Privacy Policy

At IntelliFM Ltd (Company Number 16649170), we are committed to protecting your privacy and handling your personal data responsibly. This Privacy Policy explains how we collect, use, store, share, and protect your personal data in compliance with the UK General Data Protection Regulation (UK GDPR), EU GDPR, and other applicable data protection laws worldwide. This policy applies to all users of our website (www.intellifm.io) and services (the "Service").

By accessing or using our Service, you acknowledge that you have read, understood, and agree to the collection, use, and disclosure of your personal data as described in this Privacy Policy. If you do not agree, please discontinue use of our Service immediately.

1. Data Controller and Contact Information

IntelliFM Ltd acts as the Data Controller for personal data collected through our website, services, and related communications. As Data Controller, we determine the purposes and means of processing your personal data.

Company Details:

• Legal Name: IntelliFM Ltd
• Company Number: 16649170
• Registered in: England and Wales
• Data Protection Contact: privacy@intellifm.io
• General Enquiries: hello@intellifm.io

For all data protection enquiries, requests to exercise your rights, or complaints, please contact our privacy team at privacy@intellifm.io.

2. Personal Data We Collect

We collect and process the following categories of personal data about you:

2.1 Information You Provide Directly:

• Contact and Identity Information: Full name, email address, phone number, job title, company name, business address
• Account Registration Data: Username, password (hashed), security questions and answers, profile information, preferences
• Billing and Payment Information: Billing address, payment card details (processed securely by our payment processors), VAT number, purchase order information
• Communication Data: Content of emails, chat messages, support tickets, feedback, survey responses, demo requests, and other correspondence with us
• User-Generated Content: Any data, files, documents, images, or other content you upload, create, store, or transmit through the Service
• Marketing Preferences: Your consent choices for receiving marketing communications and preferences

2.2 Information Collected Automatically:

• Usage Data: Pages viewed, features accessed, actions taken within the Service, time spent on pages, navigation paths, click patterns, search queries, timestamps
• Device and Technical Information: IP address, MAC address, browser type and version, operating system, device identifiers, screen resolution, language settings, time zone
• Location Data: General geographic location derived from IP address (country, city-level)
• Cookies and Similar Technologies: Information collected through cookies and similar technologies (see Section 10)
• Log Data: Server logs, error logs, diagnostic information, crash reports, performance metrics

2.3 Information from Third Parties:

• Information from business partners, resellers, or referral sources
• Publicly available information (e.g., company websites, LinkedIn profiles) for business contact purposes
• Data enrichment services to verify and supplement contact information
• Payment processors providing transaction confirmation and fraud prevention data

2.4 Special Category Data: We do not knowingly collect or process Special Category Data (as defined in GDPR Article 9) or data relating to criminal convictions and offences unless expressly agreed in writing and with appropriate safeguards in place. If you submit such data without authorisation, we may be required to delete it immediately.

2.5 Children's Data: Our Service is not intended for individuals under the age of 16 (or the applicable age of digital consent in your jurisdiction). We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from a child, we will delete it promptly. Parents or guardians who believe we have collected information from a child should contact us immediately at privacy@intellifm.io.

3. How and Why We Use Your Personal Data

We process your personal data for the following purposes and on the legal bases described below:

3.1 Service Delivery and Performance:

• Creating, managing, and maintaining your account
• Providing access to and functionality of the Service
• Authenticating users and managing security
• Processing transactions and maintaining billing records
• Providing customer support and responding to enquiries
• Sending service-related communications (account notifications, security alerts, system updates)
• Storing and processing your uploaded content and data
• Legal Basis: Contractual necessity (to perform our contract with you)

3.2 Product Development and Improvement:

• Analysing usage patterns and user behaviour to improve the Service
• Conducting research and development of new features
• Testing, troubleshooting, and diagnosing technical issues
• Performing data analytics and statistical analysis
• Creating aggregated, anonymised, or de-identified data for benchmarking and insights
• Legal Basis: Legitimate interests (improving our Service and developing new offerings)

3.3 Marketing and Communications:

• Sending promotional emails, newsletters, and marketing materials about our Service
• Conducting market research and surveys
• Sending information you asked us to send
• Analysing marketing campaign effectiveness
• Legal Basis: Consent (for direct marketing where required) or Legitimate interests (promoting our business)
• You may opt out of marketing communications at any time using the unsubscribe link or by contacting us

3.4 Security and Fraud Prevention:

• Detecting, preventing, and responding to security incidents, fraud, and abuse
• Verifying user identity and preventing unauthorised access
• Monitoring for malicious activity, bots, and automated attacks
• Enforcing our Terms and Conditions and Acceptable Use Policy
• Protecting the rights, property, and safety of IntelliFM, our users, and third parties
• Legal Basis: Legitimate interests (protecting our business and users) and Legal obligation

3.5 Legal and Regulatory Compliance:

• Complying with applicable laws, regulations, and legal processes
• Responding to lawful requests from courts, regulators, and law enforcement
• Establishing, exercising, or defending legal claims
• Maintaining records for tax, accounting, and auditing purposes
• Complying with data protection and privacy laws
• Conducting know-your-customer (KYC) and anti-money laundering (AML) checks where required
• Legal Basis: Legal obligation and Legitimate interests (compliance and legal protection)

3.6 Business Operations:

• Managing business relationships and partnerships
• Facilitating mergers, acquisitions, or asset sales
• Conducting internal audits and quality assurance
• Managing corporate governance and compliance programmes
• Legal Basis: Legitimate interests (operating and managing our business)

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another compatible reason. If we need to use your data for an unrelated purpose, we will notify you and explain the legal basis.

4. Legal Basis for Processing (GDPR/UK GDPR)

Under GDPR and UK GDPR, we must have a lawful basis to process your personal data. We rely on the following legal grounds:

4.1 Consent (Article 6(1)(a)): Where you have given clear, informed, and specific consent for us to process your personal data for a particular purpose (e.g., marketing communications, optional cookies). You have the right to withdraw consent at any time by contacting us or using opt-out mechanisms.

4.2 Contractual Necessity (Article 6(1)(b)): Processing is necessary for the performance of our contract with you or to take steps at your request before entering into a contract (e.g., providing the Service, managing your account, processing payments).

4.3 Legal Obligation (Article 6(1)(c)): Processing is necessary for compliance with legal obligations to which we are subject (e.g., tax and accounting requirements, responding to legal requests, data breach notifications, KYC/AML requirements).

4.4 Legitimate Interests (Article 6(1)(f)): Processing is necessary for our legitimate business interests or those of a third party, except where overridden by your fundamental rights and freedoms. Our legitimate interests include:

• Operating, maintaining, and improving the Service
• Protecting against security threats, fraud, and abuse
• Conducting analytics and research to develop new products and features
• Marketing our products and services to businesses
• Personalizing user experience and content
• Managing business relationships and communications
• Establishing, exercising, or defending legal claims
• Corporate transactions (mergers, acquisitions, etc.)

We have conducted a balancing test (Legitimate Interest Assessment) to ensure that our interests do not override your rights and freedoms. You have the right to object to processing based on legitimate interests (see Section 7).

4.5 Vital Interests (Article 6(1)(d)): In rare circumstances, processing may be necessary to protect someone's life or prevent serious harm.

4.6 Public Task (Article 6(1)(e)): Not typically applicable to our business operations.

4.7 Special Category Data: We do not routinely process Special Category Data. If we do in exceptional circumstances with your explicit consent or legal authorisation, we will implement additional safeguards and provide specific notice.

5. When and With Whom We Share Your Personal Data

We do not sell, rent, or trade your personal data to third parties for their marketing purposes.

We may share your personal data with the following categories of recipients in the circumstances described below:

5.1 Service Providers and Sub-Processors: We engage carefully selected third-party vendors to perform functions on our behalf, including:

• Cloud hosting and infrastructure providers (e.g., data centres, servers)
• Payment processors and financial services providers
• Email delivery and communication platforms
• Customer relationship management (CRM) systems
• Analytics and monitoring tools
• Customer support and helpdesk platforms
• Security and fraud prevention services
• Professional advisors (lawyers, accountants, auditors, insurers)

These service providers are contractually obligated to process data only on our instructions, maintain confidentiality, implement appropriate security measures, and comply with GDPR/UK GDPR. A list of our sub-processors is available upon request at privacy@intellifm.io.

5.2 Business Partners and Resellers: If you access our Service through a business partner, reseller, or referral arrangement, we may share your information with that partner as necessary to facilitate the relationship and provide the Service. Such partners are subject to their own privacy policies.

5.3 Legal and Regulatory Authorities: We may disclose your personal data to:

• Law enforcement agencies, courts, tribunals, regulatory bodies, and government officials when required by law or legal process (subpoenas, court orders, warrants)
• Comply with legal obligations, regulatory requirements, or valid governmental requests
• Establish, exercise, or defend legal claims and protect legal rights
• Prevent fraud, crime, or abuse; protect public safety
• Enforce our Terms and Conditions or other agreements
• Protect the rights, property, or safety of IntelliFM, our users, or the public

Where permitted by law, we will notify you of such requests unless prohibited or where notification would undermine the purpose of the disclosure.

5.4 Corporate Transactions: In the event of a merger, acquisition, corporate reorganisation, sale of assets, bankruptcy, or similar transaction:

• Your personal data may be transferred to the acquiring or successor entity
• We will notify you via email and/or prominent notice on our website before your data is transferred or becomes subject to a different privacy policy
• The acquiring entity will be required to honour the commitments in this Privacy Policy
• You will have the opportunity to delete your account or object to the transfer where legally permitted

5.5 Within Our Corporate Group: We may share personal data with our subsidiaries, affiliates, parent company, or related entities for business operations, provided they comply with this Privacy Policy and applicable data protection laws.

5.6 With Your Consent: We may share your personal data with third parties where you have provided explicit consent for such sharing (e.g., integrations with third-party applications).

5.7 Aggregated or Anonymised Data: We may share aggregated, de-identified, or anonymised data that cannot reasonably be used to identify you with third parties for analytics, research, marketing, or other business purposes. Such data is not subject to this Privacy Policy.

5.8 Public Information: Any information you post in public areas of the Service (e.g., public forums, comments) may be viewed by other users and the public. Exercise caution when posting personal data publicly.

All third parties with whom we share your personal data are required by contract to respect the security of your data and treat it in accordance with the law. We do not permit our service providers to use your data for their own purposes.

6. Data Retention and Deletion

6.1 Retention Principles: We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, comply with legal and regulatory obligations, resolve disputes, enforce our agreements, and establish or defend legal claims.

6.2 Retention Periods: Different types of data are retained for different periods based on legal requirements and business needs:

• Account Data: Retained for the duration of your active account plus 30 days after account closure (unless you request immediate deletion or longer retention is required by law)
• Transaction and Billing Records: Retained for 7 years from the end of the financial year to which they relate (UK tax and accounting requirements)
• Contracts and Agreements: Retained for 7 years after termination (UK limitation period for contractual claims)
• Marketing Consents and Opt-Outs: Retained indefinitely to honour your preferences
• Security Logs and Incident Records: Retained for 12–24 months (or longer if required for ongoing investigations)
• Website usage events: First-party events recorded by the site host. Section 10 describes what those events are. The 26-month figure previously stated here has been removed because it was not reconciled with the way the site is actually hosted. Ask us if you need the current retention period.
• Communication Records: Support tickets and correspondence retained for 3 years; legal correspondence retained for 7 years

6.3 Deletion Upon Account Closure: When you close your account or request deletion:

• We will delete or anonymise your personal data within 30 days, subject to the exceptions below
• Backup copies may persist for up to 90 days in our disaster recovery systems before automatic deletion
• Some data may be retained in anonymised or aggregated form for analytics
• We may retain data where required by legal, regulatory, tax, or accounting obligations
• We may retain data necessary to establish or defend legal claims until the claim is resolved and any appeal period expires
• Data shared with third parties is governed by their retention policies

6.4 Secure Deletion: When data is deleted, we use secure deletion methods designed to make recovery impossible, including overwriting, cryptographic erasure, and physical destruction of media where applicable.

6.5 Legal Hold: If data is subject to a legal hold, court order, investigation, or litigation, we will preserve such data until the hold is lifted or the matter is resolved, even if it exceeds standard retention periods.

For questions about our retention practices or to request deletion of your data, contact us at privacy@intellifm.io.

7. Your Data Protection Rights

Under GDPR, UK GDPR, and other applicable data protection laws, you have the following rights regarding your personal data:

7.1 Right of Access (Article 15): You have the right to request:

• Confirmation of whether we process your personal data
• Access to your personal data and a copy in a commonly used format
• Information about the purposes, categories, recipients, retention periods, and sources of your data
• First copy provided free of charge; reasonable fees may apply for additional copies

7.2 Right to Rectification (Article 16): You have the right to:

• Request correction of inaccurate, incomplete, or outdated personal data
• Supplement incomplete data with a supplementary statement
• We will notify any third parties to whom we disclosed the data of the rectification, unless impossible or involving disproportionate effort

7.3 Right to Erasure / "Right to be Forgotten" (Article 17): You have the right to request deletion of your personal data where:

• Data is no longer necessary for the purposes for which it was collected
• You withdraw consent and there is no other legal basis for processing
• You object to processing and there are no overriding legitimate grounds
• Data has been unlawfully processed
• Data must be erased to comply with a legal obligation

This right is not absolute. We may refuse deletion if processing is necessary for:

• Compliance with legal obligations or performance of a public interest task
• Establishment, exercise, or defence of legal claims
• Freedom of expression and information
• Archiving, research, or statistical purposes

7.4 Right to Restriction of Processing (Article 18): You have the right to request restriction (but not deletion) of processing where:

• You contest the accuracy of the data (restriction applies during verification)
• Processing is unlawful but you prefer restriction over deletion
• We no longer need the data but you need it for legal claims
• You have objected to processing pending verification of our legitimate grounds

During restriction, we may store the data but not otherwise process it (except with your consent or for legal claims).

7.5 Right to Data Portability (Article 20): You have the right to:

• Receive your personal data in a structured, commonly used, machine-readable format (e.g., CSV, JSON)
• Transmit that data to another controller without hindrance
• Request direct transmission to another controller where technically feasible
• This right applies only to data you provided based on consent or contract, and processed by automated means

7.6 Right to Object (Article 21): You have the right to object at any time to:

• Processing based on legitimate interests or public task (we must stop unless we demonstrate compelling legitimate grounds that override your interests)
• Processing for direct marketing purposes (we will stop immediately upon request)
• Processing for research or statistical purposes (unless necessary for public interest)

7.7 Right to Withdraw Consent (Article 7(3)): Where processing is based on consent:

• You have the right to withdraw consent at any time
• Withdrawal does not affect the lawfulness of processing before withdrawal
• Use unsubscribe links in emails or contact us to withdraw consent
• Withdrawing consent may mean we cannot provide certain services

7.8 Right Not to be Subject to Automated Decision-Making (Article 22): You have the right not to be subject to decisions based solely on automated processing (including profiling) that produce legal or similarly significant effects, unless:

• Necessary for entering into or performing a contract
• Authorised by law with suitable safeguards
• Based on your explicit consent

We do not currently engage in automated decision-making with legal or significant effects. If this changes, we will notify you and implement appropriate safeguards.

7.9 Right to Lodge a Complaint with a Supervisory Authority: You have the right to lodge a complaint with a data protection authority, particularly in your country of residence, place of work, or where an alleged infringement occurred:

• UK: Information Commissioner's Office (ICO) — ico.org.uk | Tel: 0303 123 1113
• EU: Your local Data Protection Authority — Find your authority

Exercising Your Rights:

To exercise any of these rights, please contact our privacy team at privacy@intellifm.io. Include:

• Your full name and email address associated with your account
• A clear description of your request and which right(s) you wish to exercise
• Proof of identity (to prevent unauthorised access to your data)

We will respond to your request within one month of receipt (extendable by two additional months for complex requests). We will provide our response free of charge, except where requests are manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable fee or refuse the request.

8. Data Security and Protection Measures

8.1 Security commitment: We use ordinary technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. This section states only the measures we are prepared to stand behind. It does not describe a certification.

8.2 Technical measures:

• Encryption in transit: The website and the service are served over HTTPS.
• Encryption at rest: Data stored by our hosting providers is encrypted using the provider’s standard controls. This policy does not name an algorithm.
• Access: Access to customer data inside the service is limited by role.
• Passwords: Passwords are stored in hashed form. This policy does not name the hashing method.
• Updates and logs: We apply security updates to the software we operate, and we keep logs that help us investigate faults and misuse.
• Backups: We take backups so the service can be restored after a fault. This policy does not state a recovery time.

8.3 Organisational measures:

• People who work on the service are expected to keep personal data confidential.
• If we become aware of a personal-data breach, we assess it and notify the ICO and affected people where the law requires it. Section 8.5 describes that process.
• The service is hosted by a cloud provider. We do not operate our own data centres for this service.

8.4 What we do not claim:

• We do not claim ISO, SOC 2, NIST or CIS certification on this website.
• We do not claim mandatory multi-factor authentication, a 24/7 monitoring centre, a SIEM product, a bug-bounty programme, phishing simulations, biometric access control, or CCTV operated by us.
• We process personal data in line with UK GDPR. That is an obligation, not a certificate.

8.5 Data Breach Response: Despite our security measures, no system is 100% secure. In the unlikely event of a personal data breach:

• We will assess the breach and take immediate steps to contain and remediate it
• We will notify the relevant supervisory authority within 72 hours where required by law
• We will notify affected individuals without undue delay if the breach is likely to result in high risk to their rights and freedoms
• We will document all breaches and our response for regulatory review
• We will conduct post-incident reviews and implement lessons learned

8.6 Your Responsibilities: While we implement robust security, you also play a critical role in protecting your data:

• Choose strong, unique passwords and do not reuse passwords across services
• Enable multi-factor authentication where available
• Keep your login credentials confidential and do not share them
• Log out of your account when using shared or public computers
• Report any suspicious activity or security concerns immediately to security@intellifm.io
• Keep your devices and software up to date with security patches
• Be vigilant against phishing attempts and suspicious emails

If you believe your account has been compromised or suspect a security incident, contact us immediately at security@intellifm.io.

9. International Data Transfers

9.1 Data location: The service is hosted in the cloud. This policy does not state that personal data is stored only in the United Kingdom or the EEA, because that has not been confirmed for every provider. Where personal data is transferred outside the UK, section 9.3 describes the safeguards.

9.2 Transfers to Third Countries: In some circumstances, we may transfer your personal data to countries outside the UK and EEA (including the United States) where:

• Our service providers or sub-processors are located in such countries
• You access the Service while traveling to or residing in such countries
• Technical infrastructure (e.g., cloud services, CDNs) operates in such countries

9.3 Transfer Safeguards: When we transfer data to third countries, we ensure appropriate safeguards are in place as required by GDPR Article 46:

• Adequacy Decisions: Transfers to countries recognised by the European Commission or UK Government as providing adequate protection (e.g., Adequacy Decisions under Article 45)
• Standard Contractual Clauses (SCCs): We use the European Commission's approved Standard Contractual Clauses (2021/914) or UK International Data Transfer Agreement (IDTA) to govern data transfers with processors and recipients in third countries
• Binding Corporate Rules: Where applicable, transfers within corporate groups subject to approved BCRs
• Certification Mechanisms: Transfers subject to approved certification mechanisms with binding enforcement (when available)
• Supplementary Measures: Additional technical, organisational, and contractual measures to ensure data protection equivalent to EEA/UK standards, including end-to-end encryption, pseudonymization and data minimization, contractual restrictions on government access, and regular transfer impact assessments

9.4 Derogations (Exceptions): In limited circumstances, we may rely on specific derogations under GDPR Article 49 for transfers, including:

• Your explicit consent after being informed of the risks
• Necessity for performance of our contract with you
• Necessity for establishment, exercise, or defence of legal claims
• Compelling legitimate interests where the transfer is not repetitive and concerns a limited number of individuals

9.5 Further Information: You may request further information about our international transfers and the safeguards in place by contacting privacy@intellifm.io. Upon request, we will provide:

• A list of third countries to which we transfer data
• Details of the safeguards implemented (with commercially sensitive information redacted as necessary)
• Copies of relevant SCCs or other transfer mechanisms

10. Cookies and Tracking

This marketing website does not use Google Analytics, Mixpanel, Hotjar, the Facebook pixel, the LinkedIn Insight Tag, Google Ads, or other advertising pixels. We do not run a cookie banner, because we do not place advertising cookies.

Fonts. The site uses typefaces already on your device. It does not load fonts from Google Fonts or another third-party font host.

Host usage events. The site is hosted on Base44. Base44 records first-party events, for example that a visitor selected Start Free Trial, so we can see how the site is used. These events are not used to advertise to you on other websites. A separate cookies page describes the same point: intellifm.io/cookies.

Strictly necessary cookies. A session cookie may be set where the site needs one, for example to keep an administrator signed in. These cookies are not used to advertise to you.

Server logs. The host records IP address, browser type, request time and errors so the site can run and be protected. Those logs are not used to build an advertising profile. This policy does not state a retention period for the logs. Section 6 no longer states a 26-month or 90-day figure for them, because those two figures did not match.

If this changes. If we introduce advertising cookies or a third-party analytics product, we will update this policy and ask for consent before those cookies are placed.

11. Changes and Updates to This Privacy Policy

11.1 Right to Modify: We reserve the right to modify, update, or replace this Privacy Policy at any time to reflect changes in:

• Our data processing practices or business operations
• Legal, regulatory, or compliance requirements
• Technology, security measures, or industry standards
• Feedback from users or regulators
• Mergers, acquisitions, or corporate restructuring

11.2 Notification of Changes: When we make changes to this Privacy Policy:

• Minor Changes: For non-material changes (e.g., clarifications, formatting, contact details), we will update the "Last Updated" date at the top of this policy. We encourage you to review this policy periodically.
• Material Changes: For material changes that significantly affect how we process your personal data or your rights, we will provide prominent notice at least 30 days before the changes take effect — by email notification to your registered address, in-app notification when you log in, or prominent notice on our website.
• Consent Required: Where changes require your consent under applicable law (e.g., processing for new purposes not compatible with original purposes), we will seek your explicit consent before processing data under the updated policy.

11.3 Acceptance: By continuing to access or use the Service after the effective date of any updates, you acknowledge that you have read, understood, and agree to be bound by the updated Privacy Policy. If you do not agree to the updated policy, you must stop using the Service immediately, close your account or request deletion of your data, and contact us to discuss your concerns.

11.4 Version History: We maintain a version history of this Privacy Policy. Previous versions are available upon request at privacy@intellifm.io.

We recommend that you review this Privacy Policy regularly to stay informed about how we protect your personal data.

12. Contact Us and Exercise Your Rights

IntelliFM Ltd
Company Number: 16649170
Registered in England and Wales

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, or if you wish to exercise any of your data protection rights, please contact us:

Privacy Team:
Email: privacy@intellifm.io

General Enquiries:
Email: hello@intellifm.io

Security Concerns:
Email: security@intellifm.io

We will respond to your enquiry or request within one month of receipt (extendable by two months for complex requests). Please provide sufficient information to identify you and verify your identity.

Right to Lodge a Complaint with Supervisory Authority:

If you are not satisfied with our response or believe we have processed your personal data unlawfully, you have the right to lodge a complaint with a data protection supervisory authority:

United Kingdom:
Information Commissioner's Office (ICO)
Website: ico.org.uk
Telephone: 0303 123 1113
Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

European Union / EEA:
Find your local Data Protection Authority at edpb.europa.eu

However, we would appreciate the opportunity to address your concerns before you approach a supervisory authority. Please contact us first so we can attempt to resolve the issue.