Privacy Policy

COLDLOG PRIVACY POLICY Version 1.1, effective 4 October 2026 1. WHO WE ARE ColdLog is a trading name of Woodins Cooling Services Ltd, company number 13548284, whose registered office is 36 Ryeland Way, Kingsnorth, Ashford, Kent, TN25 7FU. For privacy enquiries contact info@woodinscoolingservices.co.uk. 2. THE TWO WAYS COLDLOG HANDLES PERSONAL DATA There are two main categories of personal data within ColdLog. Data for which ColdLog is controller. We act as controller for personal data we collect for our own business purposes, such as: - account details; - account administrators; - subscription details; - billing information; - usage and security information; - support communications; and - records showing acceptance of legal terms. Customer Data. Customer companies may enter personal data about staff, engineers, customers, site contacts, suppliers and other individuals. For that information, the customer company will generally be the controller and ColdLog acts as processor on its behalf under the Data Processing Agreement. If your personal information appears inside a company's ColdLog account because you work for, deal with or are a customer of that company, you should normally contact that company first regarding your data. 3. INFORMATION WE COLLECT AND WHY We may process: User name, email address and login information. Purpose: creating and administering accounts and enabling users to sign in. Lawful basis: performance of a contract and our legitimate interests in operating the service. Company name, account contact details and billing email. Purpose: administering the customer relationship and subscription. Lawful basis: performance of a contract. Subscription status, invoices and payment history. Purpose: managing subscriptions, accounting and taxation. Lawful basis: performance of a contract and legal obligations. Records of Terms acceptance. This may include user identity, company, Terms version, date and time of acceptance, and related account identifiers. Purpose: demonstrating contractual acceptance and managing our legal relationship. Lawful basis: legitimate interests. Technical and security information. This may include login times, device information, error logs, IP-related security information, usage information and security events. Purpose: security, fraud prevention, troubleshooting and service improvement. Lawful basis: legitimate interests. Support messages. Purpose: responding to enquiries and providing customer support. Lawful basis: legitimate interests and performance of a contract where relevant. 4. PAYMENT INFORMATION Subscription payments are processed through Stripe. ColdLog does not normally receive or store complete payment-card details. Stripe may process personal data for payment processing, fraud prevention, regulatory compliance and other purposes described in its own privacy documentation. Depending on the processing involved, third-party providers may act either as processors on our behalf or as independent controllers for certain purposes. 5. PROVIDERS WE USE ColdLog relies on third-party service providers, which may include: Base44. Used for application hosting, database functionality, file storage, authentication, application infrastructure, email functions and automated or AI-related features. Data is stored on Base44's servers in the United States. Stripe. Used for subscription payments, invoices and billing administration. Postcodes.io. May be used to process a postcode for location or borough lookup functions. Only information required for the lookup is sent. We may introduce, replace or remove providers as the service develops. 6. INTERNATIONAL DATA TRANSFERS Data held in ColdLog is stored on Base44's servers in the United States, and some other service providers may also store or process personal data outside the United Kingdom. Where personal data is transferred outside the United Kingdom, we take steps intended to ensure that an appropriate lawful transfer mechanism or safeguard is in place in accordance with applicable UK data protection law. Such mechanisms may include: - adequacy regulations; - recognised contractual safeguards; - UK-approved international data transfer terms; - applicable transfer addenda; or - another lawful transfer mechanism. Further information regarding the safeguards applying to a particular provider is available on request. 7. HOW LONG WE KEEP INFORMATION Retention periods vary depending on the type of information and our legal obligations. We currently expect to retain: Account information. While the account is active and normally for up to 90 days following closure, unless longer retention is reasonably required. Customer subscription and billing records. Normally for up to six years where required for accounting or tax purposes. Technical and security logs. Normally for up to 12 months, although particular security records may be retained longer where reasonably required to investigate fraud, abuse, incidents or legal disputes. Legal acceptance records. May be retained for the life of the customer relationship and afterwards for a reasonable period to establish or defend legal claims. 8. SECURITY We use technical and organisational measures designed to protect personal data. These may include: - individual user accounts; - role-based access controls; - logical separation between customer organisations; - encrypted transmission; - access restrictions; - security monitoring; - controlled administrative functions; and - third-party infrastructure security. No software platform or internet service can guarantee complete security. If we become aware of a personal data breach affecting Customer Data, we will act in accordance with our obligations under applicable data protection law and our Data Processing Agreement. 9. DATA STORED ON USER DEVICES Certain ColdLog features may temporarily store or cache application data on a user's device, including where offline functionality is used. Users and customer businesses are responsible for securing devices used to access ColdLog. The exact information stored locally may vary depending on device, browser, operating system, ColdLog functionality and the underlying technology platform. ColdLog does not use locally stored operational data for third-party advertising. 10. YOUR DATA PROTECTION RIGHTS Depending on the circumstances, UK data protection law may give you rights to: - request access to personal data we hold about you; - request correction of inaccurate information; - request deletion of personal data; - request restriction of processing; - object to certain processing; - receive certain personal data in a portable format; and - complain about how your personal data is handled. These rights do not apply in every circumstance and may be subject to legal exemptions. To exercise a right, contact info@woodinscoolingservices.co.uk. We will normally respond within one month, subject to applicable data protection law. You also have the right to complain to the Information Commissioner's Office. 11. MARKETING We do not sell personal data. We do not provide customer personal data to third parties for unrelated advertising purposes. If we introduce optional marketing communications, recipients will be given any opt-out rights required by law. 12. CHANGES TO THIS PRIVACY POLICY We may update this Privacy Policy from time to time. We will publish revised versions within ColdLog or on the relevant website. Where a change is significant, we may also notify account administrators by email or within the application.