Privacy Policy

1. Who we are

This policy explains how Clause 60 Limited ("we") handles personal data for which we are the controller. We are registered in England and Wales (company no. 17317413), registered office 33 Firbank, Euxton, Chorley, PR7 6HP, and registered with the UK Information Commissioner's Office (registration no. ZC194083). Data protection contact: dataprotection@clause60.com.

2. Scope — what this policy does and doesn't cover

This policy covers personal data we control: account users, prospective customers, and website visitors. It does not cover the client documents you upload to the Service ("Customer Content"), where we act as your processor — that processing is governed by our Data Processing Agreement (DPA) and your instructions, not this policy.

3. What we collect

  • Account data: name, work email, organisation, role, and authentication data (we store passwords only as secure hashes; MFA secrets).
  • Usage and technical data: log data, actions in the Service, IP address, device/browser information.
  • Billing data: billing contact and payment records (card details are handled by our payment processor, not stored by us).
  • Communications: enquiries, support messages, and sales correspondence.

4. Lawful bases

We rely on: contract (to provide the Service and manage your account and billing); legitimate interests (to secure, operate and improve the Service, prevent misuse, and for limited business-to-business marketing to relevant professionals — balanced against your rights); consent where required (e.g. optional marketing, which you can withdraw at any time); and legal obligation (e.g. accounting records).

5. How we use personal data

To provide, secure and support the Service; to authenticate users; to process payments; to communicate about your account and service matters; to comply with legal obligations; and, on a legitimate-interests or consent basis, to send occasional relevant updates.

6. Who we share it with

We share personal data only with service providers acting on our behalf under contract, including our hosting and infrastructure provider (Google Cloud), our email/productivity provider (Microsoft), and our payment processor (Stripe). A current list of sub-processors is at clause60.com/trust. We do not sell personal data. We may disclose data where required by law.

7. Where your data is held (international transfers)

Account and Service data is stored and processed in the UK. AI processing is performed in the EU (Google Cloud) on the UK's adequacy footing. Where any provider processes data outside the UK/EU, we rely on appropriate safeguards (e.g. the UK International Data Transfer Addendum).

8. How long we keep it

We keep account and usage data for the duration of your relationship with us and for a reasonable period afterwards to meet legal, accounting and security needs; billing records are kept for the period required by law. Customer Content retention is governed by the DPA. Broadly, Customer Content is retained for the duration of your engagement and for 12 months after a project is completed, in line with our Retention & Deletion Policy.

9. How we protect it

Data is encrypted in transit and at rest; every organisation is isolated at the database level; multi-factor authentication is mandatory; access is least-privilege and audit-logged. The Service is independently penetration-tested by a CREST-certified firm and Cyber Essentials certified.

10. AI and your data

Our AI processing is performed via Google Cloud Vertex AI. The model is stateless and your data is not used to train AI models.

11. Your rights

You have the right to access, correct, erase, restrict or object to processing of your personal data, to data portability, and to withdraw consent. To exercise any right, contact dataprotection@clause60.com. Where we act as processor (Customer Content), rights requests from data subjects should be directed to the relevant customer (controller), whom we will assist.

12. Cookies

Our site uses only essential cookies needed to operate and secure the Service.

13. Changes

We may update this policy; the effective date above shows the latest version, and we will notify you of material changes.

14. Complaints

If you have a concern, please contact us first at dataprotection@clause60.com. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).