Privacy notice

Last updated: ⟨date of launch⟩

This notice explains how Demonstrandum uses personal information about the people who use Probatum, our compliance workspace. It covers you whether you work for one of our clients or for Demonstrandum.

Who we are

Probatum is run by Demonstrandum Ltd, a company registered in England and Wales (number 12559941), based in Sheffield. Registered office: ⟨confirm: address⟩. We are registered with the Information Commissioner's Office, registration number ⟨confirm: ICO number⟩.

For anything about your information, email info@demonstrandum.co.uk.

Two kinds of information

1. Information about you as a user. Your account, your sign-in and what you do in Probatum. Demonstrandum decides how this is used, so we are its controller, and this notice covers it.
2. What your organisation puts into its workspace. For example, its staff list, suppliers, systems and risks. We hold this for your organisation and use it only to provide Probatum, under our agreement with them. Your organisation is its controller, so its own privacy notice covers it. Ask your organisation about it first; we will help them answer you.

What we hold about you

• Your account: your name, email address and role, and the organisation you belong to.
• Sign-in security: your password, stored only in a scrambled (hashed) form we can't read. Also your two-step sign-in setup, and records of sign-in attempts used to block guessing.
• Your sessions: when you signed in, and the device and network address you used.
• What you do: documents you approve (with your name, role and the date), notes and evidence you record, changes you make to controls, and invitations you send or accept.
• Demonstrandum staff only: a record each time you open a client's workspace, which that client can rely on.
• Emails we send you: invitations, password links and deadline reminders, and whether they were sent.

We don't use cookies for advertising or analytics. Probatum sets only the cookies it needs to keep you signed in and to remember a trusted device, so it doesn't ask for cookie consent.

Why we use it, and the legal basis

• To run Probatum for your organisation: your account, sign-in and the records of what you do. Our basis is our legitimate interests, and your organisation's, in providing a working, accountable compliance workspace.
• To keep it secure: sign-in limits, session records and the staff access record. Our basis is our legitimate interests in protecting your organisation's information. Where the law requires security measures, it is also a legal obligation.
• To send service emails: these are part of the service, so again our basis is legitimate interests. We don't send marketing from Probatum.

We don't make decisions about you by automated means alone.

Who else handles it

We use a few companies to run Probatum. Each acts only on our instructions, under a written contract:

• Vercel Inc. hosts the application (⟨confirm: region⟩).
• Prisma Data, Inc. hosts the database (⟨confirm: region⟩).
• Resend, Inc. sends Probatum's emails.

Some of these companies are based in the United States, so your information may be handled there. Where it leaves the UK, we rely on the safeguards UK law provides, such as the UK International Data Transfer Agreement or Addendum, or the UK Extension to the Data Privacy Framework where the company is certified.

Otherwise we share your information only where the law requires it, such as with a regulator or the police.

How long we keep it

• Password links: last one hour.
• Invitations: last seven days.
• Your account and the records of what you did: kept for as long as your organisation uses Probatum, and for ⟨confirm: six years⟩ after. These records are your organisation's evidence of compliance, and the period matches the time in which a claim can be brought.
• After that: deleted, or anonymised so they no longer identify you.

Probatum is built so that evidence can't be quietly changed. If something about you needs correcting or removing sooner, we redact it: the content is replaced, and a note records who did it and when.

Your rights

You can ask us to:

• give you a copy of your information;
• correct it;
• delete or redact it;
• restrict how we use it, or object to our using it; or
• give it to you in a format you can pass on, where that applies.

Email info@demonstrandum.co.uk. We'll reply within one month. Some rights have limits; for example, we may need to keep an approval record your organisation relies on as evidence. If so, we'll explain why.

If you're unhappy with how we've used your information, please tell us first, so we can put it right. You can also complain to the Information Commissioner's Office: ico.org.uk/make-a-complaint, or 0303 123 1113.

Changes

If we change this notice, we'll update the date at the top. If a change affects you, we'll tell you in Probatum or by email.