Privacy notice

This notice explains what we do with personal data when you use https://rightsaas.co.uk, send us an enquiry, or become a client. Right SaaS Ltd is the data controller for that data.

Who we are

Right SaaS Ltd, 71-75 Shelton Street, Covent Garden, London WC2H 9JQ, United Kingdom.

For anything in this notice, contact [email protected].

What we collect and why

When you send an enquiry

We collect your name, email address, business name if you give one, and whatever you write in the message. We use it to reply to you and to keep a record of the conversation. The lawful basis is legitimate interests, specifically responding to someone who has asked us to.

When you become a client

We collect billing details, the services you have bought, and the correspondence relating to them. The lawful basis is performance of a contract. Some records are kept afterwards because we have to, which is a legal obligation basis.

When you pay us

Card payments are handled by Stripe. We never see or store your full card number. Stripe processes that data as a controller in its own right, and its privacy policy applies to it.

When you visit the site

Analytics cookies are off until you turn them on. If you accept them, Google Analytics collects usage data with IP anonymisation enabled. You can change your choice at any time through the cookie notice. See the cookie notice for the detail.

Who we share it with

We use a small number of processors to run the business: a hosting provider, an email delivery provider for transactional messages, Stripe for payments, and Google Analytics where you have consented. We do not sell personal data and we do not share it for anyone else's marketing.

How long we keep it

Enquiries that do not become projects are deleted after two years. Client records, including invoices, are kept for seven years after the end of the relationship, because tax law requires it. Analytics data follows the retention period set in Google Analytics.

Where it is stored

Client and order data is stored on servers in United States. Because this is outside the UK, the transfer is covered by the UK international data transfer addendum to the standard contractual clauses. Our other processors, including Stripe and Google, may also transfer data outside the UK, relying on the same addendum or on an adequacy decision. Email us if you would like the details for your own records.

Your rights

Under UK GDPR you can ask for a copy of your data, ask us to correct it, ask us to delete it, object to processing based on legitimate interests, and ask for it in a portable format. Email us and we will respond within one month.

If you are unhappy with how we handle a request, you can complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.

Changes

When this notice changes we update the date at the top. Material changes affecting existing clients are notified by email.