Softbetix Solutions Limited
1. Introduction
1.1 Purpose of this Notice
Softbetix Solutions Limited, a company incorporated in England and Wales with company number 17185262 and registered office at York Eco Business Centre (Office 12) Amy Johnson Way, Clifton Moor, York, England, YO30 4AG (“Softbetix”, “we”, “us”, or “our”), has prepared this Privacy Notice to explain our practices regarding the collection, use, disclosure, and protection of information that identifies or is capable of identifying individuals (“Personal Data”) obtained through our website and associated digital communications channels.
This Notice applies to visitors and users of our website and to individuals who correspond with us through associated communications channels. It does not govern:
Personal Data processing activities related to employment relationships or prospective employment candidates, which are addressed through separate documentation provided directly to affected individuals; or internal personnel data management, governed by our distinct internal policies.
1.2 Controller Identification
For the purposes of the UK General Data Protection Regulation (as retained in UK law by the European Union (Withdrawal) Act 2018, as amended; “UK GDPR”) and the Data Protection Act 2018 (“DPA 2018”), Softbetix acts as the data controller in respect of the Personal Data described in this Notice, meaning we determine the purposes and means by which your Personal Data is processed.
The Company operates as part of a corporate group structure, and Personal Data may be accessible to affiliated entities within that group structure for legitimate business purposes as further described in Section 5 below.
1.3 Contact Details
Questions, requests, or concerns regarding this Notice or our information handling practices should be directed to: Softbetix Solutions Limited
York Eco Business Centre (Office 12) Amy Johnson Way, Clifton Moor, York, England, YO30 4AG
Email: [email protected]
If you have a query relating to data protection compliance, please direct it to the contact details above and it will be handled by the appropriate member of our team.
2. Information We Collect
2.1 Information You Provide Directly
The primary means through which we obtain Personal Data is through your voluntary provision when you interact with us. This occurs when you:
– submit inquiry forms or information requests through our website;
– engage in correspondence via email, telephone, or messaging platforms;
– register for informational materials, publications, or event notifications; or
– participate in business discussions, consultations, or contract negotiations in connection with Softbetix’s software development, IT consultancy, software reselling, licensing, or support services.
2.2 Automatically Collected Information
Our digital infrastructure automatically captures certain technical data when you access our website, including device identifiers, internet protocol (IP) addresses, browser type and configuration, operating system information, navigation patterns, page visit sequences, session duration, and interaction metrics. Such data may be non-identifying in isolation but may be linked to other information to form a profile. Please also refer to our Cookies Policy for further information.
2.3 Information from Third-Party Sources
In limited circumstances, we may obtain information about you from external sources, including
– business information databases and commercial registries;
– professional networking platforms and publicly accessible directories;
– analytics service providers; and
– entities that supply market intelligence or industry data.
2.4 Voluntary Nature of Provision
You are under no legal compulsion to provide Personal Data to Softbetix. However, certain information may be necessary for us to respond to your inquiries or to establish and manage a business relationship. Failure to provide information that we request may prevent us from proceeding with your inquiry or delivering requested services.
3. Categories of Personal Data Processed
We may collect and process the following categories of Personal Data in connection with our business activities (which include bespoke software development, information technology consultancy, software reselling and licensing, and ongoing technical maintenance and support services):
Professional Identity Information: Full name, job title, professional credentials, and organisational affiliation.
Contact Information: Business telephone numbers, business email addresses, messaging platform identifiers, and correspondence addresses.
Organisational Information: Entity name, industry classification, business registration details, corporate structure information, and areas of commercial interest relevant to our software and IT services.
Correspondence Records: Content of communications exchanged through our website contact mechanisms, email systems, telephone channels, and other messaging applications.
Technical and Device Information: Hardware specifications, software configurations, unique device identifiers, IP addresses, connection metadata, and approximate geographic location indicators (where permitted).
Behavioural and Interaction Data: Website navigation patterns, feature utilisation, page visit sequences, session duration, referral sources, preferences, and settings selections. While this information may not directly identify you in isolation, it contributes to understanding user behaviour and may be associated with identifying information.
4. Purposes and Legal Bases for Processing
We process Personal Data for defined purposes, each supported by a recognised lawful basis under Article 6 of the UK GDPR:
Purpose 1: Responding to Inquiries and Pre-Contractual Steps
When you request information about our software development, IT consultancy, reselling, licensing, maintenance, or support services, we process your contact and communication data to respond appropriately and provide the information requested.
Lawful basis: Performance of pre-contractual measures taken at your request (Article 6(1)(b) UK GDPR); legitimate interests in operating our business effectively and responding to stakeholder inquiries (Article 6(1)(f) UK GDPR).
Purpose 2: Contractual Relationship Management
Where we enter into formal business agreements for the supply, resale, or licensing of software, provision of IT consultancy, or delivery of maintenance and support services, we process relevant Personal Data to fulfil our contractual obligations, coordinate activities, and manage the relationship.
Lawful basis: Performance of a contract to which you or your organisation is party, or pre-contractual measures taken at your request (Article 6(1)(b) UK GDPR); legitimate interests in managing business relationships (Article 6(1)(f) UK GDPR).
Purpose 3: Business Development and Relevant Communications
We may analyse your expressed interests, organisational profile, and interaction history to identify and communicate information about our solutions, services, or industry developments likely to be relevant to your business needs.
Lawful basis: Legitimate interests in developing our business and providing relevant information to interested parties (Article 6(1)(f) UK GDPR).
Purpose 4: Security, Fraud Prevention, and Risk Management
We process certain information to detect suspicious activities, prevent automated abuse (such as malicious bot traffic), verify the authenticity of interactions, and protect against security threats or fraudulent conduct.
Lawful basis: Compliance with legal obligations (Article 6(1)(c) UK GDPR); legitimate interests in protecting our assets, operations, and stakeholders (Article 6(1)(f) UK GDPR).
Purpose 5: Platform Administration and Technical Operations
Personal Data is processed to maintain website functionality, ensure information technology security, perform system diagnostics, manage infrastructure, and support potential corporate restructuring activities.
Lawful basis: Legitimate interests in maintaining secure and functional business operations (Article 6(1)(f) UK GDPR).
Purpose 6: Analytics and Service Improvement
We analyse usage patterns, interaction data, and feedback to improve our digital presence, refine our service offerings, better understand our audience, and enhance user experience.
Lawful basis: Legitimate interests in business improvement and maintaining competitive relevance (Article 6(1)(f) UK GDPR).
Purpose 7: Intra-Group Information Sharing
Personal Data may be shared among entities within Softbetix’s corporate group to facilitate coordinated operations, centralised support functions, compliance activities, and consolidated reporting.
Lawful basis: Legitimate interests in efficient group-wide business operations (Article 6(1)(f) UK GDPR).
Purpose 8: Direct Marketing Communications
Subject to applicable preferences and legal requirements under the Privacy and Electronic Communications Regulations 2003 (PECR) and the UK GDPR, we may send you promotional communications about solutions or services that may be of interest to you in your professional capacity. You may withdraw your consent or opt out at any time.
Lawful basis: Legitimate interests in marketing similar services to existing or prospective business contacts (Article 6(1)(f) UK GDPR); consent where required under PECR or the UK GDPR (Article 6(1)(a) UK GDPR).
5. Disclosure of Your Personal Data
5.1 Intra-Group Sharing
Personal Data is shared among entities within Softbetix’s corporate group in accordance with UK data protection law and this Notice, for purposes including operational continuity, centralised administrative functions, consolidated compliance oversight, shared technology infrastructure, legal and financial advisory coordination, regulatory reporting, and business continuity in corporate transactions. All group entities are required to maintain appropriate security safeguards.
5.2 Engagement of External Service Providers
We engage specialised third-party service providers who process Personal Data on our behalf under contractual data processing agreements that require them to protect your Personal Data appropriately. These include:
– Technology infrastructure providers, including cloud hosting, data storage, and communications platform operators;
– customer relationship management and marketing automation platforms;
– digital signature and electronic document execution services;
– analytics and audience measurement services;
– security and abuse prevention services; and
– professional advisors including legal counsel, auditors, accountants, and compliance consultants.
5.3 Other Disclosure Circumstances
We may also disclose Personal Data where required by applicable legislation, regulation, or legal process; ordered by a court or competent governmental authority; necessary to establish, exercise, or defend legal rights or interests; or involved in corporate transactions such as mergers, acquisitions, asset sales, or restructurings (subject to appropriate confidentiality protections).
6. International Transfers of Personal Data
6.1 Transfers Outside the United Kingdom
As an organisation operating in a global business environment, we may engage service providers and conduct activities in jurisdictions outside the United Kingdom. Where Personal Data is transferred to a country not subject to a UK adequacy decision, we ensure that adequate protection is in place through one or more of the following recognised mechanisms:
UK Adequacy Regulations: Transfers to countries or territories in respect of which the Secretary of State has made regulations confirming an adequate level of protection under section 17A of the DPA 2018.
International Data Transfer Agreements (IDTAs): Use of the UK IDTA approved by the Information Commissioner under section 119A of the DPA 2018, or the UK Addendum to the EU Standard Contractual Clauses, providing enforceable protections and data subject rights.
Specific Derogations: In appropriate limited circumstances, transfers based on your explicit informed consent, contractual necessity, substantial public interest considerations, or the establishment, exercise, or defence of legal claims, pursuant to Article 49 of the UK GDPR.
6.2 Further Information
For further information about the specific safeguards applicable to transfers of your Personal Data, please contact us using the details provided in Section 1.3.
7. Security Measures
We deploy technical and organisational security measures designed to protect Personal Data against unauthorised access, disclosure, alteration, or destruction. These include transport layer security for data in transit, access controls based on the principle of least privilege, organisational information security policies, and regular security assessments.
Access to Personal Data is limited to personnel and service providers with a legitimate business need. If you believe your Personal Data has been compromised or improperly accessed, please notify us immediately using the contact details in Section 1.3 so that we may investigate. We maintain incident response procedures and will notify affected individuals and the ICO as required by Article 33 and Article 34 of the UK GDPR where we detect a qualifying personal data breach.
8. Retention of Personal Data
We retain Personal Data only for as long as is necessary to fulfil the purposes described in this Notice or to comply with our legal obligations. The appropriate retention period is determined by reference to the category of information, the processing purpose, the nature of our relationship with you, statutory retention obligations, and any legitimate business needs.
Factors influencing our retention periods include contractual obligations and associated limitation periods under the Limitation Act 1980; statutory retention requirements (including those relating to tax records under the Taxes Management Act 1970 and company accounting records under the Companies Act 2006); legitimate interests in the defence of potential legal claims; and applicable regulatory guidance.
As a general guide, for most website interactions and business inquiries where no contractual relationship is established, we retain Personal Data for three (3) years from the date of last interaction. Where a contractual relationship exists, retention may extend further to satisfy specific legal and regulatory record-keeping obligations, such as HMRC requirements for financial records (currently six years from the end of the relevant financial year).
Upon expiry of applicable retention periods, Personal Data is securely deleted or anonymised in such a manner that it can no longer be attributed to an identifiable individual. You may request information about the specific retention periods applicable to your Personal Data by contacting us at the address in Section 1.3.
9. Your Rights Under UK Data Protection Law
Subject to the UK GDPR and the DPA 2018, and depending on the circumstances of processing, you may have the following rights in respect of your Personal Data:
Right of Access (Subject Access): You may request confirmation of whether we process your Personal Data and obtain a copy of it (Article 15 UK GDPR).
Right to Rectification: You may request that we correct inaccurate Personal Data or complete incomplete records (Article 16 UK GDPR).
Right to Erasure: You may request deletion of your Personal Data in specified circumstances, including where it is no longer necessary for the purposes for which it was collected (Article 17 UK GDPR). This right is subject to our legal retention obligations and any overriding legitimate grounds for processing.
Right to Restriction of Processing: You may request that we restrict processing in certain circumstances, for example while accuracy is verified (Article 18 UK GDPR).
Right to Object: You may object to processing based on legitimate interests; we will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defence of legal claims (Article 21 UK GDPR).
Right to Data Portability: Where processing is based on consent or contractual necessity and carried out by automated means, you may receive your Personal Data in a structured, commonly used, machine-readable format and request that it be transmitted to another controller (Article 20 UK GDPR).
Right to Withdraw Consent: Where processing relies on your consent, you may withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal (Article 7(3) UK GDPR).
Right to Lodge a Complaint with the ICO: You have the right to lodge a complaint with the Information Commissioner’s Office, which is the UK’s supervisory authority for data protection matters:
Information Commissioner’s Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Telephone: 0303 123 1113 Website: www.ico.org.uk
We encourage you to contact us first at the address in Section 1.3 to allow us to address your concerns directly and without delay. You may exercise any of the above rights without charge. We will respond to valid requests within one calendar month of receipt, though we may request identity verification before we are able to proceed.
10. Automated Decision-Making
We do not engage in fully automated decision-making processes that produce legal effects concerning you or that otherwise significantly affect you without human intervention, within the meaning of Article 22 of the UK GDPR.
Should you have concerns about any automated processing that may affect you, please contact us using the details in Section 1.3.
11. Updates to This Privacy Notice
This Privacy Notice may be revised periodically to reflect changes in our practices, applicable legal requirements, or operational needs. Updated versions will be published on this page with a revised Effective Date. We recommend that you review this Notice periodically to remain informed of our current practices. Where we make substantial modifications that are likely to affect your rights, we will implement additional notification measures as appropriate to ensure your awareness.