Privacy Notice
Draft — pending review.
This notice explains what personal data Interact DC holds, why we hold it, and who it is shared with.
Our role depends on how you got here
There are two ways to use Interact DC, and our responsibility differs between them.
If your employer set up your account, they decided that you should have one and supplied your work email address. They determine why your data is processed; we process it on their instructions. In data protection terms they are the controller and we are the processor, and their own privacy notice governs what happens to your data. Contact them first with any question about it.
If you signed up yourself, nobody instructed us, and we are the controller for your account. This notice governs that data.
We are the controller for our own billing and business records in both cases, because we are legally required to keep them.
What we hold
| Data | Why |
|---|---|
| Email address, and a display name if given | To identify your account and contact you about it |
| Which organisation you belong to, and your role in it | To decide what you can see and do |
| Password, stored only as a one-way hash | To let you sign in. We never hold the password itself |
| Simulations, hardware inventories and reports you create | To provide the service. This belongs to the organisation, not to you personally, and stays with it if you leave |
| Credit balances, allocations and transaction history | To meter usage and account for what was bought |
| Payment and receipt records, including billing address and VAT number | To take payment and meet tax obligations |
| An activity log: what was done, by whom, when, with the IP address and browser used | Security, and so an organisation's administrators can see who changed what |
| A record of emails sent to you — the subject and whether it arrived, never the content | To diagnose delivery problems |
Why we are allowed to hold it
TO CONFIRM: the lawful bases below are the ones that ordinarily apply to a business service of this kind. They need checking by whoever advises Interact DC on data protection before this page is relied upon.
- To provide the service — performance of a contract, either with you directly or with the organisation that gave you an account.
- Security and the activity log — our legitimate interest in knowing who did what, and in keeping accounts safe.
- Payment and VAT records — a legal obligation to keep them.
- Service emails, such as an invitation or a low-credit warning — necessary to provide the service. We do not send marketing.
Where it goes
Your data is held in the United Kingdom. Some of the companies listed above operate outside it, so data may be transferred to the European Economic Area or the United States under the safeguards those transfers require, such as the UK addendum to the standard contractual clauses.
TO CONFIRM: the transfer mechanism relied upon for each sub-processor.
How long we keep it
- Email delivery records are deleted automatically after 30 days.
- Payment and receipt records are kept for as long as tax law requires, and are not deleted when an account is.
- Your account is deleted when you or an administrator delete it. Work you created stays with the organisation it was created in, because it was the organisation's rather than yours; your name is removed from it.
- Everything else is kept while your account exists.
Who else sees it
We use other companies to run the service. They act on our instructions and may not use your data for their own purposes.
- Amazon Web Services — hosting and storage, in the United Kingdom (London region).
- Resend — delivers our email.
- PayPal — takes card payments. Card details go to PayPal directly and never reach us; we keep only the outcome and the billing address.
- Sentry — records application errors, which can include the page you were on and your account identifier.
- Grafana — collects operational logs and metrics.
If you give an EU VAT number we check it against VIES, a service run by the European Commission.
Your rights
You can ask for a copy of your data, ask us to correct it, ask us to delete it, or object to how we use it. If your employer set up your account, ask them — we will act on their instruction. Otherwise write to us at the address below.
If you are not satisfied with our response you can complain to the Information Commissioner's Office at ico.org.uk.
Cookies
Set out separately in our cookie notice.
Contact
Interact DC Ltd
[email protected]