Hub Privacy Policy

This Privacy Policy explains how Hub collects, uses and protects personal data across our websites and application at hub.radley.pro (the "Service"). Hub is operated by Radley Capital & Futures Limited ("Radley", "we", "us", or "our"), a company registered in England and Wales. This policy should be read alongside our Cookie Policy, which describes more fully how we use cookies and similar technologies. For the purposes of UK data protection law, including the UK General Data Protection Regulation and the Data Protection Act 2018, Radley is the controller of the personal data described in this policy unless we say otherwise below.

There is an important distinction in how Hub works that shapes the rest of this policy. When you visit our marketing pages, create an account, sign in or pay for a subscription, we decide how and why your personal data is used, and we are the controller of that data. But Hub is a multi-tenant application in which our customers build their own workspaces, sites, forms and chat widgets, and load their own records into them. Where a customer uploads or collects personal data inside their workspace, that customer is the controller of it and Radley acts only as a processor on their instructions. If you are an individual whose data appears inside somebody else's Hub workspace, that organisation is responsible for telling you how your data is used, and you should direct your questions and requests to them rather than to us. We will assist our customers in responding to you, but we cannot act on your data without their instruction.

We collect personal data in three broad ways. You give some of it to us directly, when you create an account, contact us, subscribe to a paid tier or fill in a form on our site. This typically includes your name, email address, workspace name, job title or role, billing details and any information contained in messages you send us. We collect some of it automatically when you use the Service, including your IP address, device and browser type, operating system, referring pages, the pages and features you use, timestamps and diagnostic or error data. And we receive a limited amount from third parties who provide services to us, such as our payment processor confirming that a transaction succeeded, or an authentication provider confirming your identity where you sign in through one.

We use this data for a defined set of purposes, and under UK data protection law we must have a lawful basis for each. We process your account and sign-in data to provide the Service, keep you securely logged in and route you to the correct workspace, and we do this because it is necessary to perform our contract with you. We process billing and transaction data to take payment, issue invoices and maintain accounting records, which is necessary both for our contract with you and to comply with our legal obligations under UK tax and company law. We process usage, device and diagnostic data to keep the Service secure, prevent fraud and abuse, diagnose faults and improve how Hub works, and we do this on the basis of our legitimate interests in running a reliable and secure product, having satisfied ourselves that this does not override your rights. We process the contents of your enquiries in order to respond to you, again on the basis of our legitimate interests in answering people who contact us. Where we send marketing about Hub, we do so either with your consent or, where you are an existing customer and the message concerns similar services, on the basis of our legitimate interests, and you may opt out at any time. Where we place non-essential cookies or analytics, we rely on your consent, as described in our Cookie Policy.

We do not sell your personal data, and we do not share it with third parties for their own marketing purposes. We do share it with a limited number of service providers who help us operate the Service, including cloud hosting and infrastructure providers, payment and billing processors, analytics providers, email and communications providers and security and monitoring tools. These providers act on our instructions under written contracts that restrict what they may do with the data. We may also share personal data with our professional advisers, such as accountants, auditors or solicitors, where necessary, and with law enforcement, regulators or other authorities where we are legally required to do so or where it is necessary to establish, exercise or defend legal claims. If Radley is involved in a merger, acquisition, restructuring or sale of assets, personal data may be transferred as part of that transaction, and we will notify you if it becomes subject to a materially different privacy policy as a result.

Some of our service providers are located outside the United Kingdom, which means your personal data may be transferred to and processed in other countries. Where we make such a transfer, we ensure an appropriate safeguard is in place, which will usually be either a determination by the UK government that the destination country provides an adequate level of protection, or the International Data Transfer Agreement or the UK Addendum to the European Commission's Standard Contractual Clauses. You can request further detail about the safeguards applying to a particular transfer by contacting us at the address at the end of this policy.

We keep personal data only for as long as we need it. Account and workspace data is retained for the life of your account and for a reasonable period afterwards to allow for reactivation, dispute resolution and backup cycles, after which it is deleted or anonymised. Billing and transaction records are retained for at least six years from the end of the relevant financial year in order to meet our obligations under UK tax and company law. Support correspondence is retained for as long as needed to handle the matter and for a reasonable period afterwards. Usage and diagnostic logs are retained for a shorter period, typically no more than twelve months, unless a longer period is needed to investigate a security incident. Where you have asked us to stop sending marketing, we retain a minimal record of that request so we can continue to honour it.

We take the security of personal data seriously and maintain technical and organisational measures appropriate to the risk, including encryption in transit, access controls, authentication requirements and monitoring. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and for the security of any data you or your users choose to load into a Hub workspace. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office and, where required, you.

You have a number of rights over your personal data. You have the right to be told how your data is used, which is the purpose of this policy, and the right to request a copy of the personal data we hold about you. You have the right to have inaccurate data corrected and, in certain circumstances, the right to have data erased, to restrict how we use it or to object to our processing of it, including where we rely on legitimate interests. Where we process data by automated means on the basis of your consent or our contract with you, you have the right to receive it in a portable format or to ask us to transmit it to another provider. Where we rely on your consent, you may withdraw it at any time, although this does not affect the lawfulness of anything done before you withdrew it. You can exercise any of these rights by contacting us at the address below, and we will respond within one month, though we may need to verify your identity first and may extend that period where a request is particularly complex. Exercising these rights is free of charge in almost all cases.

We do not use your personal data to make decisions about you by wholly automated means that produce legal effects or similarly significant effects. The Service is not directed at children, and we do not knowingly collect personal data from anyone under the age of 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

If you are unhappy with how we have handled your personal data, we would prefer that you raise it with us first so we have the chance to put it right. You also have the right to complain to the Information Commissioner's Office, the UK supervisory authority for data protection, at ico.org.uk or on 0303 123 1113. Raising a concern with us does not affect your right to complain to the ICO at any time.

We may update this Privacy Policy from time to time to reflect changes in how we handle personal data or for other operational, legal or regulatory reasons. Any changes will be posted on this page with a revised "last updated" date, and where the changes are material we will take reasonable steps to notify you directly. We encourage you to review this page periodically.

If you have any questions about this Privacy Policy, wish to exercise any of your rights or would like further information about how we handle personal data, please contact us at hello@radley.pro. Hub is operated by Radley Capital & Futures Limited.