This privacy notice explains how Spendstream Ltd (Spendstream, we, us or our) collects and uses personal data when you visit www.spendstream.co.uk, book a meeting with us, make a business enquiry, or otherwise interact with us in connection with this corporate website.
This notice covers the Spendstream corporate website and our dealings with prospective clients, clients, suppliers and other business contacts. It does not govern an end user's use of a Spendstream-powered white-label rewards programme, gift-card service or client application. The privacy notice shown within the relevant programme or service applies to that activity.
1. Who we are
Spendstream Ltd is a company registered in England and Wales under company number 16056707. Our registered office is at 167-169 Great Portland Street, 5th Floor, London, United Kingdom, W1W 5PF.
For the personal data covered by this notice, Spendstream Ltd is normally the controller. You can contact us about privacy matters at [email protected] or at the registered office above.
2. Personal data we collect
Depending on how you interact with us, we may collect:
- Identity and business contact data, including your name, job title, organisation, business email address, telephone number and professional contact details.
- Enquiry and meeting data, including the information you provide when you email us, book a meeting, request a demonstration, ask for a proposal or otherwise communicate with us.
- Relationship data, including records of our correspondence, meeting notes, your organisation's requirements, proposals sent to you and the status of a prospective or existing business relationship.
- Technical and usage data, including IP address, browser and device information, approximate location derived from an IP address, referring website, pages viewed, dates and times of visits, interactions with pages and diagnostic or security information.
- Analytics and interaction data, including aggregated website statistics and, where you have consented, information collected through analytics, visitor-identification, chat or user-experience tools.
- Marketing and preference data, including whether you have asked to receive or stop receiving updates and your cookie choices.
We do not ask you to provide payment-card details or special category data through this corporate website. Please do not include unnecessary sensitive information in an enquiry.
3. How we collect personal data
We collect personal data:
- directly from you when you contact us, correspond with us or book a meeting;
- automatically from your browser or device when you use the website, subject to your cookie choices;
- from service providers used to manage bookings, website analytics, chat, security and consent preferences;
- from your organisation, a colleague, a mutual business contact or a referral partner; and
- from public business sources such as company websites, professional networking services and Companies House where relevant to a genuine business relationship.
4. How and why we use personal data
| Purpose | Personal data | Lawful basis |
|---|---|---|
| Operate, secure and diagnose the website | Technical, usage and security data | Our legitimate interests in providing a secure and reliable website; compliance with legal obligations where applicable |
| Respond to enquiries, arrange demonstrations and take steps requested before entering a contract | Identity, business contact, enquiry and meeting data | Taking steps at your request before a contract; our legitimate interests in responding to business enquiries |
| Develop and manage prospective, client, supplier and partner relationships | Identity, contact, relationship and correspondence data | Performance of a contract where you are a party; otherwise our legitimate interests in managing business relationships |
| Understand and improve the website and user experience | Technical, usage, analytics and interaction data | Your consent where non-essential cookies or similar technologies are used; otherwise our legitimate interests where an applicable legal exemption permits the activity |
| Send relevant business-to-business updates and follow up genuine business interest | Business contact, relationship, marketing and preference data | Your consent where required; otherwise our legitimate interests in marketing our services to relevant business contacts, subject to your right to object |
| Comply with law, protect our rights, prevent misuse and establish or defend legal claims | Any relevant data described above | Compliance with legal obligations and our legitimate interests in protecting the business and its legal rights |
Where we rely on legitimate interests, we consider whether the processing is necessary and balance our interests against your rights and reasonable expectations. You can object to processing based on legitimate interests as explained below.
5. Cookies and similar technologies
We use cookies and similar technologies to operate the website and, with your consent where required, to understand its use and improve the experience. Our Cookie Policy identifies the technologies currently shown in our consent tool and explains how to change or withdraw your choices.
6. Who we share personal data with
We may share personal data with carefully selected organisations where necessary for the purposes described above, including:
- Cloudflare, for content delivery, website performance and security;
- CookieYes, for recording and managing cookie preferences;
- Google Analytics, Hotjar/Contentsquare and Snitcher, where enabled and permitted by your choices, for website analytics, user-experience analysis and business-visitor insights;
- Freshworks/Freshchat, where the relevant website communication functionality is enabled;
- Calendly, when you choose to book a meeting with us;
- our website hosting, email, IT support and other business-system providers;
- professional advisers, auditors, insurers and prospective purchasers or investors where reasonably necessary and subject to appropriate confidentiality protections; and
- courts, regulators, law-enforcement bodies and public authorities where disclosure is required or permitted by law.
These organisations may act as our processors or as independent controllers, depending on the service and the circumstances. We do not sell or rent personal data.
7. International transfers
Some of our service providers operate in, or make personal data accessible from, countries outside the UK. Where a restricted transfer occurs, we use an appropriate safeguard such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another lawful transfer mechanism. We also carry out any assessment required by UK data protection law.
You may contact us if you would like more information about the safeguards relevant to a particular transfer.
8. How long we keep personal data
We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including legal, accounting, security and reporting requirements. Our normal retention approach is:
- business enquiries and demonstration records: up to 24 months after the last meaningful contact, unless a business relationship continues;
- client, supplier and contractual relationship records: normally six years after the relationship ends, unless a longer period is required for a dispute or legal obligation;
- marketing contact data: until you opt out or the contact is no longer relevant; we may retain a minimal suppression record to respect an opt-out;
- website security and diagnostic logs: normally up to 12 months, or longer where required to investigate an incident;
- analytics and user-experience records: normally no longer than 24 months, subject to shorter provider settings and your cookie choices;
- data-rights requests and privacy complaints: normally six years after the matter is closed; and
- cookies: for the periods stated in the Cookie Policy.
We may retain information for longer where necessary for legal proceedings, regulatory requirements, fraud prevention or the establishment, exercise or defence of legal claims. When data is no longer required, we delete it or anonymise it.
9. Security
We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful loss, alteration, disclosure, access or use. Access is restricted to people and service providers who need the information for an authorised purpose and who are subject to appropriate obligations.
No internet-based service is completely secure. Please take care when deciding what information to send electronically.
10. Your rights
Depending on the circumstances, UK data protection law may give you the right to:
- request access to your personal data;
- ask us to correct inaccurate or incomplete data;
- ask us to erase personal data;
- ask us to restrict how personal data is used;
- receive certain personal data in a portable format;
- withdraw consent at any time where processing is based on consent; and
- object to processing based on legitimate interests.
Your right to object to direct marketing is absolute. If you ask us to stop using your personal data for direct marketing, we will do so.
These rights are not all absolute and may not apply in every case. To exercise a right, email [email protected]. We may ask for information needed to verify your identity and understand your request. We do not normally charge a fee.
11. Automated decision-making
We do not use personal data collected through the corporate website to make solely automated decisions that produce legal or similarly significant effects on you.
12. Privacy complaints
If you are concerned about how we have used your personal data, please email [email protected] with the subject line “Data protection complaint”. We will acknowledge receipt within 30 days, investigate without undue delay, keep you appropriately informed and tell you the outcome.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK supervisory authority. You can find current contact details and make a complaint at ico.org.uk/make-a-complaint, or call 0303 123 1113. We would welcome the opportunity to address your concern first, but you are not required to contact us before approaching the ICO.
13. Children's data
The corporate website is intended for business audiences and is not directed at children. We do not knowingly use it to collect personal data from children.
14. External websites
The website contains links to websites and services operated by other organisations. Their privacy notices apply when you use those services. We encourage you to review them before providing personal data.
15. Changes to this notice
We may update this notice when our services, suppliers or legal obligations change. The date at the top shows when it was last updated. Material changes will be highlighted where reasonably practicable.
16. Contact us
Email: [email protected]
Spendstream Ltd is a company registered in England and Wales under company number 16056707. Our registered office is at 167-169 Great Portland Street, 5th Floor, London, United Kingdom, W1W 5PF.