1. Data Respect Statement

We are Productively Limited (#16458217) doing business as Productively.co - Our company details are set out at the end of this document.

Our use of your personal information is regulated under:

• the General Data Protection Regulation (Regulation (EU) 2016/679)) for as long as the United Kingdom is a member of the European Union or is subject to any transition arrangements after leaving the European Union;
• the Data Protection Act 2018; and
• any other privacy related laws or regulations the UK may implement as a result of it leaving the European Union.

We are responsible as “Controller” for the purposes of those laws.

As a company we are committed to protecting and respecting the privacy of your personal information. We want you to be confident that your information will be properly protected whilst in our possession.

The Privacy Policy below explains how we, and carefully selected third parties we work with, will collect and use the personal information of our customers and suppliers and users of our websites. If this describes you, please read the Privacy Policy carefully and make sure you’re comfortable with the content.

2. Information We Collect

a. Information you provide directly

• Account registration details (name, email, company name, job role, password)
• Workspace and business data you input (tasks, projects, goals, compliance notes, uploaded documents)
• Payment and billing details (processed securely by our payment provider)
• Communications with us (customer support requests, feedback, surveys, marketing preferences)

b. Information we collect automatically

• Log information: IP address, browser type, operating system, device identifiers
• Usage information: pages visited, actions taken, time spent, feature interactions
• Cookies and tracking technologies (see Section 9)

c. Information from third parties

• Companies House data (for company registration, verification, and compliance features)
• Payment providers (confirmation of successful transactions)
• Third-party authentication services (if you sign in with Google or similar)

3. How We Use Your Information

We use your information for the following purposes:

• To deliver our service: set up and manage your account, process payments, provide customer support
• To improve the platform: analyse usage patterns, run diagnostics, test new features, enhance security
• To communicate with you: send service updates, account notices, reminders, and customer support responses
• To market our services: send newsletters, promotions, and offers (only with your consent or where lawful)
• To comply with law: meet regulatory and tax obligations, prevent fraud, enforce our Terms of Service

4. Legal Bases for Processing

Under the UK GDPR, we rely on the following legal grounds:

• Contract – processing is necessary to provide our services (e.g., account management, payments)
• Consent – where you agree to marketing emails or optional features
• Legitimate Interests – for analytics, service improvements, and security (unless your rights override ours)
• Legal Obligation – where laws require us to keep or share data (e.g., tax records)

5. Sharing Your Information

We do not sell or rent your personal information. We may share it with:

• Service providers: hosting, analytics, email delivery, payment processors.
• Business partners: for integrations or joint services (only with your permission)
• Professional advisers: accountants, auditors, lawyers
• Regulators, courts, or law enforcement: if required by law or to protect our rights

All third parties are bound by contracts requiring them to process your data securely and only for specified purposes.

6. International Data Transfers

Your data may be transferred outside the UK/EEA (for example, to cloud providers in the US). When this happens, we ensure appropriate safeguards, such as:

• UK Addendum to the EU Standard Contractual Clauses
• Adequacy decisions by the UK Government
• Binding corporate rules

7. Data Retention

We keep your personal data for as long as you have an active account. After closure:

• Account and workspace data are deleted or anonymised within 90 days
• Transaction records may be kept for up to7 years for tax and legal purposes
• Backup copies may remain for a limited time before being securely deleted

8. Your Rights

You have the following rights under data protection law:

• Access – request a copy of your personal data
• Rectification – correct inaccurate or incomplete data
• Erasure – request deletion (“right to be forgotten”)
• Restriction – limit processing in certain cases
• Portability – receive data in a structured, machine-readable format
• Objection – object to marketing or legitimate interest processing
• Withdraw consent – withdraw marketing consent at any time

To exercise your rights, email hey@productively.co. We respond within 30 days.

9. Cookies and Tracking

We use cookies and similar technologies to:

• Remember preferences and keep you logged in
• Measure website and app performance
• Analyse traffic and improve usability
• Deliver relevant marketing

You can control cookies via your browser settings. For full details, see our Cookie Policy.

10. Marketing Communications

• You will only receive marketing messages if you opt in or if you are an existing customer and we have a legitimate interest.
• You can unsubscribe at any time via the link in emails or by contacting us.
• We do not share your details with third parties for their marketing.

11. Children’s Privacy

Our services are not directed to children under 16. We do not knowingly collect data from children. If we learn that a child has provided us with personal data, we will delete it promptly.

12. Security Measures

We take data security seriously and use:

• Encryption (HTTPS, TLS)
• Encrypted storage of sensitive information (e.g., passwords, payment tokens)
• Regular security audits and monitoring
• Role-based access controls

No system is 100% secure. If we ever experience a data breach, we will notify affected users and regulators as required by law.

13. Data Breaches

If a data breach occurs that risks your rights and freedoms, we will:

• Notify the Information Commissioner’s Office (ICO) within 72 hours (if legally required)
• Inform affected users without undue delay
• Provide details of steps taken to minimise the impact

14. Changes to This Policy

We may update this Privacy Policy at any time. Significant changes will be communicated by email or via a notice on our website. Please check back regularly to stay informed.

15. Contact Us

For questions or requests regarding this Privacy Policy, contact us at hey@productively.co

Productively Limited (#16458217)

37 Westminster Buildings

Theatre Square

Suite 933

Nottingham

England