Privacy Policy

1. Introduction

DataRecs ("we", "our", "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our services.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We apply these standards globally, regardless of where you are located.

2. Data Controller

DataRecs is the data controller responsible for your personal data collected through our website and marketing activities (e.g. when you register interest, subscribe to communications, or browse our site).

When you use our platform to reconcile your data, DataRecs acts as a data processor on your behalf. In this capacity, we process your data strictly in accordance with your instructions and our Data Processing Agreement (available on request). You, as the customer, remain the data controller for any data you submit to the platform for reconciliation.

For any questions about how we handle your data, please contact our privacy contact at [email protected].

3. Information We Collect

We may collect information about you in a variety of ways, including:

• Account and contact data you voluntarily provide when registering interest, creating an account, contacting us, or subscribing to our communications (e.g. name, email address, company name, job title).
• Usage data collected automatically, such as your IP address, browser type, operating system, referring URLs, pages visited, and interactions with our website.
• Payment information processed securely through our third-party payment provider (we do not store your payment card details directly).
• Cookies and similar tracking technologies, as described in Section 10 below.

4. Lawful Bases for Processing

We process your personal data on the following lawful bases under the UK GDPR:

• Contractual necessity: processing required to provide our services to you, manage your account, and fulfil our obligations under our terms of service.
• Legitimate interests: processing necessary for our legitimate business interests, such as improving our services, ensuring security, and communicating with you about your account. We only rely on this basis where our interests are not overridden by your data protection rights.
• Consent: where you have given clear consent for us to process your personal data for a specific purpose, such as receiving marketing communications. You may withdraw consent at any time.
• Legal obligation: processing necessary to comply with a legal obligation to which we are subject.

5. How We Use Your Information

We use the information we collect to:

• Provide, operate, and maintain our services.
• Respond to your enquiries and provide customer support.
• Send you marketing communications (with your consent), which you can opt out of at any time.
• Improve our website and services through analytics.
• Process payments and manage billing.
• Detect, prevent, and address security issues and fraud.
• Comply with legal obligations.

6. Data Sharing and Third-Party Service Providers

We do not sell your personal information. We do not share your personal data with other enterprises for their own purposes.

We use the following third-party service providers to operate our platform and services. These providers process data on our behalf and are bound by contractual obligations to keep your information secure and confidential:

• Hetzner Online GmbH — cloud infrastructure and hosting (Falkenstein, Germany).
• Civo Ltd — cloud infrastructure and hosting (London, United Kingdom).
• Google Cloud Platform — key management (KMS) only; Google Cloud does not host or store customer data.
• Cloudflare — content delivery network, DNS, edge routing, and security protection.
• Resend — transactional email delivery (e.g. account notifications).
• Kit.com — broadcast email communications and newsletters (marketing subscribers only).
• WorkOS — authentication and single sign-on services.

The authoritative, dated subprocessor list — including each provider's location, purpose, and the applicable international transfer mechanism — is published on our Subprocessors page. Changes to the list are recorded there with dated change notes.

We may also disclose your information where required by law, regulation, or legal process, or to protect the rights, property, or safety of DataRecs, our users, or others.

7. Data Storage and International Transfers

Customer platform data is hosted in Germany (Hetzner, Falkenstein) and the United Kingdom (Civo, London). Our content delivery network and edge security provider (Cloudflare) operates a global network, so requests to our website and services may transit Cloudflare edge locations outside the UK and EEA. Certain named providers based in the United States process limited categories of data: Google Cloud (key management only), WorkOS (authentication), and Resend (transactional email).

Where personal data is transferred outside the UK, we rely on appropriate safeguards under Article 46 of the UK GDPR — such as the UK International Data Transfer Agreement or Addendum, or the UK Extension to the EU-US Data Privacy Framework where the receiving provider is certified. The transfer mechanism applicable to each provider is listed on our Subprocessors page.

8. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law. When your data is no longer needed, we will securely delete or anonymise it.

For data processed through the reconciliation platform, we apply the following retention schedule:

• Full reconciliation result sets — retained for 14 days, then automatically deleted.
• Mismatch samples and run summaries — retained for 90 days, then automatically deleted.
• Aggregated usage and run statistics (counts and metrics only, no row-level customer data) — retained for 13 months.

9. Your Rights

Under the UK GDPR, you have the following rights regarding your personal data:

• The right to access your personal data and obtain a copy of it.
• The right to rectification of inaccurate or incomplete personal data.
• The right to erasure ("right to be forgotten") in certain circumstances.
• The right to restrict processing of your personal data.
• The right to data portability, allowing you to receive your data in a structured, commonly used format.
• The right to object to processing based on legitimate interests or for direct marketing purposes.
• The right to withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within one month, as required by law.

If you are not satisfied with how we handle your request, you have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection. You can contact the ICO at ico.org.uk/make-a-complaint or by calling 0303 123 1113.

10. Cookies and Tracking Technologies

Consent for non-essential cookies and analytics on this website is managed through Cloudflare Zaraz, which presents a consent dialog on your first visit and stores your choices in a first-party cookie named cf_consent. Analytics tools are only activated if you grant the corresponding consent purpose.

We use Google Firebase Remote Config to control the availability of website features (feature flags). This involves your browser contacting Google's Firebase service when a page loads; where analytics consent has not been granted, this is used solely for feature configuration.

We do not use Google Analytics on this website.

Cookies and similar technologies used on our site fall into the following categories:

• Strictly necessary: required for the website to function correctly (e.g. consent state, security protection). These cannot be disabled.
• Analytics: usage measurement tools loaded via Cloudflare Zaraz. These are opt-in and only activated based on your consent choices.

You can change your preferences at any time using the "Cookie settings" link in the website footer, which reopens the consent dialog.

11. Links to Third-Party Websites

Our website may contain links to third-party websites, services, or applications that are not operated by us. If you follow a link to any of these sites, please note that they have their own privacy policies and we accept no responsibility or liability for their practices. We encourage you to read the privacy policy of every site you visit.

12. Children's Privacy

Our services are not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If you become aware that a child has provided us with personal data, please contact us at [email protected] and we will take steps to delete such information.

13. Security and Breach Notification

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. These include encryption of data in transit and at rest, access controls, and regular security reviews.

In the event of a personal data breach affecting your data, we will notify affected customers without undue delay and within 72 hours of confirming the breach, and will provide the information required for you to meet your own obligations under Articles 33 and 34 of the UK GDPR.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. For significant changes, we may also notify you by email.

15. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact our privacy contact at [email protected].

For general enquiries, you can reach us at [email protected].