Privacy Policy

Sensitive Information. We do not process sensitive information.

Payment Data. We may collect data necessary to process your payment if you make purchases, such as your payment instrument number, and the security code associated with your payment instrument. All payment data is stored by Stripe . You may find their privacy notice link(s) here: https://stripe.com/gb/privacy .

Social Media Login Data. We may provide you with the option to register with us using your existing social media account details, like your Facebook, Twitter, or other social media account. If you choose to register in this way, we will collect the information described in the section called ‘HOW DO WE HANDLE YOUR SOCIAL LOGINS? ‘ below.

All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected

In Short: Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.

We automatically collect certain information when you visit, use, or navigate the Services. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Services, and other technical information. This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.

Like many businesses, we also collect information through cookies and similar technologies. You can find out more about this in our Cookie Notice: https://www.sowhatlabs.com/cookie_policy .

The information we collect includes:

• Log and Usage Data. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type, and settings and information about your activity in the Services (such as the date/time stamps associated with your usage, pages and files viewed, searches, and other actions you take such as which features you use), device event information (such as system activity, error reports (sometimes called ‘crash dumps’ ), and hardware settings).
• Device Data. We collect device data such as information about your computer, phone, tablet, or other device you use to access the Services. Depending on the device used, this device data may include information such as your IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, Internet service provider and/or mobile carrier, operating system, and system configuration information.
• Location Data. We collect location data such as information about your device’s location, which can be either precise or imprecise. How much information we collect depends on the type and settings of the device you use to access the Services. For example, we may use GPS and other technologies to collect geolocation data that tells us your current location (based on your IP address). You can opt out of allowing us to collect this information either by refusing access to the information or by disabling your Location setting on your device. However, if you choose to opt out, you may not be able to use certain aspects of the Services.

CRM, Customer Data and Electronic Signatures

CRM Services

As part of our Services, we provide customer relationship management (“CRM”) functionality that enables our customers to store, organise, manage and process business and personal information relating to their contacts, leads, customers, suppliers, employees and other third parties.

Information stored by customers within the CRM may include names, email addresses, telephone numbers, job titles, company details, communication records, notes, documents, attachments, tasks, activities, deal information and other data uploaded by customers.

Where our customers upload, store or process personal data using the CRM, the customer is generally the Data Controller and So What Labs acts as a Data Processor, processing such personal data solely on behalf of and in accordance with the customer’s instructions and applicable law.

Customers are responsible for ensuring that they have an appropriate legal basis for collecting, storing and processing any personal data entered into the CRM and for complying with all applicable data protection and privacy laws.

Electronic Signatures

Our Services may allow customers to create, send, sign and manage documents electronically.

In connection with electronic signature services, we may collect and process:

• Signer names and contact details;

• Electronic signature data;

• Date and time of signing;

• IP addresses;

• Device, browser and operating system information;

• Authentication and verification information;

• Audit trail and transaction records;

• Signed documents and associated metadata.

This information is collected and retained for the purpose of providing electronic signature services, verifying the authenticity and integrity of signed documents, maintaining audit records, preventing fraud, resolving disputes and complying with legal obligations.

Customer Data Ownership

Customers retain ownership of all information, documents and personal data uploaded to or stored within the Services.

We do not sell, rent or use customer CRM data for marketing purposes. We access and process customer data only as necessary to provide, maintain, secure and improve the Services, comply with legal obligations, provide customer support or as otherwise instructed by the customer.

Data Security

We implement appropriate technical and organisational measures designed to protect customer data against unauthorised access, alteration, disclosure, loss or destruction. These measures may include encryption, access controls, authentication mechanisms, monitoring systems, backup procedures and other security safeguards appropriate to the nature of the data processed.

Data Retention

Customer CRM data is generally retained for the duration of the customer’s subscription or account relationship. Upon termination of the Services, customer data may be retained for a limited period to allow data recovery, comply with legal obligations, resolve disputes, enforce agreements or maintain backup systems, after which it will be securely deleted or anonymised where reasonably practicable.

Electronic signature records, audit trails and signed documents may be retained for longer periods where necessary to establish, exercise or defend legal claims or comply with applicable legal, regulatory or contractual requirements.

Service Providers and Subprocessors

We may engage trusted third-party service providers to assist in delivering the Services, including cloud hosting providers, email delivery providers, communication providers, analytics providers, payment processors, artificial intelligence providers and customer support platforms.

Where such providers process personal data on our behalf, we require them to implement appropriate safeguards and contractual protections consistent with applicable data protection laws.

International Data Transfers

Where personal data is transferred outside the United Kingdom or European Economic Area, we will implement appropriate safeguards as required by applicable data protection laws, including the use of adequacy regulations, standard contractual clauses or other legally recognised transfer mechanisms.

Data Subject Rights

Where we process personal data on behalf of a customer as a Data Processor, requests relating to access, correction, deletion, restriction, portability or objection may need to be directed to the relevant customer acting as the Data Controller. We will provide reasonable assistance to our customers in responding to such requests where required by applicable law.


2. HOW DO WE PROCESS YOUR INFORMATION?

In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We may also process your information for other purposes with your consent.

We process your personal information for a variety of reasons, depending on how you interact with our Services, including:

• To facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order.
• To deliver and facilitate delivery of services to the user. We may process your information to provide you with the requested service.
• To respond to user inquiries/offer support to users. We may process your information to respond to your inquiries and solve any potential issues you might have with the requested service.
• To send administrative information to you. We may process your information to send you details about our products and services, changes to our terms and policies, and other similar information.
• To fulfil and manage your orders. We may process your information to fulfil and manage your orders, payments, returns, and exchanges made through the Services.
• To request feedback. We may process your information when necessary to request feedback and to contact you about your use of our Services.
• To send you marketing and promotional communications. We may process the personal information you send to us for our marketing purposes, if this is in accordance with your marketing preferences. You can opt out of our marketing emails at any time. For more information, see ‘ WHAT ARE YOUR PRIVACY RIGHTS? ‘ below.
• To deliver targeted advertising to you. We may process your information to develop and display personalised content and advertising tailored to your interests, location, and more. For more information see our Cookie Notice: https://www.sowhatlabs.com/cookie_policy .
• To protect our Services. We may process your information as part of our efforts to keep our Services safe and secure, including fraud monitoring and prevention.
• To identify usage trends. We may process information about how you use our Services to better understand how they are being used so we can improve them.
• To determine the effectiveness of our marketing and promotional campaigns. We may process your information to better understand how to provide marketing and promotional campaigns that are most relevant to you.
• To save or protect an individual’s vital interest. We may process your information when necessary to save or protect an individual’s vital interest, such as to prevent harm.