Privacy Policy

Full legal name: Zenera Ltd

Registered address: Zenera Ltd, 30 Timbermans View, Basildon, Essex, SS16 4UX.

Telephone: 0207 856 0191

Email: support@zenera.co.uk

Website: www.zenera.co.uk

Should you have any questions regarding this Privacy Policy, or should you wish to exercise any of your rights, please contact us through the above-mentioned email. We shall respond to all legitimate enquiries within one calendar month.

You also have the right to lodge a complaint at any time with the Information Commissioner's Office (ICO), the supervisory authority for data protection matters in the United Kingdom. Their contact details are available at www.ico.org.uk. We would, however, welcome the opportunity to address your concerns directly before you approach the ICO, and encourage you to contact us in the first instance.

• Identity Data - including your first name, last name, username, or similar identifiers used to access our platform.
• Contact Data - including your business email address, telephone number, and postal address.
• Account and Profile Data - including your login credentials, account preferences, activity history, and any feedback or survey responses you provide.
• Technical Data - including your Internet Protocol (IP) address, browser type and version, operating system, device identifiers, time zone settings, and other technologies on the devices you use to access our website or services.
• Usage Data - including information about how you navigate and interact with our website and platform, pages visited, features used, and session duration.
• Financial and Transaction Data - including details of any subscription plans or purchases made through our platform. Please note that Zenera does not store or process payment card details directly. All payment transactions are securely processed by authorised third-party payment service providers.
• Communications Data - including correspondence exchanged with us via email, contact forms, or other channels, as well as your marketing preferences and consent records.

Where the provision of personal data is required by law, or is necessary for us to perform our contractual obligations to you, failure to provide that data may prevent us from delivering our services to you. In such circumstances, we will notify you of this at the time of collection.

You may provide us with your personal data directly when you:

• Register for an account or subscribe to any of our software services.
• Complete an enquiry, contact, or feedback form on our website.
• Correspond with us by email, telephone, post, or any other means.
• Request a product demonstration or consultation.
• Take part in a survey, competition, or promotional activity.

We may also receive personal data about you from the following third-party sources:

• Analytics providers (such as Google Analytics), who may be based outside the United Kingdom or the European Economic Area.
• Payment and subscription management providers, who process financial transactions on our behalf.
• Publicly available directories and databases, such as Companies House, to the extent permitted by applicable law.
• Marketing and lead-generation partners, where you have provided appropriate consent for your data to be shared.

We may use your Identity, Contact, Technical, Usage, and Profile Data to form a view on what products, services, or features may be of interest to you. You may receive marketing communications from us if you have provided consent or were permitted under the ‘soft opt-in’ provisions for existing customers under the Privacy and Electronic Communications Regulations (PECR).

We will always obtain your explicit opt-in consent before sharing your personal data with any third party for their own marketing purposes. You may withdraw your consent or opt out of receiving marketing communications from us at any time by following the unsubscribe link within any marketing email, or by contacting us directly at support@zenera.co.uk.

Under UK data protection law, we are required to identify a lawful basis for each purpose for which we process your personal data. The legal bases we rely upon are as follows:

Performance of a Contract: Processing necessary to fulfil our contractual obligations to you, or to take steps prior to entering into a contract with you, for example, creating your account or delivering our software services.

Legitimate Interests: Processing necessary for the purposes of our legitimate business interests, where those interests are not overridden by your rights and freedoms. This includes improving our services, preventing fraud, administering our systems, and conducting direct marketing to existing customers. We carry out a balancing test before relying on this basis, and you may request details of our assessment.

Legal Obligation: Processing required to comply with our obligations under applicable law, including tax, accounting, and regulatory requirements.

Consent: Where none of the above bases applies, we will ask for your express, informed consent before processing your personal data. You have the right to withdraw your consent at any time, without affecting the lawfulness of any processing carried out prior to its withdrawal.

We may disclose your personal data where we are under a legal duty to do so, including in response to an order from a court, regulator, or governmental authority. Where lawful and practicable, we will endeavour to notify you of any such disclosure.

In certain circumstances, it may be necessary to transfer your personal data to countries or territories outside the United Kingdom or European Economic Area (EEA). Where such transfers occur, we take all steps necessary to ensure that your data is afforded a level of protection equivalent to that which it would receive in the United Kingdom.

Safeguards we may implement include:

• Standard Contractual Clauses (SCCs) approved by the relevant supervisory authority.
• Transfers to countries deemed by the Secretary of State to provide an adequate level of data protection.
• Binding Corporate Rules, where applicable within a corporate group.
• UK International Data Transfer Agreement (IDTA) or other approved transfer mechanisms.

You are welcome to contact us at support@zenera.co.uk for further details of the specific safeguards applied to any international transfers of your personal data.

Zenera takes the security of your personal data extremely seriously. We have implemented appropriate technical and organisational measures to protect your personal data against accidental loss, unauthorised access, misuse, disclosure, alteration, or destruction. These measures include:

• Encryption of data in transit and at rest.
• Role-based access controls, ensuring that only authorised personnel may access personal data on a strict need-to-know basis.
• Regular security assessments, penetration testing, and vulnerability management.
• Staff training on data protection and information security obligations.
• Incident response and breach notification procedures.

Where we engage third-party processors to handle personal data on our behalf, we require them to implement security standards no less rigorous than our own.

In the event of a personal data breach that is likely to result in a risk to individuals, we will notify the Information Commissioner's Office within 72 hours where required under applicable law. We maintain documented procedures for detecting, reporting, and investigating data security incidents.

We will retain your personal data only for as long as is necessary to fulfil the purposes set out in this Privacy Policy, including for the purposes of satisfying any legal, regulatory, accounting, or reporting obligations.

In determining the appropriate retention period for any category of personal data, we consider the following factors:

• The amount, nature, and sensitivity of the personal data.
• The potential risk of harm from unauthorised use or disclosure.
• The purposes for which we process the data and whether we can achieve those purposes through other means.
• Applicable statutory limitation periods and legal obligations.

As a general guide, we apply the following retention periods:

• Account and subscription data: retained for the duration of your contract, plus a further two years following termination.
• Financial and transaction records: retained for a minimum of six years in compliance with HMRC requirements.
• Marketing consent records: retained for the duration of the marketing relationship, plus three years.
• Website analytics data: retained for up to 26 months.
• Security and system logs: retained for up to 12 months.

On expiry of the applicable retention period, we shall securely delete or anonymise your personal data in accordance with our data disposal procedures. In some circumstances, we may anonymise your personal data for research or statistical purposes, in which case it will no longer constitute personal data and may be retained indefinitely.

You may control or disable cookies through the settings of your web browser. Please note, however, that disabling certain cookies may affect the functionality of our website and your ability to access certain features. Most browsers accept cookies automatically, but you can amend your settings via your browser's help function.

You may also opt out of certain third-party tracking via the following mechanisms:

• Google Analytics opt-out: https://tools.google.com/dlpage/gaoptout
• Network Advertising Initiative: www.networkadvertising.org/choices
• Digital Advertising Alliance: www.aboutads.info/choices

Right of Access: You have the right to obtain a copy of the personal data we hold about you and to verify that we are processing it lawfully.

Right to Rectification: You have the right to require us to correct any inaccurate or incomplete personal data held about you without undue delay.

Right to Erasure ('Right to be Forgotten'): You have the right to request the deletion of your personal data where there is no compelling reason for its continued processing, subject to certain legal exceptions.

Right to Restriction of Processing: You have the right to request that we suspend the processing of your personal data in certain circumstances, for example, whilst we verify the accuracy of data you have contested.

Right to Data Portability: Where processing is based on your consent or on the performance of a contract, you have the right to receive your personal data in a structured, commonly used, machine-readable format and to have it transmitted to another controller.

Right to Object: You have the right to object to the processing of your personal data where we rely on legitimate interests as our legal basis, or where we process your data for direct marketing purposes. We shall cease such processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of any processing carried out prior to withdrawal.

Right to Lodge a Complaint: You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at any time. Contact details: www.ico.org.uk.

Zenera's software platform may enable users to upload, manage, or otherwise process personal data relating to third parties, for example, contact records, client data, or employee information, in the course of using our services. In such circumstances, you act as the data controller in respect of that third-party personal data, and Zenera acts as your data processor.

You are solely responsible for ensuring that your collection and use of any such third-party personal data complies with all applicable data protection and privacy laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. You must ensure that you have a lawful basis for processing such data and that any required notices or consents have been obtained.

Please refer to our Data Processing Agreement, which forms part of our Terms and Conditions, for a full description of our respective obligations in relation to any third-party personal data processed via our platform.

We review this Privacy Policy regularly and reserve the right to update or amend it at any time. Any changes we make will be published on this page, and where appropriate (for example, in the case of significant changes), we shall notify you by email or via a prominent notice on our website.

The date at the top of this Privacy Policy indicates when it was last updated. We encourage you to review this Policy periodically to remain informed of how we are protecting your information. Your continued use of our website or services following the posting of any changes constitutes your acceptance of such changes.