Privacy Policy & Data Protection Framework

1. Identity of the Data Controller

Poppetlystashpnt Technologies Ltd ("Poppetlystashpnt", "we", "our", or "us"), registered under United Kingdom Company Number 14892015, with registered offices at 84 Observatory Way, FinTech Quarter, London EC2A 4NE, United Kingdom, acts as the Data Controller with respect to account credentials, billing information, and web platform telemetry. When enterprise users upload spreadsheets for analytical processing, Poppetlystashpnt acts as a Data Processor under applicable data protection laws.

2. Data Collection Categories and Technical Scope

We collect personal data and operational parameters strictly necessary to deliver high-performance visual dashboard services:

• Direct Contact Data: Name, business email address, organizational affiliation, job title, and narrative communications submitted via our contact and consultation forms.
• Authentication and Account Data: Hashed passwords, multi-factor authentication tokens, API credentials, and session identifiers.
• Client-Uploaded Business Data: Spreadsheets, CSV payloads, and database configuration strings uploaded for visualization. As described in our security framework, these files are processed in ephemeral volatile memory (RAM) and are not repurposed for model training or secondary marketing.
• Telemetry and Device Data: Internet Protocol (IP) addresses, browser user agent strings, system language, operating system architecture, and anonymized user interaction telemetry (e.g., chart zoom events, session duration).

3. Legal Bases for Data Processing (UK / EU GDPR)

In accordance with Article 6 of the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018, our legal bases for data operations comprise:

• Contractual Necessity (Art. 6(1)(b)): Delivering requested spreadsheet ingestion, KPI anomaly calculations, and boardroom export dossiers.
• Legitimate Interests (Art. 6(1)(f)): Maintaining network resilience, mitigating unauthorized automated intrusions, debugging parser errors, and optimizing platform performance.
• Legal Obligation (Art. 6(1)(c)): Complying with financial accounting mandates, statutory anti-fraud standards, and legal compliance obligations under English law.
• Consent (Art. 6(1)(a)): Deploying optional analytical tracking cookies and delivering direct commercial marketing communications. Consent may be withdrawn at any time.

4. Third-Party Processors and Sub-Contractors

We partner with vetted third-party infrastructure providers who adhere to strict data security standards. Categories of sub-processors include:

• Cloud hosting and sovereign data center providers located within the United Kingdom and the European Union.
• Transactional email delivery and customer inquiry management platforms.
• Encrypted identity authentication and session management providers.

All sub-processors execute binding Data Processing Agreements (DPAs) incorporating standard contractual clauses to safeguard international data transfers.

5. Data Retention Schedules

We retain personal data only for the period necessary to fulfill the operational purposes outlined herein:

• Ephemeral Upload Files: Raw spreadsheet uploads are deleted from volatile processing memory immediately upon completion of the user session or within 24 hours of inactivity.
• User Account Profiles: Retained for the active duration of the business contract plus 36 months following account termination for audit validation.
• Financial & Transaction Ledgers: Preserved for seven (7) years in accordance with statutory United Kingdom corporate tax and audit regulations.
• System Access Logs: Automatically rotated and purged after twelve (12) calendar months.

6. Your Statutory Privacy Rights (GDPR & CCPA/CPRA)

Subject to statutory verifications, users residing within the United Kingdom, European Economic Area, California, and other jurisdictions hold the following legal rights:

• Right of Access: Obtain written confirmation of data processing and request a copy of personal information held.
• Right to Rectification: Request correction of inaccurate, misleading, or incomplete personal data.
• Right to Erasure ("Right to be Forgotten"): Request deletion of personal records where processing is no longer justified.
• Right to Data Portability: Receive your provided data in a structured, machine-readable format (CSV or JSON).
• Right to Object & Restrict Processing: Restrict processing under specific operational circumstances or object to processing predicated upon legitimate interests.
• Non-Discrimination: California residents will never experience discriminatory pricing or degraded service for exercising privacy choices.

7. Data Protection Officer (DPO) Contact

To exercise your statutory rights, submit data inquiries, or lodge a formal data protection complaint, contact our appointed Data Protection Officer via email or written postal correspondence:

Data Protection Officer
Poppetlystashpnt Technologies Ltd
84 Observatory Way, FinTech Quarter, London EC2A 4NE, United Kingdom
Email: [email protected]

You also maintain the legal right to file a formal complaint with the United Kingdom Information Commissioner's Office (ICO) or your local supervisory authority.