Privacy Notice

This Privacy Notice explains how StoreTech Limited collects, uses, stores and protects personal information in connection with the StoreTech and Flexicount websites, our business relationships, our hosted services and, where applicable, our technology deployments.

It is intended to explain our approach under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR), as amended, and other applicable UK data-protection legislation.

2. Scope of this notice

This notice may apply to you if you are:

• a visitor to a StoreTech or Flexicount website;
  
• somebody who contacts us or submits an enquiry;
  
• a customer, prospective customer, supplier or business partner;
  
• an employee or representative of one of our customers, suppliers or partners;
  
• an authorised user of a StoreTech or Flexicount platform or service;
  
• somebody whose name or other limited personal information appears in an operational service record, such as a service check-in;
  
• or, where relevant, a person whose information is processed as part of a customer deployment.

Not all sections will apply to everyone.

Where StoreTech processes personal information solely on behalf of one of our customers, that customer may be responsible for providing additional privacy information relating to that particular service or deployment.

3. What we mean by personal information

Personal information is information relating to an identified or identifiable individual.

It may include information such as a person's name, email address, telephone number, business contact details, platform username or records associated with an identifiable user.

Information which has been genuinely anonymised so that an individual cannot reasonably be identified is not personal information.

Many StoreTech sensor outputs are intended to provide anonymous operational information, such as counts, occupancy levels, usage events or activity measurements. Other parts of our services may involve limited personal information, and those situations are described below.

4. Information we may collect

Depending on your relationship with us, we may collect the following categories of information.

Contact and business information

This may include your:

• name;
  
• company or organisation;
  
• job title or business role;
  
• business email address;
  
• telephone number;
  
• country;
  
• business type;
  
• and details contained in an enquiry or correspondence.

Website enquiry information

When you complete a website form, we may collect the information you choose to provide, including details about your organisation, the services you are interested in and any operational problem or opportunity you want to discuss.

Customer and contract information

We may hold information necessary to manage a customer or partner relationship, including contact details, correspondence, quotations, agreements, service records, invoicing information and account-management notes.

Platform user information

Where you are provided with access to a StoreTech or Flexicount service, we may process information such as:

• your name;
  
• business email address or username;
  
• company;
  
• user role or permissions;
  
• account or authentication information;
  
• usage or audit information;
  
• and support correspondence.

Customer-user information may also be maintained within our Microsoft 365 and SharePoint environment.

Support information

If you contact us for technical or customer support, we may retain information about the issue, correspondence, contact details and actions taken.

Website and technical information

Depending on your cookie choices and the services enabled on the relevant website, we may collect information such as:

• IP address;
  
• browser and device information;
  
• pages visited;
  
• approximate location derived from technical information;
  
• referral source;
  
• interaction with website content;
  
• and analytics or campaign information.

Marketing information

Where appropriate, we may record information about enquiries, customer interests and engagement with our business communications. HubSpot is used to help us manage information arising from marketing and business-development activity.

Operational and service records

Some StoreTech services may record service activity.

For example, a digital service check-in may record:

• a member of staff's name or first name;
  
• the location;
  
• the date and time;
  
• and the service or action recorded.

The exact information depends on the customer's agreed configuration.

5. How we obtain personal information

We may obtain information:

directly from you when you complete a form, email us, speak to us, request a quotation, enter into an agreement or use one of our services;

from your employer or another organisation where it asks us to create an account or provide you with access to a service;

from a customer where we process operational information on that customer's behalf;

from our websites and associated analytics technologies, subject to applicable cookie and consent requirements;

and from systems and services used in the delivery, administration and security of our services.

We do not buy consumer mailing lists for general marketing activity.

6. Why we use personal information and our lawful bases

The lawful basis we use depends on the purpose for which information is processed.

Where we rely on legitimate interests, those interests may include operating and developing our business, servicing customers, maintaining relationships, improving our services, securing our systems and communicating with business contacts about relevant products and services.

We consider whether those interests are compatible with the rights and reasonable expectations of the individuals concerned.

Where StoreTech acts solely as a processor on behalf of a customer, the customer determines the lawful basis for that processing.

7. StoreTech sensors and operational data

StoreTech provides technology that helps organisations understand how people, spaces and services are being used.

Depending on the deployment, this may include technologies for:

• footfall and people counting;
  
• occupancy measurement;
  
• presence and activity sensing;
  
• workspace utilisation;
  
• meeting-room utilisation;
  
• washroom usage;
  
• service demand;
  
• customer or user feedback;
  
• alerts and operational workflows;
  
• service requests;
  
• and digital proof-of-service records.

The technology selected depends on the operational requirement.

Anonymous sensor outputs

Many StoreTech sensors produce operational measurements rather than information intended to identify an individual.

Examples may include:

• the number of people entering or leaving;
  
• current or historic occupancy;
  
• room or area usage;
  
• presence or activity events;
  
• device or facility usage events;
  
• threshold events;
  
• and aggregated trends.

Where this information cannot reasonably be linked to an identifiable individual, it is anonymous information rather than personal data.

Optical sensors and on-device processing

Some people-counting and occupancy technologies use optical sensing or imaging technology in order to detect and count people.

Where these technologies are used, visual processing takes place on the device or within the customer's site/store network.

Video data is not transmitted from the site/store network to the StoreTech hosted platform.

The information transmitted to StoreTech is generally the resulting operational information, such as counts, occupancy values, events or alerts, rather than video footage.

The precise technical characteristics may vary by sensor type and deployment.

Presence and activity sensors

Wireless or connected sensors may record events such as presence, activity, opening/closing or device usage.

These measurements are generally used to understand operational demand rather than to identify a person.

Service check-ins and records

Some workflows may involve identifiable service personnel.

For example, a cleaner or service employee may record a digital check-in. Depending on the customer's configuration, this may contain the employee's name or first name together with a time, location and service record.

Where such information is processed for a customer, StoreTech will normally process it in accordance with that customer's instructions and the applicable contractual arrangements.

Feedback and service requests

QR feedback or other service-interaction tools may allow users to submit feedback or request assistance.

Information may be anonymous, or an individual may choose or be required to provide contact information depending on the service design.

Users should avoid including unnecessary sensitive personal information in free-text feedback.

Additional customer-specific analytics

Some customer deployments may include additional analytics or integrations.

Where a deployment creates additional privacy considerations, these should be assessed as part of the agreed service design, contractual arrangements and, where necessary, a customer-specific privacy notice or Data Protection Impact Assessment.

8. Privacy by design

We aim to design StoreTech services so that the amount of personal information processed is proportionate to the operational purpose.

This includes considering whether a requirement can be achieved using anonymous or aggregated information rather than identifiable personal information.

Where sensing technology can produce an operational measurement without the transmission of images or identity information, this is generally preferred.

We also consider privacy, access controls, data flows, retention and customer responsibilities during the design and deployment of relevant services.

UK data-protection law requires appropriate data-protection measures to be considered from the design stage and throughout processing activities.

9. When StoreTech is a controller and when it is a processor

StoreTech Limited may act in different roles depending on the processing activity.

StoreTech as controller

StoreTech will generally act as controller where we decide why and how personal information is used for our own business purposes.

This includes areas such as:

• website enquiries;
  
• our own customer and supplier contacts;
  
• business administration;
  
• account management;
  
• our own marketing;
  
• website analytics;
  
• security;
  
• and regulatory compliance.

StoreTech as processor

For some customer services, the customer determines why personal information is processed and StoreTech processes that information on the customer's behalf.

In those circumstances, the customer is normally the controller and StoreTech is normally the processor.

We process information in accordance with the customer's documented instructions and the relevant contractual terms.

Where required, our contracts include appropriate data-processing provisions dealing with matters including confidentiality, security, sub-processors, individual rights, deletion or return of information and assistance with compliance obligations.

The UK GDPR requires a written contract where a controller appoints a processor.

Customers remain responsible for determining their own lawful basis for processing, providing appropriate privacy information to affected individuals and obtaining any permissions required for their particular use of the service.

10. Privacy information at customer sites

This website Privacy Notice does not replace any privacy information that may be required at an individual customer location.

Where a customer deployment involves personal information, the customer may need to provide employees, visitors or other affected individuals with appropriate information about the processing.

Depending on the service, this may be provided through:

• employee or workplace privacy notices;
  
• building signage;
  
• notices near a sensor or service point;
  
• QR-linked privacy information;
  
• or other appropriate communications.

StoreTech can provide customers with relevant technical information about the Flexicount service to support their transparency and data-protection obligations.

11. Website cookies and analytics

Our websites may use cookies and similar technologies for essential website functions, analytics and, where applicable, marketing or business-development purposes.

We currently use or may use services including:

Google Analytics, to understand website use and performance;

HubSpot, to help manage business-development and marketing activity;
and Semrush, for search-engine optimisation and website-performance analysis where applicable.

Where a technology requires consent under PECR or data-protection law, non-essential storage or tracking technologies should only be used after the appropriate consent has been obtained.

Visitors must be able to make a genuine choice about non-essential cookies. The ICO's current guidance states that non-essential cookies must not simply be set before the user has consented and that continuing to browse is not sufficient consent.

Our Cookie Policy provides or will provide further details of the cookies and similar technologies used, their purpose, provider and duration.

You may also control cookies using your browser settings and any cookie preference tools made available on our websites.

12. Marketing communications

We do not currently operate a general consumer email newsletter.

Where somebody contacts StoreTech or Flexicount about our products or services, we may retain their business contact details and follow up about the enquiry.

We may also contact existing customers and relevant business contacts regarding products, services or developments that we reasonably believe may be relevant to their professional role, where permitted by law.

We apply the rules of the UK GDPR and PECR to direct marketing.

The rules differ depending on whether a recipient is a corporate subscriber or an individual subscriber such as a sole trader or certain partnerships.

Where consent is legally required, we will obtain consent before sending the relevant marketing.

You have the right to object to direct marketing at any time.

If you tell us that you do not wish to receive marketing communications, we will stop sending them. We may retain a minimal suppression record so that we can respect your preference in future.

13. Who we share personal information with

We do not sell personal information.

Where necessary, information may be shared with organisations that help us operate our business and provide our services.

These may include:

Rackspace, which provides infrastructure used to host the core StoreTech and Flexicount service;

Microsoft, including Microsoft 365, SharePoint and Power BI;

HubSpot, for customer, enquiry and marketing-related information;

Google, where services such as Google Analytics are used;

Semrush, where relevant to our website and SEO activity;

technical suppliers, contractors and service providers involved in delivering or supporting a customer service;

professional advisers such as accountants, legal advisers, insurers or auditors;

government bodies, regulators, law-enforcement authorities or courts where disclosure is required or permitted by law;

and a purchaser, investor or adviser involved in a legitimate corporate transaction, subject to appropriate confidentiality and data-protection arrangements.

Service providers are only given access to information that is appropriate for the service they provide.

Where a supplier acts as our processor, we require suitable contractual and security arrangements.

14. Where information is stored and international transfers

The core StoreTech and Flexicount hosted platform operates on Rackspace virtual infrastructure hosted in the United Kingdom.

Customer operational data held within our core platform is therefore hosted in the UK.

However, some third-party services that we use, including cloud productivity, analytics, CRM or support technologies, may involve access to or processing of personal information outside the United Kingdom.

Where a restricted international transfer takes place, we take steps to ensure that an appropriate lawful transfer mechanism applies.

Depending on the circumstances, this may include:

• UK adequacy regulations;
  
• the UK's International Data Transfer Agreement;
  
• the UK Addendum to approved standard contractual clauses;
  
• or another lawful safeguard or exception.

Where appropriate safeguards are relied upon, UK rules require organisations to consider whether the standard of protection after transfer is not materially lower than the protection available in the UK.

You may contact info@storetech.com if you would like further information about the safeguards relevant to a particular transfer.

15. How long we keep personal information

We do not keep personal information for longer than it is reasonably required for the purpose for which it was collected, subject to contractual, legal, regulatory and security requirements.

The exact retention period depends on the information and the circumstances.

Where personal data is no longer required, it will be deleted, anonymised or otherwise securely disposed of as appropriate.

Anonymous statistical or operational information may be retained for longer because it is not personal information.

16. Information security

StoreTech Limited takes the security of customer and personal information seriously.

StoreTech maintains Cyber Essentials certification covering StoreTech and the Flexicount brand.

We use appropriate technical and organisational measures designed to protect information against unauthorised access, alteration, disclosure, loss, destruction or other unlawful processing.

These measures include controls relating to:

• access to systems and information;
  
• authentication and user permissions;
  
• secure system configuration;
  
• software and security updates;
  
• malware protection;
  
• network security;
  
• backups and resilience;
  
• system monitoring;
  
• and management of service providers.

Access to personal information is restricted to authorised personnel and suppliers who require it for legitimate business purposes.

Our security measures are reviewed in light of the nature of the information, the technology involved and the level of risk.

UK GDPR requires organisations to apply security measures appropriate to the risks of their processing rather than a single standard security model.

No electronic system can be guaranteed to be completely secure, but we take reasonable and proportionate steps to manage and reduce risk.

17. Personal data breaches

StoreTech maintains processes for identifying, investigating and responding to security incidents and suspected personal-data breaches.

Where StoreTech acts as a processor for a customer, we will notify and assist the relevant customer in accordance with applicable contractual and legal requirements.

Where StoreTech is controller and a personal-data breach must be reported to the ICO or affected individuals, we will do so in accordance with applicable data-protection law.

18. Automated processing and decision-making

StoreTech technology may automatically process operational information to create measurements, dashboards, alerts or notifications.

For example, a service threshold may generate an alert when a specified occupancy or usage level is reached.

These operational alerts are intended to assist people in making decisions.

StoreTech and Flexicount do not currently use personal information to make solely automated decisions about individuals which produce legal or similarly significant effects.

If this changes, we will provide appropriate information about the processing and the safeguards available.

19. Special-category information

StoreTech and Flexicount do not intentionally collect special-category personal information as part of our normal website, sales or standard Operational Intelligence services.

Special-category information includes information such as health information, racial or ethnic origin, religious or philosophical beliefs, biometric data used for identification, trade-union membership or information about a person's sex life or sexual orientation.

Customers and website users should not include this type of information in free-text forms, feedback or service records unless there is a legitimate requirement and appropriate arrangements have been agreed.

20. Children

Our websites, platforms and commercial services are intended for organisations and business users and are not directed at children.

We do not knowingly collect personal information directly from children for marketing or account-management purposes.

Anonymous footfall, occupancy or usage measurements in public or commercial environments may naturally include people of different ages, but such services are not designed to identify children.

If a specific customer deployment is intended to process personal information relating to children, appropriate additional safeguards and privacy considerations must be assessed before the service is introduced.

21. Your data-protection rights

Depending on the circumstances and the lawful basis for processing, you may have rights including:

Access - to ask whether we hold personal information about you and obtain a copy.

Rectification - to ask us to correct inaccurate or incomplete information.

Erasure - to ask us to delete personal information in circumstances where the law gives you this right.

Restriction - to ask us to restrict how information is used in certain circumstances.

Objection - to object to particular processing based on legitimate interests.

Data portability - in certain circumstances, to obtain information you supplied to us in a portable format or ask for it to be transferred.

Withdrawal of consent - where processing is based on consent, you may withdraw your consent at any time. Withdrawal does not affect processing that was lawful before consent was withdrawn.

You also have an unconditional right to object to the use of your personal information for direct marketing.

Not every right applies to every processing activity.

Where StoreTech is processing information solely as a processor for one of our customers, we may need to refer your request to the relevant customer, because they are the controller responsible for the information.

To exercise a data-protection right, contact:

info@storetech.com

We may need to verify your identity before responding to a request.

We will respond within the time limits required by applicable data-protection law.

22. Data-protection complaints

If you have concerns about how StoreTech or Flexicount has used your personal information, please contact us.

You can make a data-protection complaint by emailing:

info@storetech.com

Please mark the subject Data Protection Complaint where possible.

We will take reasonable steps to investigate the issue, acknowledge a complaint within the period required by law and respond without undue delay.

The Data (Use and Access) Act introduced additional requirements for organisations to facilitate data-protection complaints; ICO guidance says organisations must acknowledge a complaint within 30 days and respond without undue delay.

You also have the right to complain to the Information Commissioner's Office. You do not need to complain to us first.

The ICO's current contact details are:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

Information Commissioner's Office

23. Links to other websites

Our websites may contain links to websites or services operated by other organisations.

StoreTech is not responsible for the privacy practices of independent third-party websites.

We recommend reviewing the relevant organisation's privacy information before providing personal information through an external website.

24. Changes to this Privacy Notice

We may update this Privacy Notice from time to time to reflect changes to our services, technology, suppliers, legal requirements or data-protection practices.

The latest version will be published on our websites and the Last updated date at the top of the notice will be changed.

Where a change materially affects how we use existing personal information, we will take appropriate steps to bring that change to the attention of affected individuals before the new processing begins where required.

25. Contact us

For questions about this Privacy Notice, our use of personal information, your rights or a data-protection complaint, please contact:

StoreTech Limited
C/o Thorne Lancaster Parker
5th Floor, Palladium House
1–4 Argyll Street
London
W1F 7TA
United Kingdom

Email: info@storetech.com

Company number: 03509775

ICO registration reference: ZB860616