications
• Legal Obligation - where required by law or regulation

3.2 Purposes of Processing

We use data to:

• Operate and maintain our software and services
• Provide customer support
• Improve system performance and reliability
• Detect and prevent fraud, misuse, or security threats
• Comply with legal obligations

We do not sell personal data or use it for advertising, and we do not carry out targeted advertising or profiling.

4. Cookies and Similar Technologies

We use a single strictly necessary cookie to keep you securely signed in when using our applications. We do not use cookies for advertising, analytics, or tracking, and we do not deploy non-essential cookies without your explicit consent. For full details, see our Cookie Policy.

5. Data Sharing and Third-Party Processors

We may share data with trusted third-party service providers strictly for operational purposes, such as:

• Cloud hosting and infrastructure providers
• Security monitoring services
• Email or communication tools

All third-party processors:

• Are bound by Data Processing Agreements (DPAs)
• Must comply with UK GDPR
• Must process data only on our documented instructions
• Are prohibited from using data for their own purposes

The contact form on our website uses Cloudflare Turnstile to check that a message is being sent by a person rather than an automated program. When you reach the contact form, Turnstile runs in your browser and sends Cloudflare technical information such as your IP address and browser details so that it can make this check. We use the result only to protect the form from spam and abuse, under our legitimate interest in keeping our services secure.

If you were invited to use a Voltware-hosted platform by one of our clients, we may share your usage data with that client, in their capacity as the data controller for that data (see Section 1).

If Voltware Solutions Ltd is involved in a merger, acquisition, or sale of business assets, personal data may be transferred to the relevant party as part of that transaction, subject to the protections described in this notice.

We do not sell personal data to advertisers or data brokers.

6. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes outlined in this policy, including:

• Contractual obligations
• Security and fraud prevention
• Legal compliance

Retention periods are minimised wherever possible. After the applicable retention period expires, data is securely deleted or anonymised.

7. Data Security

We implement appropriate technical and organisational measures to protect personal data, including:

• Encryption
• Access controls
• Secure hosting environments
• Regular security monitoring
• Malware scanning of files you upload, such as profile images, before they are stored
• Privacy-by-design principles in our software development

Profile pictures are handled differently from other files. Once a picture passes its malware scan, it is served through our content delivery network at a long, randomly generated link that does not expire, so it loads quickly in our applications and can appear in emails we send. The link is only shown to people who can already see your profile, such as colleagues in your organisation and our support team, but anyone given the link can view the picture. Pictures are not listed or searchable. Replacing or removing your picture deletes it from storage, though copies already held by a browser or our content delivery network may take a short time to clear. If you would rather not show a picture, leave it blank and your initials are shown instead.

While we take all reasonable steps to protect data, no internet transmission is completely secure.

8. International Data Transfers

Our main servers and databases are located in the United Kingdom, and that is where your data is stored.

To make files load quickly, we deliver them through a content delivery network (CDN) provided by our hosting provider, DigitalOcean, which runs it on Cloudflare's global network. A CDN is a network of servers around the world. When someone opens a file, the nearest CDN server fetches it from our UK storage, keeps a temporary copy and serves it from there, so the next request nearby is faster. These copies expire on their own and the original stays in the UK. Most files can only be fetched through a link that stops working after two hours. Profile pictures use a link that does not expire, as explained in Section 7.

These temporary copies may be held outside the UK or EEA. DigitalOcean and Cloudflare are both certified under the EU-U.S. Data Privacy Framework and its UK Extension, which the UK recognises as giving adequate protection. If that framework stops applying, these transfers are covered by the Standard Contractual Clauses (SCCs) with the UK Addendum, under our data processing agreement with DigitalOcean.

Emails we send you, such as sign-in codes and account notices, go through our email provider, IONOS, whose email service runs in Germany. The UK recognises countries in the EEA as giving adequate protection, so no further safeguards are needed.

If any other data is transferred outside the UK or EEA in future, we will ensure equivalent safeguards are in place.

9. Your Rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you
• Request rectification of inaccurate data
• Request erasure of your data
• Request restriction of processing
• Request a copy of your data (data portability)
• Object to certain types of processing
• Withdraw consent at any time, where processing is based on consent
• Avoid decisions based solely on automated processing that significantly affect you

Requests will be handled within statutory timeframes. You can exercise these rights by contacting us using the details in Section 12.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's independent regulator for data protection, if you believe our processing of your personal data infringes data protection law. The ICO can be contacted at ico.org.uk or by telephone on 0303 123 1113.

10. Children's Privacy

Our services are not intended for individuals under 16. We do not knowingly collect data from children.

11. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date will reflect the most recent revision.

12. Contact Information

Voltware Solutions Ltd does not currently appoint a Data Protection Officer (DPO).

For all privacy or GDPR-related enquiries, please contact:

Voltware Solutions Ltd
Email: [email protected].

Our registered office address and company registration details are published on our Legal Information page.