HSoftKerr Privacy Policy

Definitions

General

Collection and Use of Personal Data

We may collect personal data from you in connection with your use of our Services. Personal data is information that identifies or relates to you as an individual. The types of personal data we may collect include:

• Contact information, such as your name, email address, and phone number;
• Usage information, such as your IP address, browser type, operating system, and pages visited on our website;
• Communications, such as messages you send to us or information you provide when you participate in a survey or promotion; and
• Other information you choose to provide to us.

Disclosure of Personal Data

We may disclose your personal data to the following types of third parties:

• Service Providers / Processors: We may share your personal data with third-party service providers who help us operate our business, such as website hosts, marketing partners, analytics providers (e.g., Google Analytics 4, Microsoft Clarity, Crazy Egg), advertising/remarketing platforms (e.g., Google Ads), and customer relationship management tools (e.g., HubSpot). These service providers may use your personal data only as necessary to provide their services to us and are contractually obligated to protect your personal data, and are prohibited from using personal data for their own purposes. Where required by law, non-essential analytics and advertising technologies are activated only with your consent.
• Affiliates / Intra-group recipients: We may share your personal data with our affiliates for the purposes described in this Privacy Policy, including with our affiliated company located in the United Arab Emirates (UAE) acting as an intra-group processor for internal hosting, support, and administrative purposes.
• Business Partners: We may share your personal data with our business partners when we collaborate with them to provide you with certain products or services.
• Professional Advisors: We may disclose personal data to our lawyers, auditors, accountants, and other professional advisors where necessary for the provision of their services and subject to confidentiality obligations.
• Legal Requirements: We may disclose your personal data when we believe in good faith that such disclosure is necessary to comply with applicable laws, regulations, or legal processes, or to respond to a subpoena or court order.
• Protect Our Rights and Interests: We may disclose your personal data when we believe in good faith that such disclosure is necessary to protect our rights or interests or the rights or interests of others.
• Aggregated or De-identified Information: We may share aggregated or de-identified information that cannot reasonably be used to identify you.

Third-Party Links

Security

Principles of Processing

We process Personal Data in accordance with the GDPR/UK GDPR and commit to the principles set out in Article 5. In particular, Personal Data we process will be:

• Lawfulness, fairness & transparency. We process Personal Data on a valid legal basis (e.g., contract, legitimate interests, legal obligation, or consent) and provide clear, accessible notices about our processing activities. In the EEA/UK, non-essential analytics/advertising cookies are deployed only with your consent (no implied/blanket consent).
• Purpose limitation. We collect Personal Data for specified, explicit, and legitimate purposes and do not further process it in a manner incompatible with those purposes. If we intend to use Personal Data for a new purpose, we will provide prior notice and identify the applicable legal basis.
• Data minimisation. We limit Personal Data to what is adequate, relevant, and necessary in relation to the purposes (e.g., minimal form fields; pseudonymisation/aggregation where feasible).
• Accuracy. We keep Personal Data accurate and, where necessary, up to date, and we provide mechanisms for you to request correction or update of your data.
• Storage limitation. We retain Personal Data no longer than necessary for the purposes for which it is processed and then delete or irreversibly anonymise it.
• Integrity & confidentiality (security). We process Personal Data using appropriate technical and organisational measures (e.g., encryption in transit, least-privilege access controls, logging/monitoring, vulnerability management, incident response) and require equivalent protections from our processors and partners.
• Data protection by design and by default. We implement appropriate technical and organisational measures designed to ensure that, by default, only Personal Data necessary for each specific purpose is processed, and we continuously review controls in line with Article 25 GDPR.

‍Data Retention

Where We Store Personal Data

Service-specific storage information:

• Google Analytics (GA4). Analytics data may be stored on Google servers located in the EU and the US. Transfers are safeguarded via Standard Contractual Clauses and/or reliance on Google’s participation in the EU-U.S. Data Privacy Framework (where applicable).
• Microsoft Clarity. Session analytics data may be stored on Microsoft infrastructure in the EU and the US. International transfers are protected via Standard Contractual Clauses.
• Google Ads (advertising/remarketing). Campaign, audience, and conversion data may be stored on Google servers in the EU and the US. International transfers are safeguarded via Standard Contractual Clauses and/or the EU-U.S. Data Privacy Framework (where applicable).

International Transfers

We are established in Andorra. For transfers of personal data from the European Economic Area (EEA) to Andorra, we rely on the European Commission’s adequacy decision recognizing Andorra as providing an adequate level of protection. We also engage processors and partners that may process personal data outside your jurisdiction (for example, in the European Union, the United States, and the United Arab Emirates). In such cases, we implement appropriate safeguards to ensure a level of protection essentially equivalent to that in the EEA/UK. These safeguards include:

• Standard Contractual Clauses (SCCs). For EEA-origin data transferred to countries without an adequacy decision (e.g., the United States or the United Arab Emirates), we enter into the European Commission’s Standard Contractual Clauses (2021/914) with the relevant recipients, using the appropriate modules and ensuring onward transfer restrictions and audit rights.
• UK Addendum / International Data Transfer Agreement (IDTA). For transfers originating from the United Kingdom, where no UK adequacy regulation applies, we use the UK Addendum to the EU SCCs or the UK IDTA, as applicable.
• EU–U.S. Data Privacy Framework (DPF). Where a U.S. recipient (e.g., certain analytics, advertising, or CRM providers) participates in the EU–U.S. DPF, we may rely on that certification for EEA→U.S. transfers. If a recipient does not participate, we use SCCs (and the UK Addendum/IDTA where relevant).
• Supplementary measures and Transfer Risk Assessments. We adopt technical, organizational, and contractual measures (e.g., access controls, encryption in transit, data minimization, purpose limitation, and transparency commitments) and conduct transfer risk assessments, where appropriate, in line with regulatory guidance.

Changes to this Privacy Policy

General Data Protection Regulation (GDPR) and UK GDPRChildren's Online Privacy Protection Act (COPPA)

Contact Us