Joqiva Privacy Policy

This Privacy Policy explains how Joqiva collects, uses, stores, shares and protects personal data. It applies to Joqiva websites, web applications, customer-facing quote and invoice pages, documented interfaces, communications and related services, features and support that we provide (together, the "Service"). Joqiva is a business-to-business SaaS product for sole traders, trades, service businesses and small companies. Joqiva customers use the Service for business purposes. End Customers may be consumers, homeowners, tenants, payers, quote recipients, invoice recipients or other individuals who interact with a Joqiva customer through customer-facing pages.

Joqiva is a trading name used by the controller identified in the Legal Notice. The Legal Notice contains the controller's full legal identity, establishment and contact details. For privacy questions, rights requests, data protection complaints or international transfer information, use the privacy contact listed in the Legal Notice. Joqiva's UK and EU GDPR Article 27 representative details are stated in the Legal Notice.

For the purposes of Article 27 UK GDPR, Joqiva has appointed Euverify Ltd (UK) as its UK representative. UK representative: Euverify Ltd (UK) 3rd Floor 86-90 Paul Street London EC2A 4NE United Kingdom Email: gdpr@euverify.com For the purposes of Article 27 EU GDPR, Joqiva has appointed Euverify Ltd (Ireland) as its EU representative for EEA individuals where EU GDPR applies. EU representative: Euverify Ltd (Ireland) Unit 3D North Point House North Point Business Park New Mallow Road Cork T23 AT2P Ireland Email: gdpr@euverify.com People in the UK, people in the EEA where EU GDPR applies, the UK Information Commissioner's Office and EU supervisory authorities may contact our representatives about UK GDPR or EU GDPR matters using the Euverify secure request and verification portal: https://gdpr.euverify.com/verify/280fd1c9-68eb-438f-a2cd-92302bb9129e You may also contact Joqiva directly at privacy@joqiva.co.uk. Our UK and EU representatives are appointed for Article 27 contact purposes only. They are not Joqiva's data protection officer, UK branch, EU branch, registered office, establishment, controller or processor.

The Joqiva operator's current ICO data protection fee registration information is maintained in the Legal Notice. This registration is not an ICO endorsement, approval or certification of Joqiva.

This Privacy Policy explains how Joqiva processes personal data where Joqiva acts as an independent controller. This includes personal data we process for: (a) account registration; (b) login and account administration; (c) subscription billing; (d) support; (e) website and Service operation; (f) customer-facing page operation; (g) service communications; (h) product administration; (i) security monitoring; (j) abuse and fraud prevention; (k) legal compliance; (l) business administration; (m) product availability and marketing communications; (n) cookie consent and preferences; (o) internal product analytics and usage metrics; (p) limited service analytics; and (q) potential partner application review. This Privacy Policy also explains how Joqiva handles personal data contained in customer, enquiry, job, quote, invoice, file, email, payment report, reminder, audit log and workspace data where Joqiva normally acts as a processor on behalf of a Joqiva customer. Where Joqiva acts as processor, the Joqiva Data Processing Agreement also applies. This Privacy Policy does not replace any privacy notice that a Joqiva customer must provide to its own End Customers, staff, suppliers or contacts where that customer acts as controller.

3.1 Joqiva as controller Joqiva acts as an independent controller when we decide why and how personal data is processed for our own purposes. This includes account data, billing administration data, support data, website visitor data, security logs, legal records, cookie consent records, service communications, internal product analytics and Joqiva business administration data. 3.2 Joqiva customer as controller For customer, enquiry, job, quote, invoice, file, email, payment report, reminder and workspace data that a Joqiva customer submits to or generates through the Service, the Joqiva customer is normally the controller. This means the Joqiva customer is responsible for deciding why and how that personal data is processed. 3.3 Joqiva as processor Where Joqiva processes Customer Personal Data on behalf of a Joqiva customer, Joqiva normally acts as processor. That processing is governed by the Joqiva Data Processing Agreement and the Joqiva customer's documented instructions. 3.4 If you are an End Customer If you are a customer, prospective customer, quote recipient, invoice recipient, payer or contact of a business using Joqiva, that business is normally the controller of your personal data. For example, if you receive a quote page, invoice page, reminder or customer-facing link from a service business using Joqiva, that business decides why your data is used. You should contact that business first if you have questions about its use of your personal data or if you want to exercise your data protection rights in relation to quote, invoice, job or payment workflow data. Joqiva may still process limited personal data about you as an independent controller where necessary for security, abuse prevention, legal compliance, website operation, service protection or legal claims. 3.5 Same data, different roles In some cases, the same item of personal data may be processed for different purposes. For example, Joqiva may process customer workflow data as processor for the Joqiva customer, while also processing limited technical, security or legal records as controller where necessary to operate, secure, protect or defend the Service.

We may collect and process the following categories of personal data. 4.1 Account and user data This may include: (a) name; (b) email address; (c) phone number; (d) authentication credentials or security information; (e) account identifiers; (f) user role; (g) workspace permissions; (h) login activity; (i) account status; (j) profile information; (k) workspace invitations; (l) authentication events; and (m) user preferences. 4.2 Business and workspace administration data This may include: (a) business name; (b) trading name; (c) business address; (d) business contact details; (e) VAT or tax details where provided; (f) plan information; (g) workspace settings; (h) user roles and permissions; (i) subscription status; (j) billing contact details; (k) business operating preferences; and (l) customer-facing display settings. 4.3 Billing and subscription data This may include: (a) billing contact name; (b) billing email; (c) billing address; (d) business name; (e) VAT or tax details; (f) subscription plan; (g) trial status; (h) renewal status; (i) Joqiva subscription invoices or receipts; (j) payment attempts; (k) payment status; (l) billing events; (m) safe billing-provider identifiers; (n) payment method references provided by the billing provider; (o) tax or VAT metadata; and (p) related accounting records. Joqiva does not store full payment card numbers, CVC codes or raw card data. Joqiva subscription billing is separate from payments that End Customers make to Joqiva customers. Where a billing provider or merchant of record processes subscription payments, that provider may process billing, payment, tax, anti-fraud and support information under its own privacy terms and legal obligations. Details of current billing providers are made available at checkout, in billing documentation, in the Refund Policy or on the Subprocessors page where applicable. Billing providers are not used for customer invoice bank-transfer payment tracking. Joqiva does not process, collect, hold, transfer, settle or control End Customer invoice payments. End Customers pay the Joqiva customer directly by bank transfer. 4.4 Support and communication data This may include: (a) support requests; (b) support messages; (c) email communications; (d) call notes; (e) screenshots; (f) attachments; (g) technical details submitted in support requests; (h) issue history; (i) feedback; (j) survey responses; and (k) complaint records. You should not send passwords, full payment card numbers, unnecessary special category data, unnecessary identity documents or irrelevant sensitive information in support requests. 4.5 Website, app and device data This may include: (a) IP address; (b) browser and device information; (c) operating system information; (d) application version where applicable; (e) referring pages; (f) pages or screens visited; (g) timestamps; (h) session information; (i) approximate location inferred from IP address; (j) cookie identifiers where used; (k) consent preferences; (l) diagnostics where used; and (m) technical request logs. 4.6 Security and abuse prevention data This may include: (a) IP addresses; (b) login and authentication events; (c) failed login attempts; (d) account recovery events; (e) suspicious activity indicators; (f) usage-limit and abuse-prevention events; (g) audit logs; (h) access logs; (i) integration and operational logs; (j) error logs; (k) fraud or abuse indicators; and (l) incident investigation records. 4.7 Marketing and product availability data This may include: (a) name; (b) email address; (c) business name; (d) role; (e) industry; (f) location; (g) product interest; (h) communication preferences; (i) product or regional availability update status; (j) marketing consent status; (k) unsubscribe status; and (l) engagement with marketing communications where lawfully tracked. Where Joqiva offers product or regional availability updates, Joqiva may collect your email address through an availability update form so we can send the updates you request. 4.8 Potential partner application data Joqiva currently accepts applications from potential partners and reviews them manually. Submitting an application does not create active partner status. This may include: (a) partner name or business name; (b) partner contact details; (c) partner website, profile or channel information; (d) partner application data; (e) audience and promotion-plan information; (f) application review status and internal review notes; and (g) timestamps. Active referral tracking, affiliate attribution, conversion validation, a commission ledger and a payout programme have not launched. Joqiva does not use an external affiliate network and no external affiliate network receives partner application, workspace, customer, document, billing or payment data. Before launching a referral or commission programme, Joqiva will update the relevant privacy, cookie and partner terms, describe the processing actually introduced and request a fresh consent choice where required. 4.9 Customer-facing page interaction data If you interact with a Joqiva customer-facing quote page or invoice page, we may process: (a) name; (b) email address; (c) phone number; (d) IP address; (e) timestamps; (f) technical information about the device or browser used; (g) page interaction records; (h) quote view records; (i) quote acceptance or decline records; (j) quote question records; (k) invoice view records; (l) document download records; (m) "I've paid" confirmations; (n) payment-related comments; (o) uploaded payment evidence; (p) customer-facing page access information; and (q) related audit history. Most of this data is processed by Joqiva as processor for the Joqiva customer. Joqiva may also process limited technical and security data as controller where necessary to operate, secure and protect the Service, prevent abuse, comply with law or handle legal claims. 4.10 Customer workspace data Joqiva customers may submit or generate personal data in workspaces, including: (a) customer names; (b) customer contact details; (c) service addresses; (d) job descriptions; (e) job notes; (f) quote details; (g) invoice details; (h) invoice items; (i) quote items; (j) payment status; (k) payment reports; (l) payment workflow records; (m) quote acceptances; (n) document view records; (o) files; (p) PDFs; (q) email content; (r) email attachments; (s) payment proof files; (t) audit logs; (u) integration and operational event records; (v) operational task records; (w) bank transfer instructions; and (x) other information submitted by the Joqiva customer or its End Customers. Joqiva normally processes this data as processor on behalf of the Joqiva customer. 4.10A Receptionist call data Where a Joqiva customer enables Receptionist, Joqiva may process: (a) caller and business phone numbers; (b) call identifiers, timestamps, duration, status and routing information; (c) caller names and contact details provided during a call; (d) call audio where recording is enabled; (e) transcript segments, summaries and structured call outcomes; (f) enquiry, message, urgency, visit-request and transfer details; (g) customer and job matching results; (h) related enquiry, customer and job identifiers; (i) voice usage, provider cost and customer billing records; (j) call lifecycle, tool-action, webhook and operational records; and (k) limited provider metadata needed for security, reconciliation, support and deletion. The Joqiva customer is normally the controller of caller and call-content data, and Joqiva normally processes that data as processor on the customer's instructions. The Joqiva customer is responsible for an appropriate lawful basis, caller notices and any recording disclosure required for its use. Recording is a configurable workspace setting and is not required for every call. Caller ID alone is not treated as conclusive identity for sensitive information or actions. 4.11 Bank transfer instruction data Joqiva customers may enter bank transfer instructions into the Service so they can be displayed on quotes, invoices, customer-facing pages, reminders and PDFs. This may include: (a) account name; (b) sort code; (c) account number; (d) IBAN, where used; (e) payment reference; (f) payment terms; and (g) payment instructions. If these details identify a sole trader or individual, they may be personal data. Joqiva does not collect, hold, transfer, settle or control money owed by End Customers to Joqiva customers. End Customers pay directly into the Joqiva customer's bank account. 4.11A Customer-selected accounting integration data If a Workspace owner or authorised administrator connects Xero or Sage Accounting, Joqiva processes the minimum supported accounting data needed to configure and operate that connection. Depending on the records the Customer chooses to synchronise, this may include organisation settings, account and tax-rate identifiers, item identifiers, customer or contact names, business names, addresses, email addresses, phone numbers and VAT numbers; invoice and credit details, line items, amounts, tax treatment, dates, references and status; payment allocations, refunds, prepayments, overpayments and outstanding balances; provider record identifiers; and connection, mapping, change-detection, reconciliation and audit metadata. Joqiva uses this data to create or update supported contacts, invoices and credit or correction records, reconcile authoritative provider status and balances, prevent duplicates, surface conflicts and maintain an audit trail. Joqiva does not use either accounting connection to create payments, obtain bank credentials, initiate transfers or move money. Accounting-provider API data is not sent to Joqiva's AI provider and is not used by Joqiva to train or fine-tune AI models. The Customer selects and separately contracts with Xero or Sage and instructs Joqiva to transmit and receive the supported data through that provider's official API. The selected provider processes data under the Customer's separate provider agreement and applicable privacy information. Further provider-role and offboarding information is available on the Subprocessors page. 4.12 AI-assisted processing data If AI-assisted features are enabled, Joqiva may process content submitted to the Service to help create suggestions or extracted fields. This may include: (a) submitted inbound email or message text; (b) manually pasted enquiry, customer or contact text; (c) limited attachment metadata where an inbound email contains attachments; (d) customer display names and legal names; (e) business, company number and VAT number information where submitted; (f) contact details and contact role titles; (g) submitted address details; (h) job descriptions and enquiry details; (i) extracted fields; (j) reviewed or validated AI-assisted output; (k) usage and operational metadata; and (l) error or operational logs. The current AI-assisted extraction implementation does not send attachment file contents to the AI service provider. AI-assisted features provide output for review only. They do not create final jobs, final quotes, final invoices, final customer communications or final business decisions. Further information is available in the AI Processing Notice. 4.13 Product analytics and usage data Joqiva may process limited product analytics and usage data to understand how the Service is used, improve reliability and usability, manage trials and subscriptions, understand feature usage, monitor usage limits and improve customer experience. Joqiva currently uses PostHog Cloud EU for two separate personless analytics modes. Personless means that Joqiva does not create PostHog personal profiles; it does not mean that every event is fully anonymous. Where analytics storage is accepted, persistent analytics may include: (a) allowlisted event names; (b) normalised route or page groups and paths; (c) allowlisted call-to-action and signup-flow metadata; (d) approved campaign parameters on non-customer pages; (e) timestamps and limited SDK metadata; and (f) pseudonymous PostHog distinct, browser-device, session and window identifiers stored in analytics cookies or browser storage. Where analytics storage is rejected, Joqiva may send limited allowlisted cookieless events to PostHog Cloud EU. Cookieless events do not use cookies, localStorage or sessionStorage and do not create a persistent browser identifier. PostHog may derive a privacy-preserving server-side hash and process limited request metadata for cookieless measurement, so Joqiva describes these events as personless rather than fully anonymous. Where analytics uses cookies, browser storage or similar storage/access technologies, Joqiva will obtain consent where required unless an exemption applies under applicable law. Joqiva does not intentionally send customer quote or invoice content, payment proof content, bank details, payment instructions, AI raw input or output, email bodies, customer names, customer email addresses, customer phone numbers, SMS delivery metadata, credentials, secrets, provider message payloads or full URLs containing access information to analytics providers. Receptionist analytics is limited to allowlisted operational event metadata. Joqiva does not intentionally send caller names, phone numbers, email addresses, addresses, full transcripts, recordings, recording URLs or raw voice-provider payloads to the analytics provider. PostHog autocapture, session replay, heatmaps and personal profiles are disabled. Joqiva sends only allowlisted events and properties through the current integration. Truly aggregated or anonymised analytics may be used to understand, operate, secure and improve the Service. Pseudonymous or personless event data may still be personal data where an individual can be identified directly or indirectly.

We may collect personal data from: (a) you directly; (b) Joqiva customers; (c) workspace owners and administrators; (d) invited users; (e) End Customers interacting with customer-facing pages; (f) emails sent to or through Joqiva; (g) support requests; (h) subscription billing providers where used; (i) service providers used to operate the Service; (j) third-party platforms where applicable; (k) cookies and similar technologies; (l) analytics or monitoring tools where used; (m) public business sources where relevant to lawful B2B communications; (n) potential partner applications; and (o) legal, security, fraud-prevention or compliance sources where necessary. Where we obtain personal data from a source other than the individual it relates to, we provide privacy information where required by applicable law, taking account of the nature of the processing, the reasonable expectations of the individual and whether Joqiva acts as controller or processor. If you provide personal data about another person, you must have the right to do so and must provide any privacy notice required by applicable law.

We rely on different lawful bases depending on the purpose of processing. 6.1 To provide the Service Purpose: To create accounts, authenticate users, provide workspaces, operate the app, provide access to features, manage subscriptions, provide customer-facing pages and deliver the Service. Personal data: Account data, user data, workspace administration data, login data, app data, subscription data and technical data. Lawful basis: Contract, where processing is necessary to enter into or perform a contract with you as an individual, sole trader or business user. Legitimate interests, where processing is necessary to operate and administer a B2B SaaS service for a business customer, including where the user acts for a business or organisation. 6.2 To manage SaaS subscriptions and billing Purpose: To manage trials, subscriptions, renewals, invoices, payment attempts, billing events, cancellations, downgrades and Read-Only Mode. Personal data: Billing contact details, business details, plan information, invoices, payment status, billing events and safe billing-provider identifiers for Joqiva subscriptions. Lawful basis: Contract, where applicable. Legal obligation, where records must be kept for tax, accounting or compliance purposes. Legitimate interests in managing billing, payment recovery, subscription administration and financial administration. 6.3 To provide support Purpose: To respond to support requests, troubleshoot issues, investigate bugs, communicate with users and improve support quality. Personal data: Contact details, support messages, screenshots, attachments, workspace identifiers, technical logs and issue history. Lawful basis: Contract, where support is part of the Service. Legitimate interests in supporting users, troubleshooting issues and improving the Service. 6.4 To send service communications Purpose: To send account messages, security notices, product notices, billing notices, trial notices, subscription notices, legal updates, operational messages and support communications. Personal data: Name, email address, account information, workspace role, subscription status and communication history. Lawful basis: Contract, where communications are needed to provide or administer the Service. Legal obligation for required notices. Legitimate interests in operating and administering the Service. 6.5 To secure and protect the Service Purpose: To authenticate users, prevent unauthorised access, detect abuse, investigate incidents, maintain audit records, apply security and abuse-prevention controls, and protect Joqiva, customers, End Customers and third parties. Personal data: IP addresses, login events, audit logs, access logs, device or browser information, security events and technical logs. Lawful basis: Legitimate interests in security, fraud prevention, abuse prevention and service protection. Legal obligation where security or breach-related processing is required by law. 6.6 To operate websites, apps and documented interfaces Purpose: To deliver website pages, app functionality, documented interfaces, customer-facing pages, redirects, product availability pages and technical infrastructure. Personal data: IP address, browser data, device data, app data, page request data, session information, interface request data and technical logs. Lawful basis: Contract, where the processing is necessary to provide the Service. Legitimate interests in operating websites, apps and documented interfaces. 6.7 To use cookies and similar technologies Purpose: To run the site and Service, keep sessions secure, remember preferences, store cookie consent choices, protect against abuse, measure performance where permitted, use analytics cookies or similar storage where consent has been given, use limited low-risk or exempt storage/access technologies where permitted by law, and support marketing or advertising where selected, configured and permitted. Personal data: Cookie identifiers, device or browser information, consent preferences, route or page groups, analytics event metadata, page events and usage data. Lawful basis: Consent, where required for non-essential cookies, analytics cookies, similar storage/access technologies, marketing technologies or advertising technologies. Legitimate interests, where technologies are strictly necessary, lawfully exempt, or where limited analytics or operational measurement is permitted without consent under applicable law. More information is available in the Cookie Policy. 6.8 To send marketing or product availability communications Purpose: To send product and regional availability updates, business communications, offers and information about Joqiva. Personal data: Name, email address, business name, role, product interest, communication preferences and engagement data. Lawful basis: For Joqiva's own marketing, the UK GDPR basis is consent where required, or legitimate interests where that basis is appropriate following the necessary assessment. A PECR soft opt-in or an exception for corporate subscribers concerns permission to send a communication; neither is a separate UK GDPR lawful basis. Provider restrictions also apply. Where the delivery provider requires prior affirmative consent for a message, Joqiva will obtain it even if PECR would allow another route. You can stop Joqiva's own marketing at any time using the refusal facility or our privacy contact. 6.9 To improve the Service and understand product usage Purpose: To understand usage, improve features, fix bugs, improve workflows, analyse performance, understand trial conversion, monitor plan and usage boundaries, and make the Service more useful for small service businesses. Personal data: Product usage data, safe internal product analytics events, usage counters, feedback, support history, technical logs and aggregated statistics. Consent-based persistent analytics may include pseudonymous browser-device, distinct, session and window identifiers. Cookieless analytics may include a provider-generated privacy-preserving server-side hash and limited request metadata, but no cookie, localStorage, sessionStorage or persistent browser identifier. Lawful basis: Legitimate interests in improving, securing and administering the Service, including internal product analytics and limited operational measurement where appropriate. Consent, where improvement activity relies on non-essential cookies, analytics cookies, similar storage/access technologies, marketing technologies or tracking that requires consent. 6.10 To comply with law and protect legal rights Purpose: To comply with legal obligations, maintain records, respond to lawful requests, handle complaints, enforce terms, resolve disputes and protect legal rights. Personal data: Account data, billing records, support records, complaint records, security logs, legal correspondence, audit logs and relevant workspace records. Lawful basis: Legal obligation. Legitimate interests in legal compliance, dispute resolution and protection of rights. 6.11 To process Customer Personal Data as processor Purpose: To process customer, job, quote, invoice, file, email, payment report, reminder and workspace data on behalf of Joqiva customers. Lawful basis: The Joqiva customer is responsible for identifying the lawful basis where it acts as controller. Joqiva processes this data as processor under the DPA and the Joqiva customer's documented instructions. When a Business Customer enables Next Service Due, Joqiva processes the relevant customer and service identifiers, email address, service-due information, consent evidence, communication preferences, suppression records, reminder content, delivery information and enquiry responses on that Business Customer's instructions. The Business Customer determines its purposes and acts as controller for this workflow. Joqiva provides processing services under the DPA; our separate controller activities, including account administration and security, remain described elsewhere in this Policy. Marketing permission for one Business Customer is not permission for Joqiva's own marketing or for another independent business. Where the same controller operates several Workspaces, Joqiva uses the controller mapping to apply the appropriate preference consistently. Information is not shared between independent businesses merely because they use Joqiva. The customer-facing enquiry page identifies the relevant Business Customer and links to its privacy information. An enquiry does not create marketing consent and is not a confirmed booking. The initial Next Service Due workflow does not use its email links or enquiry pages for advertising, open tracking or click tracking. 6.12 To provide AI-assisted features Purpose: To help create suggestions, classifications, summaries or extracted fields from submitted email or message text and manually submitted enquiry, customer or contact text. Personal data: Submitted text, limited attachment metadata where an inbound email contains attachments, customer and contact details, business identifiers, submitted address details, enquiry or job details, extracted fields, reviewed or validated AI-assisted output, usage metadata and operational logs. The current implementation does not send attachment file contents to the AI service provider. Lawful basis: Where Joqiva acts as processor, the Joqiva customer is responsible for the lawful basis and Joqiva processes under the DPA and documented instructions. Where Joqiva processes limited technical, security or operational AI metadata as controller, Joqiva relies on legitimate interests in providing, securing, monitoring and improving the Service.

Purpose: To receive and manually review applications from potential partners and contact suitable applicants about a possible future programme. Personal data: Partner application data, partner contact details, website or profile information, audience information, proposed promotion plan, application review status, internal review notes and related correspondence. Lawful basis: Legitimate interests in evaluating potential B2B partnerships, responding to applicants and maintaining accurate application records. Consent, where an applicant has separately asked to receive optional marketing communications.

Where we rely on legitimate interests, our interests may include: (a) operating a B2B SaaS service; (b) providing account administration; (c) securing the Service; (d) preventing abuse and fraud; (e) supporting users; (f) improving product reliability; (g) managing billing and subscriptions; (h) communicating with business users; (i) keeping appropriate business records; (j) enforcing our Terms of Service; (k) protecting legal rights; (l) maintaining audit history; (m) investigating incidents; (n) developing and improving Joqiva; (o) understanding product usage and trial conversion; (p) managing plan, entitlement and usage boundaries; and (q) reviewing and responding to potential partner applications. When we rely on legitimate interests, we consider whether our interests are overridden by the rights and freedoms of the individuals whose personal data is processed. We do not rely on legitimate interests where consent is required under PECR or other applicable law for cookies, similar technologies or direct marketing.

Some personal data is needed to provide the Service. If you do not provide account, authentication, workspace, billing or technical data that is necessary for the Service, we may not be able to create an account, provide access, operate a workspace, process a subscription, provide support or comply with legal obligations. Marketing and product availability communications are optional. Non-essential cookies and similar technologies are optional where consent is required. Where Joqiva processes Customer Personal Data as processor, the Joqiva customer is responsible for deciding what personal data is necessary for its own business use case and for giving appropriate notices to End Customers, staff, suppliers and contacts.

Joqiva is not designed for systematic processing of special category data or criminal offence data. Special category data includes information about racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, health data, sex life or sexual orientation. Criminal offence data is subject to additional restrictions under UK data protection law. Joqiva customers should not submit criminal offence data unless they have identified a lawful basis, any required additional condition and an appropriate business need. Joqiva customers and users should not submit special category data, criminal offence data, children's data, passwords, full payment card details, unnecessary identity documents or confidential third-party information unless it is necessary, lawful and appropriate for their business use case. If special category data or criminal offence data is incidentally submitted into the Service, Joqiva will process it according to the relevant customer instructions, the DPA and applicable law, unless Joqiva must process it for security, legal claims, compliance or another lawful controller purpose.

Joqiva is a business-to-business service and is not intended for children. Users must be at least 18 years old. Joqiva customers should not intentionally submit children's personal data unless it is lawful, necessary and appropriate for their business use case. If Joqiva becomes aware that the Service is likely to be accessed by children in a way that requires additional safeguards, Joqiva will assess and update its privacy and product safeguards where required by applicable law.

Joqiva may include AI-assisted features that help create suggestions, classifications, summaries or extracted fields from submitted email or message text and manually submitted enquiry, customer or contact text. AI-assisted features create suggestions or extracted fields for review only. AI-assisted features do not create final jobs, final quotes, final invoices, final customer communications or final business decisions. Users must review, correct and approve AI-assisted output before using it in their business. AI-assisted processing is handled through Joqiva systems and approved service providers listed in the AI Processing Notice and Subprocessors page where applicable. Joqiva may process source content, reviewed or validated output, usage metadata, status information, validation information and operational logs where needed to provide, secure, monitor and audit the feature. The current AI-assisted extraction implementation does not send attachment file contents to the AI service provider. Limited attachment metadata may be included where an inbound email contains attachments. Joqiva will not enable an AI service provider for Customer Personal Data unless relevant data protection terms, transfer safeguards and public disclosures are in place. Joqiva does not use AI-assisted features to make solely automated decisions about individuals that have legal or similarly significant effects. Further information is available in the AI Processing Notice.

Joqiva may process inbound emails, outbound emails, forwarded emails, parsed emails, attachments, reminders, service SMS messages, delivery events, bounces and related email or SMS metadata. This may include: (a) sender and recipient email addresses; (b) sender and recipient names; (c) recipient phone numbers; (d) subject lines; (e) email body content; (f) service SMS message content, including the workspace sender label, a quote or invoice reference, visit date or date-change text, reminder or quote-expiry wording, one-way "Do not reply" wording and a secure customer-facing short link; (g) attachments; (h) quote or invoice links; (i) customer-facing page links; (j) email and SMS delivery events; (k) SMS delivery status and error metadata; (l) bounce events; (m) open and click events where configured and lawful; (n) IP addresses; (o) timestamps; (p) message identifiers; and (q) message purpose, template and whether the send was initiated manually or automatically; (r) estimated and actual SMS segment count, encoding, allowance reservation and usage status, and provider price or currency information where returned; (s) service SMS enabled or opted-out status, opt-out source and time, preferred service channel and related preference history; and (t) related technical metadata. Email addresses may be used to send customer-facing quote links by email. Phone numbers may be used to send service SMS messages where the relevant SMS scenario is selected or enabled and available. Manual service SMS scenarios include user-selected quote delivery or resend, invoice delivery or resend, invoice reminders and visit reminders. Automatic service SMS scenarios include scheduled quote follow-ups, scheduled invoice reminders, scheduled visit reminders and visit-date-change notifications triggered after a workspace user changes the visit date. SMS availability depends on the applicable plan and entitlements, provider and runtime configuration, workspace SMS and automation settings, an eligible saved SMS-capable number, recipient service SMS preferences, remaining segment allowance and rate limits. An email or manual-sharing feature does not mean that SMS is available for the same workflow. Before an SMS is sent, Joqiva may estimate and reserve the required SMS segments against the workspace allowance. Joqiva may then commit, release or reconcile that usage using the provider's acceptance and delivery information, including the actual segment count where available. Joqiva may record that service SMS is disabled for a recipient phone number and may record a preferred service channel. Disabling service SMS prevents Joqiva from selecting that number for manual or automatic service SMS. The preferred channel is a workflow preference and does not override an opt-out or guarantee that a channel is available or that a message will be delivered. Joqiva does not currently provide an in-product inbound SMS reply or STOP-command workflow. Service SMS templates are one-way and state "Do not reply". The Joqiva customer is responsible for ensuring that each recipient phone number belongs to the intended recipient and is accurate and current, that each service message is lawful under applicable data protection and electronic communications law and supported by any required notice, consent or other permission, and that recipient opt-outs and channel preferences are recorded and honoured promptly. The Joqiva customer must not re-enable a recipient for service SMS without an appropriate request or other lawful authority. Manual copy-link sharing is initiated by the workspace user outside automated provider delivery. SMS delivery metadata may be processed for delivery attempts, status tracking, allowance accounting, cost reconciliation, troubleshooting, audit and security. SMS delivery is an attempted communication and may not always succeed. Most email and SMS content processed for customer workflow is processed by Joqiva as processor for the Joqiva customer. Joqiva may also process limited email, SMS and technical data as controller for security, abuse prevention, service operation and legal compliance. Approved communications providers handle email and SMS delivery where those features are enabled. Current provider information is maintained at Subprocessors page. Open and click tracking is disabled by default. If Joqiva later enables open or click tracking, Joqiva will update relevant privacy information and obtain consent where required before using it.

Joqiva does not process, collect, hold, transfer, settle or control money owed by End Customers to Joqiva customers. End Customers pay directly into the Joqiva customer's bank account by bank transfer. Joqiva may display bank transfer instructions, record "I've paid" confirmations, record payment reports, record owner confirmation, show overdue invoice status and send reminders. Joqiva subscription billing is different. Joqiva may use a billing provider or merchant of record to process subscription fees payable for access to the Service. That provider may process subscription billing data, billing contact details, business details, tax or VAT information, subscription plan, renewal status, payment attempts, payment status, safe provider identifiers and tax metadata. Joqiva does not store full payment card numbers, CVC codes or raw card data. Joqiva must not use End Customer invoice payment records as evidence of a Joqiva customer's subscription payment.

We use cookies and similar technologies such as local storage, session storage, pixels, SDKs, device identifiers or similar storage/access technologies where applicable. We use these technologies for purposes such as: (a) running the Service; (b) keeping sessions secure; (c) remembering preferences; (d) storing cookie consent choices; (e) protecting against abuse; (f) using analytics cookies or similar storage where consent has been given; (g) using limited low-risk or exempt storage/access technologies where permitted by law; (h) measuring performance where permitted; and (i) marketing or advertising where selected, configured and permitted. Joqiva will not use non-essential cookies, analytics cookies, marketing technologies or advertising technologies before obtaining valid consent where consent is required. Marketing cookies and advertising technologies are not currently used unless the Cookie Policy states otherwise. More information is available in our Cookie Policy. You can change cookie preferences through the Cookie Settings tool where available.

We may share personal data with the following categories of recipients. 15.1 Joqiva customers and workspace users If you interact with a customer-facing quote page, invoice page, reminder or payment workflow, relevant data may be shared with the Joqiva customer that uses the Service. Workspace owners and authorised users may access personal data within their workspace according to their permissions. 15.2 Service providers, subprocessors and third-party recipients We may share personal data with providers that help us operate the Service, including providers for: (a) core service operation; (b) communications; (c) AI-assisted processing, if enabled; (d) service monitoring and reliability; (e) security; (f) support; (g) analytics, if used; (h) subscription billing; (i) business operations; and (j) authentication and identity services chosen by the user. If you choose Google sign-in, Joqiva and its authentication platform exchange the minimum account details needed to authenticate you, such as your Google account identifier, email address, name and authentication events. Google may act independently for its own account security, service operation and compliance purposes under its own privacy terms. Joqiva does not request access to Gmail, Google Drive, contacts, calendars or other Google account content for this login flow. If you choose Microsoft sign-in, Joqiva and its authentication platform exchange the minimum account details needed to authenticate you, such as your Microsoft account identifier, email address, name and authentication events. Microsoft may act independently for its own account security, service operation and compliance purposes under its own privacy terms. Joqiva does not request access to Outlook mail, OneDrive, contacts, calendars, Teams or other Microsoft account content for this login flow. If you choose Apple sign-in, Joqiva and its authentication platform exchange the minimum account details needed to authenticate you, such as your Apple account identifier, email address or Apple private relay address, name when Apple supplies it, and authentication events. Apple may act independently for its own account security, service operation and compliance purposes under its own privacy terms. Joqiva does not request access to iCloud, Mail, contacts, calendars, photos or other Apple account content for this login flow. Where Joqiva processes Customer Personal Data as processor, approved subprocessors are listed at Subprocessors page. Some third-party providers may act as independent controllers for their own legal, tax, anti-fraud, payment, security or compliance purposes. Their own privacy terms may apply to that processing. Provider names, processing locations, transfer safeguards and provider roles are maintained in the Subprocessors page, Cookie Policy, Refund Policy, checkout documentation or Partner Terms where applicable. 15.3 Subscription billing providers We may share billing and subscription data with billing providers or merchants of record to manage Joqiva subscription fees, invoices, payment attempts, payment status, tax calculation, refunds, billing support and related administration. This may include billing contact name, billing email, billing address, business name, VAT or tax details, subscription plan, renewal status, payment attempts, payment status, safe billing-provider identifiers and tax metadata. This does not involve processing End Customer invoice payments. Billing providers are not used for customer invoice bank-transfer payment tracking. 15.4 Joqiva Partner Programme Joqiva currently uses its own systems only to receive and manually review applications from potential partners. Active referral tracking, affiliate attribution, conversion validation, a commission ledger and a payout programme have not launched. Joqiva does not use an external affiliate network and no external affiliate network receives data. Potential partner application data processed by Joqiva may include: (a) applicant and business contact details; (b) website, profile or channel information; (c) audience and proposed promotion information; (d) application review status and internal notes; and (e) related correspondence. Customer invoice payments, customer invoice bank-transfer payment tracking, customer invoice contents, workspace business contents, customer-facing quote or invoice data and Joqiva subscription billing records are not used for referral attribution or commission processing because that processing is not active. 15.5 Professional advisers We may share personal data with lawyers, accountants, auditors, insurers and professional advisers where necessary for legal, accounting, audit, insurance, compliance or business purposes. 15.6 Authorities and legal recipients We may share personal data with regulators, courts, law enforcement, public authorities or other third parties where required by law or where necessary to protect rights, safety, security, legal claims or the Service. 15.7 Business transfers If Joqiva is involved in a merger, acquisition, financing, restructuring, sale of assets or transfer of business, personal data may be shared with parties involved in that transaction, subject to appropriate confidentiality and data protection safeguards. 15.8 Third-party platforms If you connect third-party services to Joqiva, those third-party services may process personal data under their own terms and privacy policies. 15.9 Customer-selected accounting platforms If an authorised Workspace user connects Xero or Sage Accounting, Joqiva shares and receives only the supported accounting data described in section 4.11A through the selected provider's official API. The provider is a customer-selected third-party accounting service with which the Customer has a separate account and agreement. Disconnecting stops future Joqiva API access and removes Joqiva's encrypted provider credentials, but it does not delete records already held by that provider. The Customer must manage provider-side access, correction and deletion through the provider where required.

Joqiva provides a UK-first SaaS service. Personal data may be processed, stored, accessed or supported from the United Kingdom, Joqiva operating locations, approved provider locations and other countries where Joqiva or its service providers operate. Where required by applicable data protection law, we use appropriate transfer mechanisms for international transfers. These may include: (a) adequacy arrangements where applicable; (b) UK transfer terms or addenda; (c) standard contractual clauses where applicable; (d) approved certification, rules or equivalent safeguards where applicable; (e) transfer risk assessments or equivalent assessments; (f) supplementary technical, contractual or organisational measures; or (g) another lawful transfer mechanism or exception available under applicable law. Where no UK adequacy regulation applies, Joqiva will not rely on adequacy alone and will use another lawful transfer mechanism or exception where required. For Customer Personal Data processed by Joqiva as processor, international transfer details are set out in the DPA and the Subprocessors page. You can contact us using the privacy contact listed in the Legal Notice if you want more information about international transfer safeguards. Joqiva's UK/EU representative information, where required, is maintained in the Legal Notice.

We keep personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law. Retention depends on the type of data, the purpose of processing, workspace status, legal requirements, security needs, dispute risk and customer instructions where Joqiva acts as processor. 17.1 Account and user data Account and user data is generally kept while the account or workspace is active or in Read-Only Mode. After a valid account deletion request, we will delete or anonymise relevant account data within 90 days where legally and technically possible, except for records that must or may be kept longer. 17.2 Customer, job, quote and invoice data Customer, job, quote and invoice data is generally kept while the workspace is active or in Read-Only Mode. Inactive or Read-Only Mode workspaces are not automatically deleted solely because a trial or subscription has ended. 17.3 Deletion requests After a valid deletion request for an account or workspace, we will delete or anonymise relevant data within 90 days where legally and technically possible. We may retain records that must or may be kept longer for legal, tax, accounting, audit, dispute, security, fraud prevention, compliance or legitimate business purposes. 17.4 Standard retention periods 17.4.1 Current raw-content retention Raw content and saved workflow data are retained differently. Under the current Service configuration, the following raw content in ordinary Service storage is retained for 30 days from the relevant record's creation and is then scheduled for erasure, redaction or deletion: (a) raw input stored for an AI extraction; (b) raw source text stored in an enquiry draft; (c) inbound email plain-text and HTML bodies, the full raw header block and the raw inbound payload; and (d) the stored original raw inbound email message file. The inbound email workflow record may remain after this cleanup, but keeping that record does not mean that Joqiva keeps the original email body, full raw headers, raw payload or original raw message file for the lifetime of the workspace. Hashes, sender and recipient details, subject, message and thread identifiers, parsed header values, envelope data, attachment metadata, status, timestamps and other structured workflow metadata may be retained where needed for the email, enquiry, job, security or audit workflow. Attachments stored as separate workflow files are not the original raw email message file and follow the file periods below. Content copied or saved into a separate workflow record, such as an enquiry or job note or a conversation message, is saved workflow data rather than the raw inbound email copy and follows the retention period for that workflow record. AI-extracted or parsed output and fields reviewed, corrected or confirmed by a user are saved workflow data, not raw input. They follow the retention period for the corresponding customer, enquiry, job, quote, invoice, workspace or audit record. The 30-day raw-content cleanup operates independently of account status and does not wait for an account deletion request. A valid deletion request may result in earlier deletion or anonymisation. Backup copies may remain until the scheduled backup deletion cycle described below and are not used for ordinary Service purposes before deletion. Consent evidence needed to support Next Service Due is stored separately from the raw inbound email copy. The raw-content deletion schedule does not automatically delete the only evidence on which an active marketing permission relies. The retained evidence is limited to the statement and context needed to demonstrate the permission, rather than the full unrelated correspondence. After a permission is replaced or withdrawn, continued retention of its evidence must have a separate, documented compliance or dispute purpose and a limited retention period. It is not used as permission to continue marketing. Minimal suppression information is retained while it is needed to avoid reintroducing the affected marketing, including after imports or restoration. At the end of Joqiva's processing, the return, deletion and backup provisions of the DPA apply; stopping use of Joqiva does not remove the Business Customer's obligation to respect a person's preferences. 17.4.2 Other standard retention periods The following other standard retention periods may apply: (a) customer, job, quote and invoice data: kept while the workspace is active or in Read-Only Mode; (b) invoices, invoice items, quotes, payments, payment reports, quote acceptances and audit-relevant business history: 6 years where retained as part of workspace history, accounting, audit or legal records; (c) VAT/accounting-relevant records: 6 years; (d) files, PDFs and payment proofs: kept with the corresponding workspace, job or document data, except for the original raw inbound email message file covered by the 30-day raw-content period above; (e) email messages and inbound emails: outbound email messages and inbound email workflow records, after the raw-content cleanup described above, are kept with the corresponding workspace or job data; (f) email events and delivery logs: email delivery event logs are kept for up to 24 months. Delivery state or delivery attempts saved as part of a quote, invoice, reminder, message or audit workflow may be kept with the corresponding workflow record and for 6 years where they form part of audit-relevant business history; (g) SMS delivery status metadata: up to 24 months. Delivery state or delivery attempts saved as part of a quote, message or audit workflow may be kept with the corresponding workflow record and for 6 years where they form part of audit-relevant business history; (h) integration and operational event logs: up to 24 months; (i) operational task records: up to 24 months; (j) audit logs: 6 years for audit-relevant history; (k) SaaS billing events and billing records: 6 years; (l) potential partner application and review records: kept for as long as reasonably necessary to review the application, contact the applicant, maintain an accurate decision history, handle disputes and meet legal or compliance obligations; (m) document view records: kept with the corresponding workspace, quote, invoice or audit history where needed for security, audit, support or legal reasons; (n) exports: up to 30 days; (o) backups: up to 90 days; (p) inactive or Read-Only Mode workspaces: not automatically deleted solely because the trial or subscription has ended; and (q) deleted or cancelled accounts: deleted or anonymised within 90 days except for legal, tax, accounting, audit, dispute, security, fraud prevention and compliance records. Receptionist call transcripts and recordings follow the workspace Receptionist retention setting, which is configurable from 1 to 730 days and defaults to 90 days. When the retention deadline is reached, Joqiva schedules deletion of provider artifacts, local transcript segments, recording references and direct caller identifiers. Minimum non-personal usage, billing, security and audit records may be kept for the applicable periods above. A provider deletion failure is retried and is not treated as successful deletion. Provider-side processing and international transfers are also described on the Subprocessors page. Verified raw Xero webhook payloads are encrypted in ordinary Service storage and retained for no more than 30 days. Sage change detection uses bounded API polling rather than Sage invoice webhooks. Non-secret accounting mappings, canonical hashes, provider identifiers, reconciliation state and financial or audit history may be retained with the corresponding invoice or accounting record, including for 6 years where they form part of accounting, tax, audit or legal history. Encrypted Xero or Sage OAuth credentials are deleted from Joqiva when a verified disconnect completes; disconnect does not delete provider-side records. 17.5 Support records Support records are generally kept for up to 24 months after the support matter is closed, unless a longer period is needed for legal, security, audit, dispute or service improvement purposes. 17.6 Marketing and product availability records Marketing and product availability records are kept until you unsubscribe, withdraw consent, ask us to delete them, or we decide they are no longer needed. We may keep a suppression record to make sure we do not send you marketing after you unsubscribe. 17.7 Cookie consent records Cookie consent and preference records may be kept for up to 24 months after your last consent choice or for another period required to demonstrate compliance. 17.8 Security records Security logs and abuse prevention records may be kept for up to 24 months, unless a longer period is needed for security, investigation, legal claims, fraud prevention or compliance. 17.9 Product analytics and usage records Product analytics and usage records are generally kept for up to 24 months unless a shorter period is configured or a longer period is reasonably needed for security, fraud prevention, billing, legal claims or compliance. Analytics records are limited to approved event metadata and, where analytics cookies or similar storage are accepted, pseudonymous visitor or session identifiers. Consent-based persistent PostHog Cloud EU analytics and cookieless PostHog Cloud EU events are separate modes. Persistent analytics may use pseudonymous browser-device, distinct, session and window identifiers. Cookieless events do not use browser storage or a persistent browser identifier, but PostHog may derive a privacy-preserving server-side hash and process limited request metadata. Aggregated or anonymised analytics may be kept for longer where it no longer identifies individuals. 17.10 Potential partner application records Potential partner application records, review status, internal review notes and related correspondence may be kept for as long as reasonably necessary to review the application, contact the applicant, maintain an accurate decision history, handle disputes and meet legal or compliance obligations. Where records are needed for audit, dispute or legal purposes, they may be kept for up to 6 years after the application, correspondence or dispute ends, unless a longer period is required or permitted by law. 17.11 Complaints and rights requests Data protection complaints, rights requests and related correspondence may be kept for up to 6 years where needed to show compliance, handle disputes or protect legal rights. 17.12 Backups Backups may be retained for up to 90 days. Backup deletion may occur on the next scheduled backup deletion cycle. Backup data may be isolated, protected and not used for ordinary Service purposes before deletion. 17.13 Longer retention Retention periods may be longer where required or permitted by law, court order, regulator, dispute, investigation, security incident, fraud prevention need or legal claim.

We use reasonable technical and organisational measures designed to protect personal data. Our security measures may include access controls, authentication controls, role-based permissions, customer-environment separation, logging, monitoring, abuse-prevention measures, backup and recovery measures, secure credential handling, provider security controls and malware-prevention measures where appropriate. No online service can be guaranteed to be completely secure. You are responsible for keeping your own login details, devices, email accounts, API credentials, workspace permissions, customer-facing links and bank transfer details secure. You should tell us promptly if you suspect unauthorised access, account compromise, credential compromise, unauthorised changes to bank details, unauthorised changes to payment instructions or a security incident affecting your workspace.

Depending on the circumstances and applicable law, you may have the following rights: (a) the right to be informed about how your personal data is used; (b) the right of access to your personal data; (c) the right to rectification of inaccurate or incomplete personal data; (d) the right to erasure of personal data in certain circumstances; (e) the right to restriction of processing in certain circumstances; (f) the right to data portability in certain circumstances; (g) the right to object to processing in certain circumstances; (h) the right to withdraw consent where processing is based on consent; (i) rights related to automated decision-making and profiling; and (j) the right to lodge a complaint with a supervisory authority. These rights are not absolute and may depend on the lawful basis, the type of personal data and the reason for processing. To exercise your rights, use the privacy contact listed in the Legal Notice. We may need to verify your identity before responding. We will respond to rights requests without undue delay and within the time required by applicable law. Where permitted by law, we may ask for additional information to verify your identity or clarify the request, and the response period may pause while we wait for that information. If your request relates to Customer Personal Data processed by Joqiva on behalf of a Joqiva customer, we may refer your request to that customer or act on that customer's instructions. If you are an End Customer and your request relates to quote, invoice, job, payment workflow or customer data controlled by a Joqiva customer, you should contact that Joqiva customer first.

You have the right to object to processing based on legitimate interests in certain circumstances. You always have the right to object to direct marketing. You can opt out of marketing emails by using the unsubscribe link in the email or by using the privacy contact listed in the Legal Notice. If you object to security, legal compliance, service operation or billing-related processing, we may need to continue processing where we have compelling legitimate grounds or legal obligations. If your objection relates to Customer Personal Data processed by Joqiva as processor, we may refer the objection to the relevant Joqiva customer or act on that customer's instructions.

Where we rely on consent, you can withdraw consent at any time. Withdrawing consent does not affect the lawfulness of processing before withdrawal. You can withdraw cookie consent through the Cookie Settings tool where available. Withdrawing or rejecting analytics cookies or similar storage stops Joqiva from using consent-based analytics cookies or storage for analytics measurement. It does not necessarily stop strictly necessary processing, security processing, or limited analytics or operational measurement that is permitted without consent under applicable law. You can withdraw marketing consent by using unsubscribe links or contacting us. Consent must be as easy to withdraw as it is to give where applicable law requires this.

Joqiva does not use personal data to make decisions about individuals that are solely automated and have legal or similarly significant effects. AI-assisted features create suggestions or extracted fields for review only. A Joqiva user must review and approve AI-assisted output before using it in their business. If Joqiva later introduces automated decision-making that has legal or similarly significant effects, we will update this Privacy Policy, provide the information required by applicable law, and implement required safeguards before using it.

If you have a concern about how Joqiva uses your personal data, please contact us first using the privacy contact listed in the Legal Notice. Please include "Data protection complaint" in the subject line where possible. We will acknowledge receipt of your data protection complaint within 30 days. We will take appropriate steps to investigate and respond without undue delay. We will tell you the outcome of your complaint without undue delay. If your complaint relates to Customer Personal Data processed by Joqiva on behalf of a Joqiva customer, we may refer the complaint to that customer or handle it in cooperation with that customer. You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) or any successor supervisory authority.

The Service may link to third-party websites, apps or services. Third-party services are not controlled by Joqiva and may process personal data under their own privacy policies. This Privacy Policy does not apply to third-party websites, apps or services.

If you connect third-party services to Joqiva, those third-party services may process personal data under their own terms and privacy policies. This Privacy Policy does not apply to third-party websites, apps or services.

We may update this Privacy Policy from time to time. If we make material changes, we will provide reasonable notice, such as by updating this page, sending an email, showing an in-app notice or posting a website notice. The updated Privacy Policy applies from the effective date shown at the top of the page. If we plan to use personal data for a new purpose that is materially different from the purposes described in this Privacy Policy, we will update our privacy information and communicate the change where required before starting that new processing.

For privacy questions, rights requests, data protection complaints or international transfer information, use the contact details maintained in the Legal Notice. The current privacy contact and legal contact are listed in the Legal Notice.