Application Privacy Policy for Fospha Limited

This Privacy Policy describes the information that we gather on, or through, our Services and how we use and process such information. For each processing purpose we will articulate the reason for requiring the data, what data we will process, the legal basis for processing the data and how long we will keep the data.

Where the legal basis of consent is to be used, it will be gathered freely, in clear, plain language that is easy to understand, and the consent can be removed at any point.

References in this Privacy Policy and on the site to “we”, “our” or “us” refer to Fospha Limited and its affiliates. References to “you” and “your” mean each natural or legal person who uses the site.

1. What Information Do We Collect About You and How Do We Use It?

We collect/process information so that we can provide the best possible experience when you utilise our Services.  This section of the policy will describe the purpose for processing your Personal Data, the legal basis to do so and how long we will keep your data.

"Personal Data" has the meaning given to it in the Data Protection Laws.

"Data Protection Laws" means any and all laws, statutes, enactments, orders or regulations or other similar instruments of general application and any other rules, instruments or provisions in force from time to time relating to the processing of personal data and privacy applicable to the performance of this Agreement, including where applicable the Data Protection Act 2018, the Regulation of Investigatory Powers Act 2000, the Privacy and Electronic Communications (EC Directive) Regulations 2003 (SI 2426/2003) and the GDPR (Regulation (EU) 2016/679), as amended or superseded.

Fospha Limited does not collect any Special Categories of Personal Data about you (such as details about your race or ethnicity, religious or philosophical beliefs, sexual orientation, or information about your health).

1.1. Our Service

Our solution provides a comprehensive framework for data-driven growth. By pseudonymising and aggregating data to protect user privacy, our in-depth analytics and performance KPI reporting deliver critical insights into customer journeys, enabling the identification of key pain points. These insights directly inform and drive targeted website optimisation efforts to significantly improve the customer experience. Furthermore, the solution empowers marketers by providing the tools to precisely measure and optimise both customer acquisition and retention activities, ensuring marketing efforts are effective and efficient. 

If you choose to use our Services, including access to the platform, email notifications, newsletters and product/service updates, you must provide us with some Personal Data so that we can provide our Services to you; this will include your name, email address and IP address. Other non-mandatory Personal Data (for example job titles) may also be gathered on an optional basis, but is not mandatory to use our product/services.

Fospha Limited will only process your personal data where there is a lawful basis for doing so. In general, unless Fospha Limited has your consent, the lawful basis will be one or more of the following:

• That the processing is necessary for the performance of a contract
• That the processing is necessary for compliance with legal obligations
• That the processing is necessary for the purposes of pursuing legitimate interests (this includes carrying out the business of providing products and services and pursuing general business interests)
• That the processing is necessary for the establishment, exercise, or defense of legal claims

Sometimes Fospha Limited may process personal data on the basis that you have provided your consent; however, you have the right to change your mind, which you can do by getting in touch with us using the contact details below. You may also opt-out of receiving marketing emails by following the instructions outlined in the email.

Fospha Limited will retain Personal Data for active customer leads or site users for a period of up to two (2) years. A lead will be active under the following circumstances:

• An email sent by Fospha Limited has not received an unknown account bounce back
• An email or contact us form has been sent to us from the data subject

1.2. Our use of Productivity Tools

If you choose to use our Service, Personal Data items such as name, email address, telephone number and other non-mandatory Personal Data may be stored in our corporate cloud application platform, corporate email platform and our help desk platform.

We will process Personal Data using two legal rationales:

1. if you are an individual and not associated with a contracted client we will use legitimate interest based upon our Terms and Conditions;
2. if you are associated with a contracted client we will use legitimate interest as the legal basis to process the data.

Our ability to retain the Personal Data will be determined by account activity, if the account is not used for over two (2) years we will delete your data. Accounts associated with contracted clients will be deleted on termination of the contract.

1.3. Cookies

Like many websites, Fospha Limited uses cookies and similar technologies to collect additional site usage data and to improve our services. Site usage information is collected using cookies to monitor aggregate site usage metrics such as total number of visitors, pages viewed, and web traffic routing on our services.

Fospha Limited will process Personal Data under the legitimate interest legal basis as we only use the data to perform aggregated tracking analysis and will not target individuals based upon this analysis. You will also need to accept our cookie policy to allow us to process the data.

Active cookie data will be retained for a period of up to one (1) year. A cookie will remain active if a user re-visits our site.

Learn more about how Fospha Limited uses cookies by visiting the cookie policy on our website.

2. Updating This Policy

Fospha Limited may change or update this Privacy Policy at any point so that it accurately reflects our services, if we believe it does not fundamentally change your data privacy rights. If we believe your rights have been affected, users will be contacted 30 days before the change is implemented. If you continue to use the site once the Privacy Policy has been updated or amended, you will be bound by the updated Privacy Policy. If you do not want to agree to any updated or amended Privacy Policy, please stop using the site.

3. Your Rights

3.1. Accessing or Rectifying your personal data

In most circumstances, before your rights can be invoked, verification as the data subject may be needed. Data will be requested from you and checked against our records before proceeding.

We want to make sure that your personal information is accurate and up to date, and you have the right to request a copy and update the Personal Data that we hold about you. You may ask us to correct or remove information you think is inaccurate. If you would like to invoke this right, please email or write to us at dp@fospha.com or DP – Fospha Limited, Scale Space, 58 Wood Lane, London, W12 7RZ.

3.2. Deletion

Based upon the retention periods described above, Personal Data will be removed from our platforms.

3.3. Object, Restrict, or Withdraw Consent

You may wish to object to or restrict our ability to process your Personal Data. This can be done either via email or in writing, using the contact details below. Further context may need to be requested to ensure the relevant tasks can be carried out to perform the request.

You can also opt out of receiving emails or updates at any point.

3.4. Portability

You may wish to port your Personal Data to another platform. If you would like to invoke this right, please email or write to us at dp@fospha.com or DP – Fospha Limited, Scale Space, 58 Wood Lane, London, W12 7RZ.

4. Who We Are And How To Contact Us

This Privacy Policy is issued on behalf of the Fospha Limited group of companies, so when we mention “Fospha Limited”, “we”, “us” or “our” in this Privacy Policy, we are referring to the relevant company in the group responsible for processing your data. Fospha Limited is the data controller and is responsible for this website.

Our company name is: Fospha Limited

Our company address is: Scale Space, 58 Wood Lane, London, W12 7RZ.

Our email address is: dp@fospha.com

5. To Whom We Disclose Information

Except as described in this Privacy Policy, Fospha Limited will not intentionally disclose the Personal Data that is collected or stored to third parties without the consent of the data subject. Information may be disclosed to third parties if you consent to us doing so, as well as in the following circumstances:

Unrestricted Information

Any information that you voluntarily choose to include in a public area of the site will be available to any visitor or user who has access to that content.

6. Service Providers

We work with third-party service providers who provide email hosting, core corporate applications, web hosting, maintenance, advertising, marketing, and other services for us. These third parties may have access to, or process Personal Data as part of providing those services for us. We limit the information provided to these service providers to that which is reasonably necessary for them to perform their functions, our contracts with them require them to maintain the confidentiality of such information, and we ensure a privacy impact assessment and data processing agreement is conducted with each third party before any Personal Data is shared to ensure privacy compliance with applicable laws at all time. An up-to-date list of our service providers can be found at the end of this policy.

6.1. Overseas transfers

The information you provide may be transferred to countries outside the UK or European Economic Area (EEA). However, we will take steps to ensure adequate protections are in place to ensure the security of your information. The EEA comprises the EU member states plus Norway, Iceland, and Liechtenstein. By submitting your information, you consent to these transfers for the purposes specified above.

We may transfer your personal information to our service providers located outside of the UK or EEA as specified in the list of service providers which can be found at the end of this policy.

All of our International service providers have each provided the information to demonstrate they have appropriate technical and organizational measures in place to safeguard Personal Data, and it shall be processed to at least the same standards as set out by the General Data Protection Regulations. Each organization has entered into Standard Contractual Clauses with Hive Learning, which is accepted by the European Commission as evidence that an adequate level of protection exists for the Personal Data in the country, territory, or organization where it is being transferred.

6.2. Non-Personally Identifiable Information

We may make non-personally-identifiable information available to third parties for various purposes. This data may be automatically-collected and would be analysed to create an aggregated view of the data, ensuring the reported information was anonymous.

6.3. Law Enforcement, Legal Process, and Compliance

We may disclose Personal Data or other information if required to do so by law or in the good-faith belief that such action is necessary to comply with applicable laws, in response to a valid court order, judicial or other government subpoena or warrant, or to otherwise cooperate with law enforcement or other governmental agencies.

6.4. Change of Ownership

Information about data subjects may be disclosed and otherwise transferred to an acquirer, successor, or assignee as part of any merger, acquisition, debt financing, sale of assets, or similar transaction, as well as in the event of an insolvency, bankruptcy, or receivership in which information is transferred to one or more third parties as one of our business assets and only if the recipient of the Personal Data commits to a privacy policy that has terms substantially consistent with this Privacy Policy.

7. Our Data Security

We have appropriate security measures in place to prevent personal information from being accidentally lost, used, or accessed in an unauthorized way, and we regularly review and maintain these measures to ensure they are always fit for purpose.

Please see our Trust Site for more information, https://trust.fospha.com

8. Complaints

If you are not happy with this privacy policy, or you wish to speak to a supervisory authority, you can contact the ICO on 0303 123 1113 or via their website www.ico.org.uk.

9. CCPA

In relation to the California Consumer Privacy Act (CCPA), we confirm the following:

• We do not sell any personal information
• We do not offer any financial incentive for your personal information
• You will not receive any discriminatory treatment by our business for exercising your privacy rights
• We will not charge you for exercising your privacy rights
• Upon receiving a request to know or a request to delete, we will confirm receipt of the request within 10 business days and provide information about how the business will process the request.
• We will respond to requests to know and requests to delete within 45 calendar days.
• We shall not disclose in response to a request to know a consumer’s Social Security number, driver’s license number or other government-issued identification number, financial account number, any health insurance or medical identification number, an account password, security questions and answers, or unique biometric data generated from measurements or technical analysis of human characteristics.
• We are able to provide the information and classification of information when responding to a Request to Know request
• We are able to delete the personal information in relation to a Request to Delete request

This Privacy Policy was last updated August 2025.

Service Providers

FiveTran: Located in San Francisco, CA, United States, with data storage on Google Cloud Platform in London, providing secure data pipelines/movement

Amazon Web Services EMEA SARL: Located in Luxembourg and London, with data storage in the AWS region eu-west-2 (UK, London), providing hosting services

Intercom R&D Unlimited Company: Located in Dublin, Ireland, with data storage in the AWS eu-west-1 region in Dublin, providing customer support services

Blenheim Chalcot IT Services India Private Limited: Located in Mumbai, India, providing application development, back-office finance and invoicing services, and helpdesk queries

HubSpot: Located in Cambridge, MA, United States, with data storage in the AWS us-east-1 region, providing CRM services

BC LTF Limited: Located in London, UK, they are used for internal company operations

Planhat AB: Located in Stockholm, Sweden, with data storage on Google Cloud Platform in Belgium and the Netherlands, providing a customer success platform