Privacy policy

1. Who we are

Data Cactus Ltd ("DataCactus", "we", "us") is a company registered in England and Wales, company number 14942968. We are the data controller for the personal information described in this policy, except where section 4 says we act for you as a processor.

• Registered office: 19 Balcombe Street, London NW1 6HE
• ICO registration number: C2073163
• Email: [email protected]

Apartemo is a product of Data Cactus Ltd with its own privacy policy at apartemo.com.

2. What this policy covers

• Visits to datacactus.co.
• Enquiries you send us, and our business relationship with clients, prospects, partners and suppliers.
• Our apps published on Microsoft Marketplace, such as Social Publisher, and the support and implementation work we do for them.

When we deliver a project inside a client's systems, the client decides what personal data is processed and we act as its processor under our contract with it. That client's own privacy notice applies to its data.

3. Information we collect

Information you give us

• Contact details when you fill in a form, email us or book a call: name, work email, company, job title, phone number and your message.
• Details we need to deliver and invoice work: billing contacts, contracts, purchase orders and correspondence.
• Details you share when you ask for support with one of our apps.

Information from others

• Microsoft, when you select "Contact me" or start a trial for one of our offers on Microsoft Marketplace. Microsoft shares the details you agreed to share, usually your name, email, company, country and the offer you chose.
• Business contact details from public sources and licensed business data providers, such as a work email and job title, which we use for business-to-business outreach.
• Introductions from partners, such as Microsoft or the managed service providers we work with.

Information collected automatically

• Website usage through Google Analytics: pages viewed, approximate location, device and browser type and how you arrived. Analytics cookies are set only if you accept them (see section 9).
• Technical logs kept by our hosting provider for security, such as IP address and request time.

4. Our apps in your Microsoft tenant

Our Microsoft Marketplace apps, including Social Publisher, install as solutions in your own Microsoft Dataverse environment. They run under your Microsoft tenant, your security roles and your Microsoft agreements.

• Posts, media, channels, schedules, publishing logs and any other records the apps create are stored in your Dataverse environment and, where you configure it, your own Azure Storage account. DataCactus does not receive a copy.
• Connections to social networks such as LinkedIn, Facebook and Instagram use your own accounts and credentials, held in your Power Platform connections and environment variables. The apps send content only to the networks you connect, through their official APIs, and those networks' own privacy policies apply.
• The apps do not send usage data or telemetry to DataCactus.

If you ask us to install, configure or support an app and give us access to your environment, we act as your processor. We only access the data needed for the task, only on your instructions, and under a data processing agreement or the data protection terms in our contract with you.

5. How we use it and why

We do not sell personal information, and we do not use it for automated decisions that have legal or similarly significant effects on you.

6. Who we share it with

We use service providers that process personal information on our behalf, under contracts that require them to protect it:

• Microsoft: Microsoft 365, Dynamics 365 and Azure, for email, documents, our client and sales records, and hosting.
• Google: Google Analytics, for website measurement.
• Tally: the contact forms on this website.
• Cloudflare: website hosting and security.
• YouTube: product videos, embedded with YouTube's privacy-enhanced mode and only loaded when you choose to play one.
• Our accountants, auditors, lawyers and insurers, where needed.
• Partners we deliver work with, such as a managed service provider, where you are a shared client and the information is needed for the work.

We may also disclose information when the law requires it, or to a buyer or successor if all or part of our business is sold.

7. Where your data is stored

We store our business records in Microsoft data centres in the UK and the European Economic Area. Some providers, such as Google, Cloudflare and Tally, may process data in other countries, including the United States. Where personal data leaves the UK, we rely on UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or another safeguard the law allows.

8. How long we keep it

• Enquiries, leads and outreach contacts that do not become clients: up to 2 years after our last contact, or sooner if you ask us to delete them.
• Client and supplier records, contracts and invoices: 6 years after the end of the financial year they relate to, as UK tax and company law require.
• Google Analytics data: no longer than 14 months.
• If you opt out of marketing, we keep a minimal record of that choice so we do not contact you again.

9. Cookies

When you first visit, we ask whether you accept analytics cookies. Your choice is stored in your browser's local storage under the name dc-consent. You can change it at any time with the "Cookie settings" link in the footer.

• If you accept, Google Analytics sets the _ga and _ga_<id> cookies, which last up to 2 years.
• If you decline or do not choose, no analytics cookies are set. Google Analytics receives only anonymous, cookie-free signals that it uses to estimate visits, and advertising features are always switched off.
• Contact forms are provided by Tally and videos by YouTube. Those services may set their own cookies when you use the form or play a video, under their own privacy policies.

10. Your rights

Under UK data protection law, and the EU GDPR where it applies, you can ask us to:

• give you a copy of the personal information we hold about you
• correct information that is wrong or incomplete
• delete your information
• restrict how we use it, or object to our use of it, including for direct marketing at any time
• give you your information in a portable format
• withdraw consent you have given, such as for analytics cookies

Email [email protected] to make a request. We reply within one month. If you are unhappy with how we handle your information, you can complain to the Information Commissioner's Office at ico.org.uk, or to the data protection authority where you live.

11. Security

We protect personal information with encryption in transit and at rest, multi-factor authentication, access limited to the people who need it, and the security controls of Microsoft 365 and Azure. When we work in a client's environment, we follow that client's security policies and access rules.

12. Changes to this policy

We will update this page when the way we handle personal information changes, and change the date at the top. If a change affects our clients significantly, we will tell them directly.

13. Contact us

Data Cactus Ltd, 19 Balcombe Street, London NW1 6HE
Email: [email protected]