Privacy Policy
1. Who we are
CertiFast is provided by Cloud Enterprise Software Limited, registered in England and Wales (company number 07369867), registered office at The Copper Room, Deva City Office Park, Trinity Way, Manchester, M3 7BG. We are the data controller for the personal data described in this policy.
Contact: hello@cloudenterprise.co.uk
2. What data we collect
- Contact details you give us.
- Account and usage data when you use CertiFast, including login details, actions taken in the platform, and the files you upload as part of your compliance evidence.
- Technical data collected automatically when you visit our website, such as IP address, browser type, and device information.
3. How we use your data
- To manage communications.
- To provide, maintain, and improve the CertiFast platform.
- To send relevant updates. You can opt out at any time.
- To meet our legal and regulatory obligations.
4. Sharing your data
We do not sell your data. We share it only with:
- Service providers who help us run CertiFast, including cloud hosting (Microsoft Azure) and our AI provider OpenAI, which processes document content to generate scores, drafts, and recommendations.
- Authorities, where we are legally required to.
5. Where your data is stored
Your data is stored on Microsoft Azure infrastructure in the United Kingdom. Where any provider is based outside the UK or EEA, we put appropriate safeguards in place.
6. How long we keep your data
We keep your data for as long as you have an active account, and for 6 years afterward to meet legal and audit requirements, after which it is deleted or anonymised.
7. Your rights
Under UK GDPR, you have the right to access, correct, delete, or restrict the use of your data, and to complain to the Information Commissioner’s Office (ico.org.uk). Contact hello@cloudenterprise.co.uk to exercise any of these rights.
8. Changes to this policy
We may update this policy from time to time. The current version, with its last updated date, will always be available on this page.
Data Protection Policy
1. Purpose
This policy sets out how Cloud Enterprise Software Limited protects the personal and business data that we and our customers put into CertiFast.
2. Our approach
- We collect and process only the data needed to deliver the service.
- Access to data is role-based, so staff and systems only see what they need for their function.
- Customer data is encrypted in transit and at rest.
- Each customer’s data is isolated (multi-tenant architecture with per-organisation access controls), so one organisation cannot access another’s data.
3. Roles and responsibilities
Our privacy team is responsible for data protection compliance and can be contacted at hello@cloudenterprise.co.uk.
4. Third parties and sub-processors
We use vetted third parties, including cloud hosting and AI processing providers, under written contracts requiring them to protect data to the same standard we apply ourselves. A current list of sub-processors is available on request.
5. Security measures
- Encryption of data at rest and in transit.
- Access controls and authentication on all accounts.
- Regular review of who has access to what.
- An incident response plan covering any suspected breach, including notifying affected customers and, where required, the ICO within 72 hours.
6. Data breaches
If a breach occurs that risks your rights or your data, we will notify you and, where required by law, the ICO, without undue delay.
7. Staff training
Staff with access to customer data receive data protection training appropriate to their role.
8. Review
This policy is reviewed at least annually.