Privacy Policy

1. Who we are

The details of the business responsible for this data will be shown here.

2. What this policy covers

2.1 This policy explains how we handle personal data when you visit this website, contact us or ask for a demo, and when your business has a SubClik account (for example, the details of account owners, billing contacts and Users, and how they use the service).

2.2 Service companies use SubClik to keep records about their own staff, engineers and customers, such as job details, signatures, chat messages, meter readings and fault reports. For that data the service company is the controller and we act on its instructions as a processor under our Data Processing Agreement. If your details are in SubClik because of a company you deal with, please contact that company first; we will help them respond.

3. The data we collect and why

Enquiries and demo requests

When you request a demo, ask about pricing or send a message, we receive what you enter in the form: your name, company, email address, country, number of engineers, phone number if you give it, and your message, together with the page it was sent from and the time. We use it to reply, to arrange a demo and to discuss a proposal. Our lawful basis is our legitimate interest in responding to people who contact us and in developing our business.

Customer accounts

For businesses that use SubClik we hold the names, work email addresses and phone numbers of account owners, billing contacts and Users; the subscription, billing and payment history; support conversations; and records of acceptance of our terms. We use them to provide the service, manage the subscription, take payment, give support, send service messages (such as security notices and changes to our terms) and meet our legal and accounting obligations. Our lawful bases are the performance of our contract with the customer business, our legal obligations, and our legitimate interest in running and securing the service.

Security and service records

When anyone uses SubClik or the website, we record technical information needed to keep the service secure and working, such as sign-in events, the network address of requests (used briefly to limit repeated attempts), and error reports. Error reports leave out form contents, web address parameters, email addresses and tokens. Our lawful basis is our legitimate interest in protecting the service and its users.

Product updates

We may send account owners occasional emails about important new features of the service. You can opt out at any time using the link in the email or by contacting us. We do not use enquiry details for marketing newsletters.

4. Who receives the data

We use these service providers, who process data on our behalf under contract:

• Supabase: database, storage and authentication, with data stored in London, United Kingdom.
• Vercel: hosting of the website and application, with application servers in London, United Kingdom; and visit counts for the public website (pages viewed, referring site, country and device type, without cookies and without identifying you).
• Resend: delivery of emails, based in the United States.
• Our payment provider, accountant and professional advisers, where needed for billing, accounts and legal advice.

We may also share data if the law requires it, to protect our rights or the safety of others, or with a buyer of our business, who would have to respect this policy. We do not sell personal data or share it with advertisers.

5. International transfers

Where a provider is based outside the United Kingdom or may access data from elsewhere, we rely on a safeguard recognised by UK data protection law, such as a UK adequacy regulation (including the UK Extension to the EU-US Data Privacy Framework, where the provider is certified), the UK International Data Transfer Agreement, or the UK Addendum to the EU standard contractual clauses.

6. How long we keep it

• Enquiries: up to 24 months after you contacted us, unless you become a customer.
• Customer account and billing records: for the life of the account, and then for six years after the end of the financial year they relate to, to meet accounting and tax rules.
• Data kept in a customer’s SubClik account: as set out in the Data Processing Agreement, deleted within 30 days after the subscription ends.
• Error reports: 90 days. Records used to limit repeated attempts: one day.

7. Security

We protect personal data with measures that include encryption in transit and at rest, separation of each customer’s data in the database, role-based access, two-step sign-in for administrators, and private storage for files. Details are in Annex 1 of the Data Processing Agreement.

8. Your rights

Under UK data protection law you can ask us for a copy of your personal data, ask us to correct or delete it, ask us to restrict or stop using it, object to our use of it based on legitimate interests, and ask for it in a portable format. To use these rights, contact us. We will reply within one month. If you are not happy with how we handle your data, you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We would appreciate the chance to deal with your concern first.

9. Children

SubClik is a business service and is not intended for anyone under 18.

10. Cookies

This website does not use advertising or analytics cookies. Visits to the public website are counted without cookies (Vercel Web Analytics). The application uses only cookies needed for signing in. See our cookie information.

11. Changes

We may update this policy. The date at the top shows when it last changed; we will tell account owners about important changes.