Privacy policy

1. Who we are

Twilltac is operated by Twilltac Limited, a company registered in England and Wales (company number 15866168), whose registered office is at Unit V Beacon Business Park, Weston Road, Stafford, Staffordshire, England, ST18 0WL ("Twilltac", "we", "us").

This policy explains how we collect and use personal data when you create a Twilltac account and use the Twilltac platform, including the workspace, partner, enterprise and console apps. For your account data, we are the data controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

When you create an account, we show you this policy. You can read the current version at any time from your account settings.

2. Information we collect

We collect:

• identity and contact details, such as your name, email address and phone number
• login details, such as your hashed password, one-time codes and single sign-on identifiers
• role details, such as the organisations you belong to and your permissions
• usage and device data, such as features used, actions taken, IP address, browser type and error logs
• session recordings, only if you consent to analytics
• records of your choices, such as which versions of our policies you have been shown and your cookie settings
• messages you send us

Most of this comes from you or your use of the platform. Some comes from the organisation that invited you or from your sign-in provider.

We do not ask for special category data, such as health or ethnicity, and ask that you do not enter it into the platform.

3. How we use your information

We use your personal data to:

• run your account and provide the platform (contract)
• send service messages, such as login codes, invites and alerts (contract)
• keep the platform secure, prevent misuse and keep audit trails (legitimate interests)
• fix errors, support you, and improve and develop Twilltac's products (legitimate interests)
• run analytics and session recordings (consent)
• meet our legal obligations (legal obligation)

You can object to uses based on legitimate interests, and withdraw consent at any time in your account settings (section 9).

We do not sell your personal data. We do not make decisions about you that have legal or similarly significant effects based solely on automated processing.

4. Data your organisation puts into Twilltac

Twilltac connects your organisation's systems and third parties, such as dealer management systems, finance providers and marketplaces, and syncs their data into the platform. Your organisation's users can then view, manage and change that data. It includes customer records, vehicle details, images and imports.

What each user can see. The data and connections a user can access depend on the Twilltac products your organisation has and the permissions it gives that user. We keep a history of changes made to the data.

Providing the service. When we hold personal data so that we can provide the service to your organisation, your organisation is the controller and we act as its processor. That use is covered by our terms of service and data processing agreement.

Connections to third parties. When your organisation connects a third party, we send data to it and receive data from it as your organisation instructs. Your organisation chooses which connections to turn on and is responsible for having the right to share that data. The third party's own use of the data is governed by its terms and privacy policy, not this one.

Our own purposes. We also use this data for Twilltac's own purposes, as a controller, based on our legitimate interests. These purposes are:

• building and improving vehicle data used across the platform, such as specifications, valuations, taxonomies and images
• creating aggregated statistics, benchmarks and market insights
• developing, testing and training our products and features, including machine-learning models
• keeping the platform secure and working correctly

Where this involves personal data, we de-identify or aggregate it first wherever we can, so the results do not identify anyone. We treat an image that shows a person or a registration plate as personal data. We do not sell personal data, and we do not market to your organisation's customers ourselves.

Vehicle data and images that do not identify a person are not personal data. Our rights to use them are set out in our terms of service.

5. Who we share data with

We share personal data only where it is needed, with:

• service providers that host and process data for us, such as cloud hosting and email and SMS delivery
• sign-in providers you choose to use
• third parties your organisation connects to Twilltac, such as partner apps and other business systems
• other users in your workspace, partner or enterprise, according to the permissions your organisation sets
• professional advisers, auditors and insurers
• police, regulators and courts, where the law requires it
• a buyer or successor of our business, under the same protections

Our service providers act only on our instructions, under written contracts. A list is available on request.

6. International transfers

We store your data in the UK, in Amazon Web Services' London region. Some service providers may access or process data outside the UK, for example in the European Economic Area or the United States.

When data leaves the UK, we make sure it is protected by a UK adequacy decision, the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses, or another safeguard the law allows. You can ask us for a copy of the safeguards we use.

7. How long we keep data

We keep personal data only as long as we need it:

• account data: while your account is active, then deleted or anonymised within a reasonable period after it closes
• logs and session recordings: for a short period, to keep the platform secure and fix problems
• records of what you agreed to, and data needed for legal, tax or accounting reasons: as long as the law requires
• de-identified or aggregated data: may be kept indefinitely, because it no longer identifies anyone

Data your organisation stores in Twilltac is kept and deleted according to its instructions and our agreement with it.

8. How we protect your data

We use technical and organisational measures to protect personal data, including:

• encryption in transit (TLS) and at rest
• hashed passwords, one-time login codes and single sign-on
• role-based permissions that limit each user to the workspaces and data they need
• audit trails of changes made on the platform
• restricted, logged access to production systems for our staff

No system is completely secure. If a breach puts your rights at risk, we will tell you and the Information Commissioner's Office (ICO) as the law requires.

9. Your rights

Under UK data protection law you have the right to:

• access the personal data we hold about you
• correct data that is wrong or incomplete
• erase your data in some circumstances
• restrict how we use your data
• object to processing based on legitimate interests
• port data you gave us to another service
• withdraw consent at any time, where we rely on it

To use any of these rights, contact us using the details in section 12. We will reply within one month and may need to confirm your identity first. There is normally no charge.

If you are unhappy with how we handle your data, please tell us first. You also have the right to complain to the ICO at ico.org.uk or on 0303 123 1113.

10. Cookies and session recording

We use strictly necessary cookies and local storage to sign you in, keep your session secure and remember your settings. These do not need your consent.

We use analytics, including session recordings, only if you agree. A session recording captures how you move through the app so we can find problems and improve it. We exclude automated and test traffic, and we do not record password fields. You can change your choice at any time in your account settings, and recording stops straight away.

For further information, see our Cookie Policy.

11. Changes to this policy

Each version of this policy has a number and the date it is in force from, and we keep a record of which version you have been shown.

We may update this policy when our services or the law change. We may email you about a new version, and we will always tell you before we use your data for a new purpose.

Where we rely on consent, such as for analytics, we ask for it separately.

12. Contact us

For questions about this policy or your data, contact our data protection lead:

Email	privacy@twilltac.com
Post	Data Protection Officer Twilltac Limited Unit V Beacon Business Park Weston Road Stafford Staffs ST18 0WL

Our ICO registration number is ZB769740.