Privacy Policy

1. Who we are

GIMLabs is run by SoTech Studio Limited (”GIMLabs”, “we”, “us”), registered in England and Wales, company number 13906561, at Cedar Barn, White Lodge, Walgrave, Northampton, NN6 9PY.

This policy explains how we handle personal data when you visit our websites, sign up, use the GIMLabs platform (our web apps, mobile apps, Excel add-in, API, QGIS plugin and documentation), or contact us. It applies wherever you are, and is written to meet the UK GDPR, the Data Protection Act 2018 and, for people in the European Economic Area (EEA), the EU General Data Protection Regulation (EU GDPR).

2. Our two roles

We handle personal data in two different ways, and the rules differ for each.

If you are a member of a customer’s team, your organisation is the controller of its project data. Questions about that data, including requests to see or delete it, are best sent to your organisation first. We will help them answer.

3. The personal data we collect

• Identity and contact data: your name, job title, employer, work email address and phone number.
• Account data: your login details (we store passwords only as secure hashes), your role and settings, such as your timezone, date and number formats.
• Billing data: your organisation’s billing contact, address and VAT number, and records of payments. Card details are taken and held by our payment processor, Stripe; we never see or store your full card number.
• Support and correspondence: what you tell us when you contact us, and our replies.
• Technical data: IP address, browser and device type, and the pages and features you use, collected when you use our websites and apps.
• Signup data: the details you give on our signup form, including your company’s country, and the country we detect from your connection, which we use to spot mistyped or unusual signups.
• Marketing preferences: whether you want to hear from us.

We do not intentionally collect special category data (such as health data) about you. Our services are for businesses and are not aimed at children.

4. Why we use it, and our legal basis

Where we rely on legitimate interests, we have weighed them against your rights. You can object at any time (see section 9).

We never sell personal data, and we never use your organisation’s project data to train AI models without its opt-in.

5. Who we share it with

We share personal data only with:

• Our subprocessors, the service providers that host and run the Services for us, such as cloud hosting, our database, payments and email. They are listed, with where they process data, on our Subprocessors page. Each is bound by a contract that requires them to protect the data and use it only to provide their service to us.
• Professional advisers, such as our accountants and lawyers, where needed.
• Authorities, where the law requires it.
• A buyer or successor, if our business or its assets are sold, under the same protections.

6. Where your data is held

GIMLabs runs in the United Kingdom: our application hosting and file storage are in London. Our database is hosted in Ireland, in the European Economic Area. Product analytics are processed in the EU.

Some subprocessors are based in, or may access data from, other countries, including the United States. Where personal data moves between the UK, the EEA and other countries, we protect it as section 7 describes.

7. International transfers

• Between the UK and the EEA. The UK and the EU recognise each other’s data protection as adequate, so personal data can move between them without extra safeguards.
• To other countries. Where personal data goes to a country without such recognition, we use the safeguards the law provides: the European Commission’s Standard Contractual Clauses (SCCs), the UK International Data Transfer Agreement or the UK Addendum to the SCCs, or a recipient’s certification under the EU-US Data Privacy Framework and its UK Extension.

You can ask us for a copy of the safeguards that apply.

8. How long we keep it

Backups are overwritten on a rolling basis, so deleted data leaves our backups shortly after it leaves our live systems.

9. Your rights

Under UK and EU data protection law you have the right to:

• Access the personal data we hold about you
• Correct it if it is wrong
• Erase it, where there is no good reason for us to keep it
• Restrict our use of it
• Object to our use of it, including to direct marketing at any time
• Port it: receive it in a usable format, or have it sent to someone else
• Withdraw consent, where we rely on it, without affecting what we did before

To use any of these rights, email privacy@gimlabs.io. We will reply within one month. It is free, unless a request is clearly unfounded or excessive. We may need to confirm your identity first.

10. Complaints

We would like the chance to put things right, so please contact us first at privacy@gimlabs.io.

You also have the right to complain to a data protection regulator:

• In the UK: the Information Commissioner’s Office (ICO), ico.org.uk.
• In the EEA: the supervisory authority in the country where you live or work, or where you think the problem happened. The European Data Protection Board lists them at edpb.europa.eu.

11. Security

We protect personal data with encryption in transit and at rest, access controls, and audit logs of who changes what. Our Data Processing Agreement sets out these measures in more detail. If a personal data breach puts your rights at risk, we will tell you and the relevant regulator as the law requires.

12. Changes to this policy

We will update this policy when the way we handle personal data changes, and change the date at the top. If a change materially affects you, we will tell you by email before it takes effect.

13. Contact

SoTech Studio Limited, Cedar Barn, White Lodge, Walgrave, Northampton, NN6 9PY, United Kingdom.

Email: privacy@gimlabs.io