Privacy and Cookie Policy

1. The Personal Data We Collect

• Identity Data - first name, last name, title.
• Contact Data - email address, billing address, registered or residential address, telephone number.
• Financial Data - payment information relating to your subscription or purchases. Payment card details are collected and stored by our payment provider, Stripe. We do not store your payment card details.
• Transaction Data - details of payments to and from you, details of your subscription, and of the Services you have purchased.
• Technical Data - IP address, login data, browser type and version, time zone and location, operating system, and other technology on the devices you use.
• Profile Data - your account reference, preferences, feedback, survey responses and correspondence.
• Usage Data - information about how you use the Site, Platform and Services.
• Marketing and Communications Data - your marketing preferences and your preferences in receiving communications from us.
• Recruitment Data - CVs, employment and education history, professional qualifications, right to work information, interview notes, references and correspondence relating to job applications or recruitment enquiries.

We also use Aggregated Data (such as statistical or demographic data) for any purpose. This is derived from personal data but does not, in law, identify you. If we combine Aggregated Data with personal data so that it can identify you, we will treat the combined information as personal data and process it in accordance with this policy.

We do not seek to collect Special Category Data (such as data about your health, race, ethnicity, religious beliefs, sexual orientation, political opinions or trade union membership), nor data about criminal convictions. Please do not provide us with this information unless we specifically request it or it is necessary for the Services we provide.

2. How We Collect Your Personal Data

We collect personal data through:

• Direct interactions - data you give us when you create an account, subscribe to or use the Service, contact us for support, request marketing, or give us feedback.
• Automated technologies - as you use the Site or Platform, we automatically collect Technical and Usage Data through cookies and similar technologies (see Section 5).
• Third parties and public sources - Technical Data from analytics providers; Contact and Transaction Data from our payment and service providers; Identity, Contact and Accounting Data from the accounting platforms you connect (at your direction); and Identity and Contact Data from public sources such as Companies House; Identity, Contact and Recruitment Data from recruitment agencies, referees, and background screening providers.

We do not seek to collect Special Category Data (such as data about your health, race, ethnicity, religious beliefs, sexual orientation, political opinions or trade union membership), nor data about criminal convictions. Please do not provide us with this information unless we specifically request it or it is necessary for the Services we provide.

3. How We Use Your Personal Data

We will only use your personal data when we can rely on a legitimate (lawful) basis, such as:

• Contract: Where processing is necessary for the performance of a contract with you, or to take steps at your request before entering into a contract, such as creating and managing your account, providing the Service and supplying our products or services.
• Legitimate Interests: Where processing is necessary for our legitimate interests (or those of a third party) and those interests are not overridden by your interests or fundamental rights and freedoms, such as operating, maintaining, securing and improving the Site, Platform and Services.
• Legal Obligation: Where processing is necessary for compliance with a legal or regulatory obligation to which we are subject, such as maintaining records required by law.
• Consent: Where we have obtained your freely given, specific, informed and unambiguous consent to process your personal data for a particular purpose, such as sending you marketing communications where consent is required by law.

Where we process your personal data on more than one lawful basis, you may contact us if you would like further information about the lawful basis or bases we rely on in any particular circumstance.

Marketing

We may use your Identity, Contact, Profile and Usage Data to send you marketing about Services and offers we think will be relevant. You'll receive these only where you've asked for information, subscribed, or otherwise not opted out, and you can opt out at any time in one click. Every marketing email includes an unsubscribe link in its footer, and you can also update your marketing preferences from within your account or by emailing us at dpo@floatapp.com. Opting out of marketing won't stop service-related messages (for example, about billing or changes to the Service).

Change of purpose

We'll only use your personal data for the purposes we collected it for, unless we reasonably consider we need to use it for a compatible purpose. If we need to use it for an unrelated purpose, we'll notify you and explain the legal basis.

4. Cookies and Similar Technologies

We use cookies and similar technologies (including third-party tracking technologies) to distinguish you from other users of our Site and Platform. This helps us to provide you with a good experience when you browse our Site and Platform and to display advertisements according to your interests, and also allows us to improve our website services.

A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer where required by law and subject to your consent for non-essential cookies. Cookies contain information that is transferred to your computer's hard drive. Some emails and pages contain a tiny graphic file that lets us see when you open a message or visit a page. Web beacons work together with cookies; if you disable cookies, they may stop working.

We display a cookie banner when you first visit our Site and Platform which allows you to accept, reject or customise your preferences for non-essential cookies. Strictly necessary cookies are always active as they are required for the operation of the website.

We use the following cookies:

• Strictly necessary cookies. These are cookies that are required for the operation of our Site and Platform. They include, for example, cookies that enable you to log into secure areas of our Site and Platform or make use of our booking and payment services. We also use Cloudflare security cookies which protect our website against malicious traffic and do not collect personal data for marketing purposes. Our cookie consent preferences cookies are also strictly necessary as they store your cookie choices.

• Analytical or performance cookies. These allow us to recognise and count the number of visitors and to see how visitors move around our Site and Platform when they are using them. This helps us to improve the way our Site and Platform work, for example, by ensuring that users are finding what they are looking for easily. In particular, we use:
  • Google Analytics: Google Analytics sets cookies that collect information about how you use our Site and Platform. This information is transmitted to and stored by Google.Google Analytics 4 does not store IP addresses You can find out more about Google's privacy practices at https://policies.google.com/privacy  and opt out at https://tools.google.com/dlpage/gaoptout. 
  • LinkedIn Analytics: LinkedIn's Insight Tag sets cookies that collect information about website visits made by LinkedIn members. This information is transmitted to and stored by LinkedIn Ireland Unlimited Company. You can find out more about LinkedIn's privacy practices at https://www.linkedin.com/legal/privacy-policy.

• Targeting or advertising cookies. These cookies are used to deliver relevant advertisements to you on other platforms, to measure the effectiveness of our advertising campaigns, and to build a profile of your interests. They may be set by us or by our advertising partners. In particular, we use:
  • Meta Pixel: Meta sets cookies that allow us to measure the effectiveness of our advertising on Meta platforms (including Facebook and Instagram) and to show you relevant advertisements. Information collected may be transmitted to and stored by Meta Platforms, Inc. in the United States. You can find out more at https://www.facebook.com/privacy/policy/. 
  • LinkedIn Ads: LinkedIn's Insight Tag sets additional cookies  that enable us to run targeted advertising campaigns on LinkedIn and to measure their performance. Information may be transmitted to and stored by LinkedIn Ireland Unlimited Company. You can manage your LinkedIn advertising preferences at https://www.linkedin.com/psettings/guest-controls. 
  • Twitter/X Ads: Twitter/X sets cookies that allow us to serve relevant advertising to you on Twitter/X and to measure campaign performance. Information may be transmitted to and stored by X Corp. in the United States. You can find out more at https://twitter.com/en/privacy. 
  • Microsoft/Bing Ads (Universal Event Tracking): Microsoft sets cookies that allow us to track conversions from Bing advertising and build audiences for retargeting. Information may be transmitted to and stored by Microsoft Corporation in the United States. You can find out more at https://privacy.microsoft.com/en-gb/privacystatement. 
  • Google Ads / DoubleClick: Google sets cookies via its advertising services that allow us to measure the effectiveness of our Google Ads campaigns, attribute conversions, and serve relevant advertisements via the Google Display Network. Information may be transmitted to and stored by Google LLC in the United States. You can opt out of Google advertising cookies via https://adssettings.google.com.

• Functionality cookies. These are used to recognise you when you return to our Site and Platform and to enable certain features of our Site and Platform. This allows us to personalise our content for you and remember your preferences. In particular, we use: 
  • Intercom: We use Intercom to provide live chat and support functionality on our Site and Platform. Intercom sets cookies to enable the chat widget and maintain your session. Information may be transmitted to and stored by Intercom R&D Unlimited Company. You can find out more at https://www.intercom.com/legal/privacy.

You can block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of our Site and Platform.

When you first visit, a cookie banner lets you accept, reject or customise non-essential cookies. You can change your choices at any time by clicking “Cookie Settings” in the website footer. Most browsers also let you block or delete cookies through their settings; see www.allaboutcookies.org  for instructions.

5. Who We Share Your Personal Data With

We may share your personal data with:

• Other authorised users of your account, such as administrators and additional users you've invited;
• Service providers (our sub-processors) who provide services to us or on our behalf, including our hosting and infrastructure providers (Heroku, Amazon Web Services and Google Cloud Platform), support tools, payment processing (Stripe), customer relationship management and sales-intelligence tools and advertising and analytics providers (such as Google). We require these providers to process personal data only on our documented instructions where they act as our processors, to keep it secure and confidential, and not to use it for their own purposes;
• Professional advisers, such as lawyers, auditors, bankers and insurers;
• Regulators and authorities, where we're required to report; and
• Buyers, investors other third parties in connection with an actual or proposed merger, acquisition, financing, or sale of all or part of our business, provided that they use your personal data only for the purposes for which it was originally collected or otherwise in accordance with this policy.

A current list of the sub-processors we use in connection with the Service is available in our Data Processing Agreement.

We require all third parties to respect the security of your personal data and to process it in accordance with the Data Protection Legislation. We do not permit our third-party service providers to use your personal data for their own purposes unless they act as an independent controller and have their own lawful basis for doing so.

6. International Transfers

We use a number of hosting and infrastructure providers, including Heroku, Amazon Web Services and Google Cloud Platform, and your personal data may be stored or processed in the UK, European Economic Area (EEA) and other countries, including the United States. Some of our other service providers are also based outside the UK and the EEA. This means that some of your personal data may be transferred outside the UK and EEA.

Wherever we transfer personal data outside the UK or EEA, we ensure that the transfer is protected by an appropriate safeguard recognised under Data Protection Legislation, which may include:

• a transfer to a country covered by an adequacy regulation;
• the UK International Data Transfer Agreement (IDTA), the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses, where applicable); or
• where relevant, the UK Extension to the EU-US Data Privacy Framework (the UK-US Data Bridge), where the recipient is certified.

We may also rely on any other lawful transfer mechanism recognised under the Data Protection Legislation from time to time.

Further information about the safeguards we rely on is available on request.

7. Data Security

We have appropriate technical and organisational measures in place to prevent your personal data accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, your personal data. These measures include, where appropriate, encryption, access controls, authentication measures, secure hosting, staff confidentiality obligations and procedures for testing, monitoring and reviewing the effectiveness of our security measures.

We have procedures to deal with any suspected personal data breach, and will notify you and the ICO where we're legally required to do so. Further information about our security measures is available on our security page.

8. Data Retention

We keep your personal data only for as long as necessary for the purposes for which we collected it, including to satisfy any legal, accounting, regulatory or reporting requirements.  The appropriate retention period will depend on the nature of the personal data and the purpose for which it was collected.

In some circumstances we may anonymise your personal data so that it can no longer be associated with you. Once anonymised, it is no longer personal data and we may retain and use it without further notice to you.

When you close your account, we will ordinarily delete the data in your account within 30 days, except where we're required to retain some of it to comply with a legal or regulatory obligation, or to establish, exercise or defend legal claims. 

If you would like further information about our retention periods for particular categories of personal data, please contact us using the details below.

9. Your Legal Rights

You have a number of rights under Data Protection Legislation in relation to your personal data. You have the right to:

• Request access to your personal data (commonly known as a "subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Request erasure of your personal data in certain circumstances. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) as the legal basis for that particular use of your data (including carrying out profiling based on our legitimate interests). In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your right to object.
• You also have the absolute right to object at any time to the processing of your personal data for direct marketing purposes.
• Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
• Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in one of the following scenarios:
  • If you want us to establish the data's accuracy;
  • Where our use of the data is unlawful but you do not want us to erase it;
  • Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
  • You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

If you wish to exercise any of the rights set out above, please contact us at dpo@floatapp.com. 

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Much of this is also available directly in the Service, and you can access, correct and export your data, and close your account, from within your account.

10. Third Party Links

The Site and Platform may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our Site and Platform, we encourage you to read the privacy policy of every website you visit.

11. Contact

Questions about this policy, or about how we handle your personal data, can be sent to our Data Protection Officer at dpo@floatapp.com.