Privacy notice

Prototime Ltd (“we”, “us” and “our”) operates Spreadsheet Upgrade. This notice explains how we handle personal data when you visit our website, contact us, book an assessment, use the customer portal or receive our services.

Spreadsheet Upgrade is a trading name of Prototime Ltd.

Controller and contact details

Prototime Ltd, company number 15941295
Unit 38 John Baker Close
Llantarnam Industrial Park
Cwmbran, Wales, NP44 3AX
United Kingdom
Email: support@spreadsheetupgrade.com

For data-protection questions or requests, email us using the address above and include “Data protection” in the subject line.

Personal data we collect

• Identity and contact details, including name, work email, company and optional phone.
• Account, membership, authentication and email-alias verification information.
• Enquiries, support messages and other communications.
• Assessment answers, project requirements, uploaded files and review feedback.
• Contract, subscription, invoice and payment references. Stripe handles card details.
• Technical, security and usage records, including IP address, timestamps and audit logs.
• Cookie, currency and organisation preferences described in our cookie notice.

How we obtain personal data

Most information comes directly from you or an authorised user at your organisation. We also receive payment status and billing references from Stripe, technical information from the service and information supplied by colleagues or project contacts.

Purposes and lawful bases

• To answer enquiries and take steps requested before a contract: contract necessity and our legitimate interest in responding to prospective customers.
• To provide assessments, projects, hosting, accounts, support and billing: contract necessity.
• To secure, monitor and improve the service, prevent misuse and keep audit records: our legitimate interests in operating a safe and reliable business service.
• To maintain tax, accounting and corporate records and respond to lawful requests: legal obligation.
• To send service messages about an account, payment, project or support request: contract necessity or our legitimate interests in administering the service.

We do not sell personal data and do not use it for third-party advertising. We do not currently send marketing newsletters. If that changes, we will provide the required choice and unsubscribe controls.

When we act as a processor

Your organisation is normally the controller of personal data placed into a hosted app for its own business purposes. In that situation, we process the data on its documented instructions as a processor. Requests about that data should usually be directed to your organisation. Project data-processing terms will address confidentiality, security, subprocessors, assistance, deletion and return of data.

Service providers and disclosures

We use carefully selected providers to operate the service, including:

• Cloudflare for application hosting, security, databases and file storage.
• Stripe for checkout, subscriptions, invoices, tax calculation and payment processing.
• Resend for transactional email delivery.
• Professional advisers, insurers and authorities where reasonably necessary or required by law.

Access is limited to what is needed for each purpose. We may also disclose information in connection with a business sale, restructuring or legal claim, subject to appropriate confidentiality protections.

International transfers

Some providers may process data outside the United Kingdom. Where required, we rely on an adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses or another lawful safeguard. Contact us for more information about the safeguard relevant to your data.

Retention

• Unfinished onboarding records are normally expired after 90 days.
• Soft-deleted project files are normally purged after 30 days.
• Expired onboarding and offer tokens are normally removed after 7 days.
• Expired unaccepted invitations are normally removed after 30 days.
• Webhook payloads are normally removed after 30 days and audit events after 365 days.
• Customer, contract and financial records may be retained for the service term and up to six years afterwards where needed for legal, tax, accounting or claims purposes.

We may retain information for longer where a legal hold, dispute or statutory requirement applies. Data in backups is removed through the normal backup lifecycle.

Security

We use access controls, authenticated accounts, encryption in transit, restricted file access, audit records, backups and operational monitoring appropriate to the nature of the service. No internet service can be guaranteed completely secure, so please contact us promptly if you suspect an account or data incident.

Your rights

Subject to UK data-protection law, you may ask for access, correction, deletion, restriction or portability of your personal data, or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting earlier processing.

We may need to verify your identity and some rights are subject to legal exceptions. There is no fee in ordinary circumstances. Contact support@spreadsheetupgrade.com to make a request.

Complaints

Please contact us first so we can try to resolve your concern. You may also complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint.

Automated decisions and children

We do not use personal data to make solely automated decisions with legal or similarly significant effects. The service is for business users and is not directed at children.

Changes to this notice

We may update this notice when our services, providers or legal obligations change. The date above identifies the latest version. We will provide a prominent notice if a change materially affects how we use personal data.