Privacy Policy
Last Updated: 25th August 2025
Version: 1.0
Navigation
1. Introduction and Controller Information2. Legal Basis and Regulatory Framework3. Personal Information We Collect4. Cookies and Tracking Technologies5. How We Use Your Personal Information6. Information Sharing and Disclosure7. International Data Transfers8. Data Retention and Deletion9. Your Rights and How to Exercise Them10. Regional Privacy Rights11. Children's Privacy12. Data Security Measures13. Automated Decision-Making and Profiling14. Third-Party Integrations and Links15. Marketing and Communications16. Data Quality and Accuracy17. Privacy by Design and Default18. Updates to This Privacy Policy19. Contact Information and Privacy Support20. Definitions and Legal Terms21. Effective Date and Legal Validity
1. Introduction and Controller Information
This Privacy Policy explains how EzAz Automations Limited ("EzAz," "we," "our," or "us") collects, uses, processes, and protects your personal information when you use our automation marketplace platform.
Data Controller Details:
- Legal Name: EzAz Automations Limited
- Company Number: [TO BE INSERTED]
- Registered Address: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
- Data Protection Officer: Chris Snowden
- Privacy Contact: dpo@ezaz.io
IMPORTANT: This Privacy Policy should be read alongside our Terms and Conditions. By using our Platform, you acknowledge you have read and understood how we handle your personal information.
2. Legal Basis and Regulatory Framework
2.1 Applicable Laws
We comply with:
- UK General Data Protection Regulation (UK GDPR)
- Data Protection Act 2018
- Privacy and Electronic Communications Regulations (PECR)
- California Consumer Privacy Act (CCPA) for US users
- Other applicable international privacy laws
2.2 Data Controller vs Processor Roles
- EzAz as Controller: For user accounts, platform operations, marketing, and analytics
- EzAz as Processor: For Creator-Customer communications and certain custom services
- Joint Controllers: With payment processors for transaction data
3. Personal Information We Collect
3.1 Information You Provide Directly
Account Registration:
- Full name and email address (required)
- Username/handle (required)
- Password (hashed and encrypted)
- Profile photograph/avatar (optional)
- Professional information: bio, website, LinkedIn profile (optional)
Creator-Specific Information:
- Tax identification numbers (UTR, VAT registration)
- Bank account details and payment information
- Business registration details
- Professional certifications and qualifications
- Marketing preferences and referral tracking
Transactional Information:
- Billing addresses and contact information
- Purchase history and transaction records
- Payment method details (tokenized via Ryft)
- Refund and dispute information
Content and Communications:
- Templates, Apps, Bundles, and associated documentation
- Blog posts, comments, and community contributions
- Reviews, ratings, and feedback
- Support tickets and correspondence
- Job postings and project bids
3.2 Information Automatically Collected
Technical Data:
- IP address and geolocation data
- Device type, operating system, and browser information
- Session identifiers and authentication tokens
- Platform usage patterns and navigation data
- Error logs and diagnostic information
Analytics and Tracking Data:
- Page views, click-through rates, and engagement metrics
- Search queries and result interactions
- Time spent on platform features
- Conversion funnel and user journey data
- A/B testing participation and results
3.3 Information from Third Parties
Payment Processors (Ryft):
- Payment verification and fraud detection data
- Transaction success/failure information
- Chargeback and dispute details
Analytics Providers:
- Google Analytics 4: Demographics, interests, device data
- HubSpot: Marketing engagement and lead scoring data
- Social media platforms: Profile information if you connect accounts
Public Sources:
- Business registration verification data
- Professional network information for verification purposes
4. Cookies and Tracking Technologies
4.1 Essential Cookies (Always Active)
- Purpose: Platform functionality and security
- Examples: Session management, authentication, fraud prevention, load balancing
- Legal Basis: Legitimate interests (platform operation)
- Retention: Session duration or as technically required
4.2 Analytics Cookies
- Purpose: Understanding user behavior and platform improvements
- Providers: Google Analytics 4, internal analytics
- Legal Basis: Consent (can be disabled)
- Retention: Up to 26 months
- Opt-out: Available via cookie preferences or browser settings
4.3 Marketing Cookies
- Purpose: Campaign measurement and personalized marketing
- Providers: HubSpot, Google Ads (if applicable)
- Legal Basis: Consent (can be disabled)
- Retention: Up to 24 months
- Opt-out: Available via cookie preferences or unsubscribe
4.4 Cookie Management
- Cookie preference center available on first visit
- Browser-level controls respected
- Regular cookie audit and inventory updates
- Third-party opt-out mechanisms provided
5. How We Use Your Personal Information
5.1 Primary Processing Purposes
Service Provision (Contract Performance):
- Account creation and management
- Transaction processing and order fulfillment
- Content delivery and access management
- Customer support and dispute resolution
- Platform security and fraud prevention
Business Operations (Legitimate Interests):
- Platform improvements and feature development
- Usage analytics and performance optimization
- Business intelligence and reporting
- Regulatory compliance and legal obligations
Marketing Communications (Consent):
- Newsletter and promotional emails
- Product announcements and updates
- Personalized recommendations
- Marketing campaign measurement
5.2 Legal Bases Under UK GDPR
- Consent: Marketing communications, non-essential cookies, optional features
- Contract: Service provision, account management, payment processing
- Legal Obligation: Tax reporting, regulatory compliance, legal requests
- Legitimate Interests: Analytics, security, platform improvements, fraud prevention
- Vital Interests: Emergency situations requiring immediate action
5.3 Automated Decision-Making
We use automated processing for:
- Fraud detection and prevention
- Content recommendation algorithms
- Pricing optimization
- Risk assessment for payments
Your Rights: You can request human review of automated decisions that significantly affect you.
6. Information Sharing and Disclosure
6.1 Service Providers (Data Processors)
Payment Processing:
- Ryft Pay Ltd (Global, Privacy Shield certified)
- Purpose: Transaction processing, fraud prevention
- Data Shared: Payment details, transaction history
- Safeguards: Data Processing Agreement, adequate protections
Technology Infrastructure:
- Supabase Inc. (EU/UK data centers)
- Purpose: Database hosting and management
- Data Shared: All platform data (encrypted)
- Safeguards: Data Processing Agreement, encryption
Analytics and Marketing:
- Google LLC (Global, adequacy decision)
- HubSpot Inc. (Global, Privacy Shield successor framework)
- Purpose: Analytics, marketing automation
- Data Shared: Usage data, contact information
- Safeguards: Data Processing Agreements, privacy controls
Communication Services:
- Email service providers (TBD - recommend EU provider)
- Purpose: Transactional and marketing emails
- Data Shared: Email addresses, communication preferences
- Safeguards: Data Processing Agreement, GDPR compliance
6.2 Legal Disclosures
We may disclose personal information when required by law:
- Court orders and legal processes
- Regulatory investigations (ICO, ASA, etc.)
- Law enforcement requests with proper authority
- Protection of rights, property, or safety
- Prevention of fraud or illegal activities
Process: We review all requests for legal validity and narrow scope before disclosure.
6.3 Business Transfers
In the event of merger, acquisition, or asset sale:
- Users will be notified via email and platform notice
- Successor entity must honor existing privacy commitments
- Users may have rights to object or withdraw consent
- Data minimization principles applied to transfers
6.4 Public Information
The following information is publicly visible by design:
- Creator profiles (name, bio, professional links)
- Published Templates, Apps, and Bundles with descriptions
- Product reviews and ratings (with username)
- Blog posts and community contributions
- Team memberships and collaboration history
7. International Data Transfers
7.1 Transfer Mechanisms
- Adequacy Decisions: Transfers to countries deemed adequate by UK/EU authorities
- Standard Contractual Clauses: EU/UK approved contracts for adequate protection
- Binding Corporate Rules: For multinational organizations with approved rules
- Derogations: Specific situations allowing transfers (consent, contract performance)
7.2 Specific Transfer Details
United States:
- Google Analytics: Covered by adequacy decision and additional safeguards
- Stripe: Privacy Shield successor framework and contractual protections
- HubSpot: Standard Contractual Clauses and additional privacy controls
Other Jurisdictions:
- Individual assessment for each processor
- Documented transfer impact assessments
- Regular review of political and legal developments
7.3 Your Rights Regarding Transfers
- Right to be informed about transfer safeguards
- Right to object to transfers in certain circumstances
- Right to complain to supervisory authorities
- Right to effective judicial remedies
8. Data Retention and Deletion
8.1 Retention Principles
- Data Minimization: Only retain what's necessary
- Purpose Limitation: Delete when purpose fulfilled
- Storage Limitation: Regular review and deletion cycles
- Legal Requirements: Comply with statutory retention periods
8.2 Specific Retention Periods
Active User Accounts:
- Personal information: Retained while account active
- Usage analytics: 26 months maximum
- Marketing data: Until consent withdrawn
Closed User Accounts:
- Account recovery period: 30 days
- Personal information: Deleted after recovery period
- Published content: Remains available per licensing terms
- Comments/reviews: May be anonymized or retained
Financial and Legal Records:
- Transaction records: 7 years (UK tax law requirement)
- Legal correspondence: Until matter resolved + 3 years
- Regulatory reporting: As required by applicable law
- Dispute records: 6 years from resolution
Technical Data:
- Security logs: 12 months
- Error logs: 6 months
- Backup systems: 90 days rolling retention
8.3 Automated Deletion Processes
- Regular automated purging of expired data
- Manual review for complex retention scenarios
- Secure deletion using industry-standard methods
- Documentation of deletion activities for compliance
9. Your Rights and How to Exercise Them
9.1 Your Legal Rights
Right of Access (Article 15):
- Request copies of your personal information
- Information about processing purposes and recipients
- Details of retention periods and automated decision-making
- How to exercise: Email dpo@ezaz.io with identification
Right to Rectification (Article 16):
- Correct inaccurate personal information
- Complete incomplete personal information
- How to exercise: Account settings or contact support
Right to Erasure (Article 17):
- Request deletion of personal information in specific circumstances
- Note: Some information may be retained for legal compliance
- How to exercise: Account deletion or privacy request
Right to Restrict Processing (Article 18):
- Limit how we process your information in specific situations
- How to exercise: Contact dpo@ezaz.io with specific request
Right to Data Portability (Article 20):
- Receive your data in structured, machine-readable format
- Transfer data to another controller where technically feasible
- How to exercise: Data export request via support
Right to Object (Article 21):
- Object to processing based on legitimate interests
- Object to direct marketing (absolute right)
- Object to automated decision-making
- How to exercise: Contact dpo@ezaz.io or use opt-out links
9.2 Exercising Your Rights
Verification Process:
- Identity verification required for all requests
- Additional verification for sensitive requests
- Authorized representatives accepted with proper documentation
Response Timeframes:
- Standard response: 30 days
- Complex requests: May extend to 60 days with notification
- Urgent requests prioritized where appropriate
No Fee Policy:
- Rights requests are free of charge
- Manifestly unfounded or excessive requests may incur reasonable fees
- Repeated identical requests may be declined
9.3 Complaints and Supervisory Authorities
UK Supervisory Authority:
- Information Commissioner's Office (ICO)
- Website: ico.org.uk
- Phone: 0303 123 1113
- Email: casework@ico.org.uk
EU Supervisory Authorities:
- Contact your local data protection authority
- European Data Protection Board (edpb.europa.eu) for cross-border complaints
Internal Complaints:
- Contact our Data Protection Officer: dpo@ezaz.io
- Internal complaint resolution within 30 days
- Escalation to senior management if unresolved
10. Regional Privacy Rights
10.1 California Residents (CCPA/CPRA)
Right to Know:
- Categories of personal information collected
- Purposes for collection and use
- Categories of third parties we share with
- Specific pieces of personal information collected
Right to Delete:
- Request deletion of personal information
- Exceptions for legal compliance and business operations
Right to Opt-Out:
- We do not sell personal information
- Right to opt-out of targeted advertising
- Right to limit sensitive personal information use
Right to Non-Discrimination:
- No discrimination for exercising privacy rights
- No denial of services or different pricing
10.2 Other US State Laws
We comply with privacy laws in:
- Virginia Consumer Data Protection Act (VCDPA)
- Colorado Privacy Act (CPA)
- Connecticut Data Privacy Act (CTDPA)
- Other applicable state privacy laws
10.3 International Compliance
- Canada (PIPEDA): Consent requirements and access rights
- Brazil (LGPD): Data subject rights and processing limitations
- Australia (Privacy Act): Australian Privacy Principles compliance
- Other jurisdictions: Local privacy law compliance where applicable
11. Children's Privacy
11.2 Parental Rights and Controls
Parents/guardians of users under 18 may:
- Review their child's personal information
- Request correction or deletion of data
- Withdraw consent for data processing
- Receive notifications about data practices
- Contact us at dpo@ezaz.io for assistance
11.3 Special Protections
- Enhanced verification for users claiming to be under 16
- Restricted data processing for users under 18
- No behavioral advertising to users under 18
- Regular review of age verification processes
12. Data Security Measures
12.1 Technical Safeguards
Encryption:
- TLS 1.3 for data in transit
- AES-256 encryption for data at rest
- End-to-end encryption for sensitive communications
- Regular encryption key rotation
Access Controls:
- Multi-factor authentication for all admin accounts
- Role-based access control (RBAC)
- Principle of least privilege
- Regular access reviews and de-provisioning
Infrastructure Security:
- Web Application Firewall (WAF)
- DDoS protection and rate limiting
- Regular security scanning and penetration testing
- Secure development lifecycle practices
12.2 Organizational Safeguards
Staff Training:
- Regular privacy and security training
- Data protection impact assessments
- Incident response procedures
- Confidentiality agreements for all staff
Vendor Management:
- Due diligence on all data processors
- Contractual security requirements
- Regular security assessments
- Incident notification requirements
Audit and Monitoring:
- Continuous security monitoring
- Regular security audits and assessments
- Compliance monitoring and reporting
- External security certifications where appropriate
12.3 Data Breach Response
Detection and Assessment (0-24 hours):
- Automated monitoring systems
- Incident response team activation
- Initial impact assessment
- Containment measures implementation
Notification Requirements (24-72 hours):
- ICO notification within 72 hours if high risk
- Affected individuals notified without undue delay
- Clear, plain language communication
- Ongoing updates as investigation continues
Remediation and Prevention:
- Root cause analysis
- System hardening and improvements
- Process improvements
- Regular review of incident response procedures
13. Automated Decision-Making and Profiling
13.1 Automated Systems We Use
Fraud Detection:
- Purpose: Prevent fraudulent transactions and account abuse
- Logic: Risk scoring based on transaction patterns and device information
- Consequences: Transaction blocking or additional verification requirements
- Human review: Available upon request
Content Recommendations:
- Purpose: Personalize user experience and improve engagement
- Logic: Machine learning algorithms based on user behavior and preferences
- Consequences: Customized content display and suggestions
- Human review: Not applicable (no significant impact)
Pricing Optimization:
- Purpose: Dynamic pricing for platform services
- Logic: Market analysis and demand-based algorithms
- Consequences: Variable pricing within defined parameters
- Human review: Available for pricing disputes
13.2 Your Rights Regarding Automated Decisions
- Right to be informed about automated decision-making
- Right to human intervention for significant decisions
- Right to challenge automated decisions
- Right to receive explanation of decision logic
- Right to request reconsideration
14. Third-Party Integrations and Links
14.1 Automation Platform Integrations
We integrate with third-party platforms (HubSpot, Make, Zapier, etc.):
- Data sharing: Limited to necessary integration data
- User control: You control what data is shared through integrations
- Third-party policies: Subject to their respective privacy policies
- Responsibility: We are not responsible for third-party data practices
14.2 External Links and Services
Our platform may contain links to external websites:
- No control: We do not control external websites
- No responsibility: External sites have their own privacy policies
- User caution: Review privacy policies before providing information
- Notification: External links are clearly marked where possible
14.3 Social Media Integration
If you connect social media accounts:
- Limited access: We only access publicly available information
- User control: You can disconnect accounts at any time
- Data use: Social data used only for profile enhancement
- Third-party terms: Subject to social media platform policies
15. Marketing and Communications
15.1 Types of Communications
Transactional (No Opt-Out):
- Account confirmation and security alerts
- Purchase confirmations and receipts
- Platform updates affecting your account
- Legal and compliance notifications
Marketing (Opt-Out Available):
- Newsletter and product announcements
- Promotional offers and discounts
- Educational content and webinars
- Surveys and feedback requests
15.2 Communication Preferences
Granular Controls:
- Separate preferences for different communication types
- Frequency controls where available
- Channel preferences (email, platform notifications)
- Easy unsubscribe mechanisms
Opt-Out Methods:
- Unsubscribe links in all marketing emails
- Account settings for communication preferences
- Direct contact with support team
- Automated processing of unsubscribe requests
15.3 Marketing Analytics
Email Marketing:
- Open rates, click-through rates, and engagement metrics
- A/B testing for content optimization
- Behavioral segmentation for personalization
- Spam compliance monitoring
Behavioral Targeting:
- On-platform behavior analysis for content personalization
- No cross-site tracking without explicit consent
- Regular review of targeting accuracy and relevance
16. Data Quality and Accuracy
16.1 Our Responsibilities
- Implement reasonable measures to ensure data accuracy
- Provide mechanisms for users to update their information
- Regular data quality audits and cleansing
- Correction of inaccuracies when identified
16.2 User Responsibilities
- Provide accurate information during registration
- Update information when circumstances change
- Report inaccuracies through appropriate channels
- Verify information before relying on platform data
16.3 Data Verification Processes
- Email verification for account registration
- Identity verification for high-value transactions
- Business verification for Creator accounts
- Regular prompts to review and update profile information
17. Privacy by Design and Default
17.1 Design Principles
- Proactive not Reactive: Privacy considerations built into system design
- Privacy as the Default: Most privacy-friendly settings by default
- Full Functionality: Privacy protections without compromising functionality
- End-to-End Security: Comprehensive security throughout data lifecycle
17.2 Implementation Examples
- Minimal data collection by default
- Strong privacy settings for new accounts
- Regular privacy impact assessments
- User-friendly privacy controls and settings
17.3 Continuous Improvement
- Regular review of privacy practices
- User feedback incorporation
- Technology updates for enhanced privacy
- Industry best practice adoption
18. Updates to This Privacy Policy
18.1 Amendment Process
Significant Changes:
- 30 days advance notice via email
- Clear highlighting of material changes
- Option to object or withdraw consent
- Continued use constitutes acceptance
Minor Updates:
- Platform notification of updates
- Updated "Last Modified" date
- No action required from users
- Updated policy available on platform
18.2 Version Control
- All versions dated and archived
- Previous versions available upon request
- Change log maintained for transparency
- Regular review and update schedule
18.3 User Notification Methods
- Direct email to registered users
- Platform notifications and banners
- Social media announcements for major changes
- Website notice for minimum required period
19. Contact Information and Privacy Support
19.1 Privacy Team Contacts
Data Protection Officer: Chris Snowden
Email: dpo@ezaz.io
Our Data Protection Officer and privacy team handle:
- General privacy inquiries
- Data subject rights requests
- GDPR-related matters
- Privacy compliance oversight
Response Times:
- Initial response within 48 hours
- Complex matters resolved within 30 days
- All requests require identity verification
19.2 Business Contact Information
EzAz Automations Limited
- Registered Address: 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom
- Company Number: [TO BE INSERTED]
- General Contact: hello@ezaz.io
19.3 Supervisory Authority Information
UK - Information Commissioner's Office:
- Website: ico.org.uk
- Phone: 0303 123 1113
- Address: Wycliffe House, Water Lane, Wilmslow, SK9 5AF
- Online complaint form available
EU - European Data Protection Board:
- Website: edpb.europa.eu
- Find your local supervisory authority
- Cross-border complaint mechanisms
20. Definitions and Legal Terms
20.1 Key Definitions
- Personal Data: Any information relating to an identified or identifiable individual
- Processing: Any operation performed on personal data (collection, use, storage, etc.)
- Data Controller: Entity that determines purposes and means of processing
- Data Processor: Entity that processes data on behalf of a controller
- Consent: Freely given, specific, informed indication of agreement
- Legitimate Interests: Processing necessary for legitimate interests pursued by controller
20.2 Technical Terms
- Encryption: Process of encoding information to prevent unauthorized access
- Anonymization: Process of removing personally identifiable information
- Pseudonymization: Processing that prevents identification without additional information
- Data Minimization: Principle of collecting only necessary personal data
21. Effective Date and Legal Validity
This Privacy Policy is effective as of 25th August 2025.
- Legal Status: This Privacy Policy forms part of our Terms and Conditions and constitutes a legally binding agreement.
- Precedence: In case of conflict between language versions, the English version takes precedence.
- Jurisdiction: This Privacy Policy is governed by English law and subject to the jurisdiction of English courts.
IMPORTANT NOTICE: This Privacy Policy describes our current privacy practices. We are committed to transparency and will continue to update our practices in line with legal requirements and industry best practices. If you have any questions or concerns about your privacy, please don't hesitate to contact our privacy team.
Document Control:
- Classification: Public
- Owner: Data Protection Officer
- Review Frequency: Annual or as required
- Next Review Date: 25th August 2026