Etainabl Ltd Privacy Notice

1. Who we are

Etainabl Limited (“Etainabl”, “we”, “us”, or “our”) provides a software platform to business customers. We are registered in the United Kingdom. This notice explains how we process personal data in connection with our services and our website.

Data Protection Officer: dpo@etainabl.com

ICO Registration Number: ZA921150

2. What this notice covers

This notice applies to personal data that we process in two contexts:

1. Customer content where we act as a processor. Business customers load or generate content on our platform. We process that customer content only on the documented instructions of the customer and for the purpose of providing the services.
2. Account, usage, and business contact data where we act as a controller. This includes information about users who access our services on behalf of a business customer, as well as prospects and website visitors.

We do not sell personal data. We do not use customer content for advertising or to build independent profiles. We do not use customer content to train models except where a customer has explicitly opted in.

3. Categories of data subjects

• Users of the platform who act on behalf of our business customers
• Individuals whose information may appear in documents uploaded by users
• Website visitors and business contacts

4. Personal data we process

Depending on how you interact with us, we may process the following data:

• Identification and contact data such as name and work email address
• Account and profile data such as username, role, and organisation
• Technical data such as IP address, device and browser information, and activity logs
• Business contact details such as work phone number and business postal address
• Customer content that users upload or generate in the platform, which may include personal data about third parties

We do not intentionally collect special category data. Customers should avoid uploading special category data or other sensitive data unless the data is strictly necessary and appropriate safeguards are in place.

We do not provide services to children and the platform is intended for business use only.

5. Purposes of processing and legal bases

The table below summarises why we process personal data and the corresponding legal bases under UK GDPR and EU GDPR.

Where we rely on legitimate interests, we balance our interests against the rights and freedoms of individuals and apply safeguards such as access controls, encryption, and data minimisation.

Depending on the purpose of the communication and applicable legal requirements, we may contact users and business contacts by telephone, email, SMS, MMS, WhatsApp, post, in-platform messaging or other appropriate digital communication channels. Where a particular channel requires specific consent (for example WhatsApp), we will ask for that consent separately and record it before contacting you through that channel.

Marketing communications are managed separately from service and contractual communications and are sent only where permitted under applicable data protection and electronic marketing legislation. Where required, we will obtain appropriate consent before sending marketing communications. You may withdraw consent or object to direct marketing at any time using the opt-out mechanism provided in the communication or by contacting us at the address in section 14. Your marketing preferences will not affect service or contractual communications that we need to send you.

6. Sources of personal data

We obtain personal data from the following sources:

• Directly from users or their organisation, for example when accounts are created, services are configured, or data is uploaded to the platform.
• Automatically through use of the services, including logs, telemetry, and usage data generated when users interact with the platform.
• From third-party identity providers, such as single sign-on providers, where enabled by the customer.
• Customer data (comprising name, contact details, usage data and meter details (including serial numbers, MPRN, MPANs, meter addresses and billing data)) from Fidelity Energy Limited where a Fidelity Energy customer wishes to receive our services.
• From industry data sources and market operators, where authorised by the customer or permitted under applicable law, for the purpose of accessing and validating energy and utility information. These sources may include:
  • Electralink, for electricity market messaging and data flows
  • Xoserve, for gas market data and related services
  • ECOES (Electricity Central Online Enquiry Service), for electricity meter point administration data

Data obtained from these sources may include meter identifiers, supply addresses, consumption-related metadata, and associated business contact information. We process this data only for the purposes instructed by the customer and in accordance with applicable data protection laws.

7. Customer content and our role as processor

Customer content is processed only to deliver the service features selected by the customer, for example document parsing and automated data extraction. Customer content may include data retrieved from authorised third-party industry systems (such as electricity and gas market operators) where access is initiated by or on behalf of the customer. We do not access customer content except as necessary to provide support or to meet legal obligations. The customer is responsible for ensuring that it has the appropriate authority, permissions, and legal basis to request and provide such data to us for processing via the platform.

Our Data Processing Addendum forms part of our customer agreements and sets out our processor commitments, including confidentiality, security, sub-processor controls, and international transfer mechanisms. The customer is the controller for customer content and determines the retention period for that content.

8. Sub processors and sharing

We use trusted service providers that process personal data on our behalf. We require sub processors to meet appropriate security and privacy standards and we have contracts in place with each of them.

Current core sub processors:

• Amazon Web Services (AWS), cloud hosting and infrastructure. Services used include SES for transactional email, S3 for object storage, and CloudWatch for logs and monitoring. Hosted in the AWS Europe (Ireland) region.
• Digital Ocean, cloud hosting and infrastructure. Primary region UK.
• MongoDB Atlas, managed database service hosted on AWS in the Europe (Ireland) region.
• Auth0, identity and access management, including login, SSO, and MFA. Hosted in the EU region as configured by the customer.
• Freshdesk, customer support platform for tickets and support communications.
• Mixpanel, product analytics for usage metrics and feature adoption.
• Sentry, error tracking and performance monitoring.
• Twilio, SMS delivery for multi factor authentication and service alerts.
• Google Maps Platform (Geocoding), address lookup and geocoding.
• Google Email, communication with customers which may include attachments containing data.
• Atlassian Jira, project management and engineering ticketing. We instruct staff not to paste customer content into tickets unless necessary for support.
• We may also engage additional providers for email delivery, analytics, support, or similar business services. A current list of sub processors is available upon request and will be incorporated into our Data Processing Addendum. We will notify customers in advance of any material changes where required by our agreement.
• We may disclose personal data to professional advisers and authorities where necessary to comply with law or to protect our legal rights. We do not sell personal data.

9. International transfers

Our platform and customer content are hosted on AWS in Ireland, within the European Economic Area. Transfers of personal data from the UK to the EEA are covered by the UK adequacy regulations for EEA countries. Where we transfer personal data outside the UK or EEA, we use recognised transfer mechanisms such as the UK International Data Transfer Addendum, the EU Standard Contractual Clauses, or an adequacy decision. For sub processors with data centres in the EU or UK, we configure regional processing where possible.

10. Security

We apply technical and organisational measures appropriate to the risk, including:

• Encryption at rest and in transit
• Password protected databases with IP allowlisting and role based access controls
• Logging and monitoring
• Vulnerability management and regular updates
• Backups and resilience
• Staff training and confidentiality undertakings
• Incident response procedures including breach notification in accordance with applicable laws.

11. Retention

We keep personal data only for as long as necessary for the purposes described in this notice or as required by law. Typical retention periods are:

• Account data: for the term of the customer contract plus up to 12 months
• Activity and maintenance logs: most back end logs are stored for no more than 30 days
• Database backups: retained for up to 1 year
• Billing records: up to 7 years to meet legal obligations

Customers control the retention of their customer content stored in the platform. Upon contract termination we will delete or return customer content in line with our agreement and backup cycles.

12. Cookies and similar technologies

We use cookies and similar technologies to operate and secure the service, and to understand usage. Where required, we will present consent controls. For details, see our Cookie Notice.

13. Your rights

Depending on your location and subject to applicable law, you may have the right to request access, rectification, erasure, restriction, or portability of your personal data, and to object to processing where we rely on legitimate interests. Where processing is based on consent, you can withdraw consent at any time.

To exercise your rights, contact us using the details above. We will verify your identity and respond within statutory timeframes. You also have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner’s Office at ico.org.uk.

14. How to contact us

If you have questions about this notice or our data practices, contact dpo@etainabl.com. All privacy and data protection issues should be sent to this address. If you are an end user, please contact your organisation first regarding customer content because they control that data.

15. Changes to this notice

We may update this notice to reflect changes to our practices or legal requirements. We will post the updated version with a new effective date and, where appropriate, provide additional notice to customers.