1. Who we are
This Privacy Policy explains how personal data is collected, used, stored, shared and protected when individuals use:
- the FormaPortal website (the Site); and
- the FormaPortal software-as-a-service platform (the Platform), together with the Site, the Services.
“Services” means the FormaPortal website, the FormaPortal software-as-a-service platform, and related support, operational and administrative services.
The Services are operated by FormaPortal Ltd, a company registered in England and Wales under company number 17335174, with its registered office at 565 Green Lanes, London, England, N8 0RL.
In relation to personal data processed through the Services, FormaPortal Ltd acts as a data controller for the purposes of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Where goods or services are offered to individuals in the European Economic Area, processing may also be subject to the EU General Data Protection Regulation (EU GDPR).
Questions about this Privacy Policy or the handling of personal data may be sent to:
Email: info@formaportal.com
2. About the Services
FormaPortal provides features and services that may include:
- hosted platform access for business customers and their Authorised Users;
- data processing, storage and reporting features;
- analytics, insights and dashboards; and
- integrations and API access.
The Services are provided for business use only and are not offered to consumers. They do not constitute legal, financial, tax, regulatory or other professional advice.
Some information provided through the Services may be confidential or sensitive to a customer’s business and is therefore handled with additional care.
The Services are intended for business users aged 18 and over only.
3. The personal data collected
The categories of personal data collected depend on how the Services are used.
Account data may include:
- name;
- email address;
- password stored in encrypted form; and
- phone number.
Platform and content data may include:
- data and content uploaded to the Platform;
- scores, labels or insights generated within the Platform;
- account and configuration entries; and
- notes or other content added by an Authorised User.
Some content uploaded by a customer or Authorised User could amount to data concerning health or other special category data under data protection law, depending on the information entered by the user.
Billing and subscription data may include:
- subscription or plan purchased;
- billing contact details;
- billing and subscription history; and
- payment confirmation or related transaction status information.
Full payment card details are not intended to be stored directly by FormaPortal where payments are handled by third-party payment providers.
Technical and usage data may include:
- device and operating system type;
- browser type and version;
- IP address;
- general location derived from IP address;
- date and time of access; and
- app or website usage events.
Support and communications data may include:
- emails and messages sent to support;
- issue descriptions;
- feedback; and
- records of communications with users.
Marketing and preference data may include:
- marketing consent status;
- subscription preferences; and
- records of marketing communications or in-app preferences.
FormaPortal does not intentionally collect special category data, children’s data, bank login credentials or other unnecessary sensitive data for the operation of the Services.
4. How personal data is collected
Personal data is collected directly from users when they:
- create an account or update profile information;
- use platform features and upload data or content;
- purchase or manage a subscription; or
- contact support or provide feedback.
Personal data is also collected automatically through the use of the website and the Platform, including through cookies, software development kits, analytics tools and similar technologies.
Limited information may also be received from third parties, including payment processors, analytics providers and crash-reporting providers, where relevant to the operation of the Services.
5. How and why personal data is used
Personal data may be used to create and manage user accounts, provide access to features, display results, store user entries and operate the Services generally.
Personal data may be used to process subscriptions, administer billing and provide related customer support.
Personal data may be used to respond to queries, send service-related messages, issue security notices and communicate changes to the Services, terms or policies.
Personal data may be used to analyse how the Services are used, improve features, diagnose technical issues and protect the Services from misuse, fraud or security threats.
Personal data may also be used to comply with legal obligations, respond to regulators or law enforcement, and establish, exercise or defend legal rights.
6. Lawful bases for processing
Personal data is processed only where there is a valid lawful basis under applicable data protection law.
The lawful bases relied upon may include:
- contract, where processing is necessary to provide the Services requested by the user;
- legal obligation, where processing is necessary to comply with applicable law;
- legitimate interests, where processing is necessary for operating, improving or securing the Services, provided those interests are not overridden by the rights and freedoms of the user; and
- consent, where consent is required or otherwise relied upon.
Where content uploaded by a customer or Authorised User amounts to data concerning health or other special category data, FormaPortal will process that information only where both:
- a valid lawful basis under UK GDPR art 6 applies to the relevant processing purpose; and
- a separate condition under UK GDPR art 9 applies, typically the customer’s or Authorised User’s explicit consent where the Services process such information as part of the content uploaded to the Platform.
Depending on how the relevant feature is used, FormaPortal may process such information to provide the requested functionality, store and display entries, maintain the safety and security of the Services, and comply with legal obligations. FormaPortal does not use such information for unrelated third-party advertising purposes and does not use special category data to make solely automated decisions that produce legal or similarly significant effects on individuals.
7. Special category data
Content uploaded to the Platform by a customer or Authorised User could, depending on what is entered, amount to special category data and may therefore receive enhanced protection under data protection law.
Such data is processed only where relevant to the operation of the Services and where a valid lawful basis and special category condition apply.
FormaPortal does not use special category data to make solely automated decisions that produce legal or similarly significant effects on users.
8. Marketing communications
FormaPortal may send business contacts updates about products, services, features, promotions or content, where permitted by law.
Marketing communications may be sent on the basis of consent where required, or on the basis of legitimate interests where permitted by applicable law.
Users may opt out of marketing communications at any time by using the unsubscribe function, adjusting in-app settings where available, or contacting FormaPortal using the contact details in clause 15.
9. Cookies and similar technologies
The website and the Platform may use cookies, analytics technologies, software development kits and similar tools to:
- provide core functionality;
- keep users signed in;
- understand how the Services are used; and
- improve performance and user experience.
Where required by law, consent will be requested before non-essential cookies or similar technologies are used.
10. Sharing personal data
Personal data may be shared with selected third parties where this is necessary for the operation of the Services or compliance with legal obligations.
Some of these third parties act as processors on our behalf, while others act as independent controllers; where processors are used, we require appropriate contractual and data protection safeguards.
These third parties may include:
- hosting, infrastructure and cloud service providers;
- analytics, diagnostics and communication providers;
- payment processors and billing providers;
- integration and support tool providers;
- professional advisers such as lawyers, accountants, auditors and insurers; and
- regulators, courts, public authorities or law enforcement bodies where disclosure is required or justified by law.
Personal data may also be disclosed in connection with a merger, acquisition, restructuring, sale of business or investment transaction, subject to appropriate confidentiality protections.
FormaPortal does not share content uploaded to the Platform, or personal data derived from it, with advertisers or for unrelated third-party marketing purposes.
11. International transfers
Some recipients of personal data may be located outside the United Kingdom or the European Economic Area.
Where personal data is transferred internationally, FormaPortal will ensure that appropriate safeguards are used in accordance with applicable law, including adequacy regulations, adequacy decisions or approved standard contractual clauses where relevant.
Further information about international transfers may be requested using the contact details in clause 15.
12. Data retention
Personal data is retained only for as long as necessary for the purposes for which it was collected, including to provide the Services, comply with legal obligations, and establish, exercise or defend legal claims.
In general:
- account data is kept while the account remains active and is deleted or anonymised within a reasonable period after account deletion;
- customer content and uploaded data is kept until the relevant content is deleted by the customer or Authorised User, or the account is deleted, subject to operational backup and legal retention requirements;
- order and transaction records may be kept for up to 6 years for tax, accounting and legal compliance purposes;
- support records are generally kept for 12 to 24 months, unless a longer period is required for dispute handling, investigation or legal compliance;
- technical and analytics data are generally retained for 12 to 26 months, subject to earlier deletion, aggregation or anonymisation where appropriate, and
- marketing data is kept until the user unsubscribes or consent is withdrawn.
Anonymised or aggregated data may be retained for longer where it no longer identifies any individual.
13. Security
FormaPortal applies appropriate technical and organisational measures designed to protect personal data against unauthorised or unlawful processing, accidental loss, destruction or damage.
These measures may include:
- encryption in transit and, where appropriate, at rest;
- access controls and role-based permissions;
- secure hosting infrastructure;
- monitoring and logging; and
- internal procedures relating to breach response, retention and access management.
Users are responsible for maintaining the confidentiality of their login credentials and for notifying FormaPortal promptly if unauthorised account use is suspected.
Where a personal data breach occurs, FormaPortal will assess the incident and respond in accordance with its Data Breach Response Policy and applicable law.
14. User rights
Subject to applicable law and any relevant exemptions, users may have the right to:
- access their personal data;
- request correction of inaccurate or incomplete personal data;
- request deletion of personal data;
- request restriction of processing;
- object to certain processing, including direct marketing;
- receive certain personal data in a portable format; and
- withdraw consent where processing is based on consent.
Where available, users may also delete their account through the Platform or by contacting FormaPortal directly.
A request to exercise any of these rights may be made using the contact details in clause 15.
15. Contact and rights requests
Questions about this Privacy Policy, requests to exercise data rights, or concerns about the handling of personal data should be directed to:
Email: info@formaportal.com
FormaPortal may request information necessary to verify identity before responding to a rights request.
16. Complaints
If a user has concerns about the way personal data is handled, FormaPortal asks that the concern be raised first using the contact details in clause 15.
Users also have the right to lodge a complaint with the relevant supervisory authority.
In the United Kingdom, the supervisory authority is the Information Commissioner’s Office (ICO).
17. Changes to this Privacy Policy
This Privacy Policy may be updated from time to time to reflect changes to the Services, operational practices or legal requirements.
Where changes are material, appropriate notice may be given through the website, the Platform, email or other suitable means.