Privacy Policy & Cookie Policy

1. Introduction

Etellect Ltd, trading as ePostcode ("we," "us," or "our"), is committed to protecting your privacy and ensuring the security of your personal data. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our website (www.epostcode.com), customer portal (portal.epostcode.com), and API services (collectively, the "Services").

This Privacy Policy is designed to help you understand:

• What personal data we collect and why
• How we use and process your personal data
• Your rights regarding your personal data
• How we protect your information
• How to contact us with privacy concerns

2. Data Controller Information

The data controller responsible for your personal data is:

Contact Our Data Protection Officer

For any privacy or data protection queries, please contact us:

• Email: privacy@etellect.com
• Phone: +44 (0)20 4577 0019
• Support: hello@epostcode.com

3. What Data We Collect

We collect different types of personal data depending on how you interact with our Services:

3.1 Account Registration Data

When you create an account, we collect:

• Identity Information: First name, last name, job title
• Contact Information: Email address, phone number, company name
• Account Credentials: Username, encrypted password
• Business Information: Company name, business address, VAT number (if applicable)

3.2 Billing and Payment Data

When you purchase credits or services, we collect:

• Payment Information: Credit/debit card details (last 4 digits only), PayPal email, Direct Debit mandate details
• Billing Address: Full billing address for invoice generation
• Transaction Data: Purchase history, credit balance, usage records, invoices

3.3 API Usage Data

When you use our postcode lookup and address validation API services, we process:

• Lookup Requests: Postcodes, partial addresses submitted for lookup and validation (processed transiently)
• Technical Data: API key, request timestamps, IP addresses, request/response logs
• Usage Metrics: Number of requests, success/error rates, service usage patterns

Important: Address data in API requests is processed transiently for lookup and validation purposes and is not permanently stored beyond operational logs (retained for 90 days).

3.4 Website and Portal Usage Data

When you visit our website or portal, we automatically collect:

• Technical Data: IP address, browser type and version, operating system, device type
• Usage Data: Pages visited, time spent on pages, click behavior, referral sources
• Cookie Data: Cookie identifiers, preferences, session information (see Cookie Policy below)

3.5 Communications Data

When you contact us, we collect:

• Correspondence: Email content, support tickets, chat transcripts
• Feedback: Survey responses, product feedback, testimonials
• Marketing Preferences: Newsletter subscriptions, communication preferences

4. How We Collect Data

We collect personal data through the following methods:

4.1 Direct Interactions

You provide data directly when you:

• Register for an account on our website or portal
• Purchase credits or services
• Subscribe to our newsletter or marketing communications
• Contact us for support or inquiries
• Complete surveys or provide feedback
• Participate in promotions or competitions

4.2 Automated Technologies

We automatically collect data through:

• Cookies: See our Cookie Policy (Section 14-19)
• Server Logs: API requests, website visits, error logs
• Analytics Tools: Google Analytics (with anonymized IP addresses)
• Security Monitoring: Fraud detection, abuse prevention

4.3 Third-Party Sources

In limited circumstances, we may receive data from:

• Payment Providers: Transaction confirmations from Stripe, PayPal
• Royal Mail: PAF (Postcode Address File) data updates (containing no personal data)
• Business Partners: Referral information (with your consent)

5. How We Use Your Data

We use your personal data for the following purposes:

5.1 Service Delivery

• To create and manage your account
• To provide API access and process postcode lookup and address validation requests
• To deliver address data cleansing services
• To provide technical support and customer service
• To send service-related notifications (e.g., credit balance alerts, system updates)

5.2 Billing and Payment

• To process payments and issue invoices
• To manage credit balances and usage limits
• To handle refunds and billing disputes
• To comply with tax and accounting requirements

5.3 Service Improvement

• To analyze usage patterns and improve service performance
• To develop new features and services
• To troubleshoot technical issues
• To conduct research and analytics

5.4 Marketing and Communications

• To send promotional emails and newsletters (with your consent)
• To inform you about new products, features, and offers
• To conduct customer surveys and gather feedback
• To personalize your experience on our website

5.5 Legal and Security

• To comply with legal obligations and regulatory requirements
• To protect against fraud, abuse, and security threats
• To enforce our terms of service and usage policies
• To respond to legal requests and prevent harm

We will never: Sell your personal data to third parties or use it for purposes incompatible with those described in this policy without your explicit consent.

6. Legal Basis for Processing

Under UK GDPR, we must have a legal basis for processing your personal data. We rely on the following legal bases:

6.1 Contract Performance

Processing is necessary to perform our contract with you:

• Creating and managing your account
• Providing API access and address lookup services
• Processing payments and issuing invoices
• Delivering customer support

6.2 Legal Obligation

Processing is necessary to comply with legal obligations:

• Maintaining financial records for tax purposes (7 years)
• Complying with anti-money laundering regulations
• Responding to lawful requests from authorities
• Retaining records as required by UK law

6.3 Legitimate Interests

Processing is necessary for our legitimate business interests:

• Improving and developing our services
• Analyzing usage patterns and service performance
• Detecting and preventing fraud and security threats
• Managing our business operations efficiently

We balance these interests against your rights and will not use your data in ways you would not reasonably expect.

6.4 Consent

We ask for your explicit consent for:

• Marketing emails and newsletters
• Non-essential cookies (analytics, marketing)
• Processing special category data (if applicable)

You can withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

7. Data Sharing & Disclosure

We may share your personal data with the following categories of recipients:

7.1 Service Providers

We work with trusted third-party service providers who process data on our behalf:

• Payment Processors: Stripe, PayPal (PCI DSS compliant)
• Hosting Providers: AWS, Azure (ISO 27001 certified)
• Email Services: SendGrid, Mailchimp (for transactional and marketing emails)
• Analytics: Google Analytics (with anonymized IPs)
• Support Tools: Zendesk, Intercom (for customer support)

All service providers are bound by data processing agreements and must comply with UK GDPR.

7.2 Legal Requirements

We may disclose your data when required by law:

• In response to court orders, warrants, or legal process
• To comply with regulatory requirements
• To protect the rights, property, and safety of our company, users, or others
• In connection with fraud prevention and security investigations

7.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your personal data may be transferred to the new entity. You will be notified of any such change and your rights will remain protected under UK GDPR.

7.4 Data We Do NOT Share

• We never sell your personal data to third parties
• We do not share data for third-party marketing without explicit consent
• API lookup requests are not shared with any third parties

8. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this policy:

8.1 Account Data

• Active Accounts: Retained while your account is active
• Closed Accounts: Deleted within 90 days of closure (unless legal retention applies)

8.2 Financial Records

• Invoices and Transactions: 7 years (UK tax law requirement)
• Payment Records: 6 years (UK accounting standards)

8.3 Technical Data

• API Request Logs: 90 days (for troubleshooting and security)
• Server Logs: 180 days (for technical support and security monitoring)
• Analytics Data: 26 months (Google Analytics default)

8.4 Marketing Data

• Newsletter Subscribers: Until you unsubscribe
• Marketing Consent: Reviewed every 2 years

When data is no longer needed, it is securely deleted or anonymized.

9. Data Security

We implement comprehensive security measures to protect your personal data:

9.1 Technical Security

• Encryption: All data transmitted via HTTPS/TLS 1.3
• Database Encryption: Encryption at rest for sensitive data
• Password Protection: Industry-standard hashing algorithms
• API Security: API keys, rate limiting, authentication
• Network Security: Firewalls, intrusion detection systems

9.2 Organizational Security

• ISO 27001: Information security management certification
• Access Controls: Role-based access, principle of least privilege
• Staff Training: Regular data protection and security training
• Incident Response: Documented breach notification procedures
• Regular Audits: Security assessments and penetration testing

9.3 Data Breach Procedures

In the unlikely event of a data breach:

• We will notify the ICO within 72 hours (if required)
• We will inform affected individuals without undue delay
• We will take immediate steps to mitigate risks
• We will investigate the cause and implement preventive measures

10. Your Rights Under UK GDPR

Under UK GDPR, you have the following rights regarding your personal data:

10.1 Right of Access

You have the right to request a copy of your personal data. We will provide this within 30 days, free of charge for the first request.

10.2 Right to Rectification

You can request correction of inaccurate or incomplete personal data. You can update most information directly in your portal account.

10.3 Right to Erasure ("Right to be Forgotten")

You can request deletion of your personal data in certain circumstances, such as when it's no longer necessary for the purpose collected. Note: We may need to retain some data for legal compliance.

10.4 Right to Restrict Processing

You can request that we limit how we use your data in certain circumstances, such as while disputing accuracy or processing lawfulness.

10.5 Right to Data Portability

You can request your data in a structured, commonly used, machine-readable format and have it transferred to another service provider.

10.6 Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes. We will stop processing unless we have compelling legitimate grounds.

10.7 Right to Withdraw Consent

Where processing is based on consent, you can withdraw it at any time. This won't affect the lawfulness of processing before withdrawal.

10.8 Right to Lodge a Complaint

You have the right to lodge a complaint with the Information Commissioner's Office (ICO):

How to Exercise Your Rights

To exercise any of these rights, contact us at:

• Email: privacy@etellect.com
• Subject: "Data Subject Rights Request"

We will respond within 30 days. We may ask for identification to verify your identity before fulfilling requests.

11. International Data Transfers

Your personal data is primarily stored and processed in the United Kingdom. However, some service providers may process data outside the UK/EEA:

Safeguards in Place

When data is transferred internationally, we ensure appropriate safeguards:

• Adequacy Decisions: Countries deemed adequate by the UK government
• Standard Contractual Clauses: UK-approved SCCs with service providers
• Privacy Shield Framework: Where applicable and certified
• Binding Corporate Rules: For multinational service providers

Countries We Transfer To

• United States: Google Analytics, Stripe (with appropriate safeguards)
• European Economic Area: Various service providers within EEA

You can request more information about international transfers and safeguards by contacting privacy@etellect.com.

12. Children's Privacy

Our Services are not directed at children under 16 years of age. We do not knowingly collect personal data from children under 16.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us at privacy@etellect.com. We will delete such data promptly.

If we become aware that we have collected personal data from a child under 16 without parental consent, we will take steps to delete that information.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or legal requirements.

How We Notify You

• Minor Changes: Updated "Last Updated" date at the top of this policy
• Material Changes: Email notification to registered users and prominent notice on our website

We encourage you to review this policy periodically. Continued use of our Services after changes indicates acceptance of the updated policy.

Version History: Previous versions of this policy are available upon request by contacting privacy@etellect.com.

14. What Are Cookies?

Cookies are small text files that are placed on your device (computer, smartphone, tablet) when you visit a website. They are widely used to make websites work more efficiently and provide a better user experience.

How Cookies Work

Cookies contain information that allows a website to recognize your device and remember information about your visit. They help websites:

• Remember your login state and preferences
• Understand how you use the website
• Provide personalized content and features
• Improve website performance and security

15. Types of Cookies We Use

15.1 Strictly Necessary Cookies

These cookies are essential for the website to function properly. They enable core functionality such as security, network management, and accessibility.

Note: Strictly necessary cookies do not require consent under UK law.

15.2 Analytics Cookies

These cookies help us understand how visitors interact with our website by collecting and reporting information anonymously.

We use Google Analytics with anonymized IP addresses to respect your privacy.

15.3 Marketing Cookies (Optional)

These cookies track your browsing activity to display relevant advertisements. They are only set with your explicit consent.

16. Purpose of Our Cookies

We use cookies for the following purposes:

Essential Operations

• Authenticate users and manage sessions
• Remember your preferences and settings
• Maintain security and prevent fraud
• Enable core website functionality

Analytics and Performance

• Understand how visitors use our website
• Analyze traffic patterns and popular features
• Identify and fix technical issues
• Improve website performance and user experience

Marketing and Personalization

• Display relevant content and recommendations
• Measure effectiveness of marketing campaigns
• Retarget visitors with relevant advertisements
• Personalize your experience based on preferences

17. Third-Party Cookies

Some cookies are placed by third-party services that appear on our pages. We do not control these cookies. You should check the respective third-party websites for more information:

18. Managing Your Cookie Preferences

You have control over cookies and can manage your preferences in several ways:

Using Our Cookie Manager

You can manage your cookie preferences using our cookie consent banner or by clicking the "Manage Cookies" link in the footer. This allows you to:

• Accept all cookies
• Decline non-essential cookies
• Customize preferences by category
• Change your preferences at any time

Using Your Browser Settings

Most browsers allow you to control cookies through their settings. You can:

• Block all cookies
• Block third-party cookies only
• Delete cookies when you close your browser
• Set exceptions for specific websites

Browser-specific instructions:

• Chrome: Settings > Privacy and security > Cookies
• Firefox: Options > Privacy & Security > Cookies
• Safari: Preferences > Privacy > Cookies
• Edge: Settings > Privacy, search, and services > Cookies

19. Cookie Consent

In compliance with UK GDPR and PECR (Privacy and Electronic Communications Regulations), we ask for your consent before setting non-essential cookies.

How We Obtain Consent

• Cookie Banner: On your first visit, you'll see a cookie consent banner
• Clear Information: We explain what cookies we use and why
• Granular Control: You can accept all, decline all, or customize preferences
• Ongoing Control: You can change your preferences at any time

Consent Categories

• Strictly Necessary: No consent required (essential for website operation)
• Analytics: Requires consent (helps us improve the website)
• Marketing: Requires consent (personalized advertising)

Withdrawing Consent

You can withdraw your consent at any time by:

• Clicking "Manage Cookies" in the footer
• Changing your preferences in the cookie manager
• Deleting cookies through your browser settings
• Contacting us at privacy@etellect.com

Withdrawing consent does not affect the lawfulness of processing before withdrawal.