Privacy Policy

Last updated: March 2023

1.INTRODUCTION
Who are we?	We are Spaze Ltd, a private company incorporated and registered in England & Wales with company number 12962620 whose registered office is at Broadway Court, Brighton Road, Lancing, West Sussex, United Kingdom, BN15 8JT (“Spaze”, “we”, “us” or “our”). Where we decide the means or purposes of processing your personal data, we are the “data controller."
What’s this policy about?	We have developed an application called “Spaze” ("App"), a web-based application for community service organisations (“Community Service Organisations”) and provides certain services which relate to the App, excluding any improvements or additional functionality which we may develop from time to time (and “Services” shall refer to the App and those services). The App enables Community Service Organisations to: (i) log the transactional data about their community services (“Client Services” shall refer to those services) and Service User's personal data (“Service Users” shall refer to individuals procuring the Client Services), which is required for the provision of Client Services; (ii) source and aggregate transactional data and Service User’s historic data for the purpose of monitoring and reporting on the operations of the Community Service Organisation. This policy explains how we process your personal data as a data controller in relation to our website (https://spaze.social, the “Website”) and the Services. We may make changes to this policy in the future, which will be posted on this page. You should check this page from time to time to ensure you are aware of any changes. Where appropriate we may notify you of changes by email. Where you interact with those Community Service Organisations which are using our App, they decide the means and purpose of processing your personal data. Please refer to their privacy policies for more information about that processing.
How do you contact us? (if you have questions about this policy or to exercise your rights)	If you have any questions concerning this notice, including how you can exercise your rights, please contact us at legal@spaze.social. If we can’t resolve your issue, you can also get in touch with the Information Commissioner’s Office at: https://ico.org.uk/concerns (or if you live outside the UK in a European country, you can submit a complaint to the supervisory authority in your country). Under Article 27 of the GDPR, we have appointed an EU Representative to act as our data protection agent. Our nominated EU Representative is: Instant EU GDPR Representative Ltd. Adam Brogden contact@gdprlocal.com Tel +35315549700 INSTANT EU GDPR REPRESENTATIVE LTD Office 2, 12A Lower Main Street, Lucan Co. Dublin, K78 X5P8, Ireland
What are your rights?	You have the following rights, although these rights may be limited in some circumstances: Ask us to send a copy of your personal data to you or someone else Ask us to restrict, stop processing, or delete your personal data Object to our processing of your personal data Object to use of your personal data for direct marketing Ask us to correct inaccuracies If we rely on consent to process personal data, or send direct marketing, you can withdraw consent by email to the address above.

2.YOUR PERSONAL DATA AND HOW WE USE IT
Your personal data	How we use it	Sources and recipients
Community Service Organisation data Information relating to Community Service Organisations and their personnel (including employees, contractors and volunteers of Community Service Organisations) (“CSO Personnel”), including: Name Job title and name of Community Service Organisation (if applicable) Contact details (address, phone number, email) Billing/invoicing information	We process this information to provide Community Service Organisations with the Services in accordance with the agreement between the applicable Community Service Organisation and Spaze (“Spaze Service Agreement”). Legal basis for this processing For the purposes of our legitimate interests (in providing our Services and promoting the success of our business), entering Spaze Service Agreements with you or performing our obligations under Spaze Service Agreements. How long we keep it Until 6 years after our business relationship with you (or the applicable Community Service Organisation) ends.	Sources We collect this information from you Recipients We may store this information with Amazon Web Services, Google Cloud Platform and DigitalOcean.
Email update data Contact information including: Name Email address	We process this information to allow you to subscribe to receive information and updates from us by email about the Services, where you have given your consent. Legal basis for this processing Consent. How long we keep it Until you withdraw your consent. More information You may be required to provide us with certain information in order to subscribe to receive information and updates on our Services.	Sources We generally collect this information from you. Recipients We may store this information with Amazon Web Services, Google Cloud Platform and DigitalOcean. We use Amazon Web Services, Google Cloud Platform and DigitalOcean to send you information and updates on our Services
Website analytics, advertising and retargeting data This includes the following information (which may be associated with a unique identifier): Browser type and settings, IP address, approximate location, access logs, device type and settings, operating system, and other information provided by your browser The use you make of our Website, including which pages you visit, which links you click, the Websites you have come from, how long you spend on our Website and how you interact with it Details of which adverts you have seen (for example, to avoid showing you them again)	Where we have your consent, we: (a) use a third party service (Google Analytics) to collect information about visitors to our Website, to understand how many people visit the Website, where they come from, and how they interact with it, and to help us improve the Website; and (b) use Facebook and Google advertising services to measure, optimise and build audiences for advertising campaigns served via Google and on Facebook (as described in more detail at section 3 of this policy, relating to cookies). Legal basis for this processing Consent How long we keep it After 26 months underlying personal data is deleted, but we may retain some anonymous, aggregated statistics generated from that personal data. More information You can find out more about how Google uses personal data by clicking here. You can find out more about how Facebook uses personal data by clicking here. You can withdraw your consent at any time by contacting us, or opting-out using the following links: You can opt-out here: Google Ads. You can opt-out here: Facebook Pixel. You can opt-out here: Google Analytics.	Sources We use Google’s services to collect this personal data from you when you visit our Website. Recipients Google in the USA, and Facebook collect and process this information on our behalf.
Service and enquiry data This includes: Name Contact details (address, phone number, email) Information you send us as part of enquiries Any personal data you provide to us in order for us to provide our Services	We process this information: (a) to respond to your enquiries; (b) to promote our Services; and (c) to understand how Community Service Organisations use our Services in order to improve them; and (d) to provide our Services. Legal basis for this processing (a), (b) and (c): Our legitimate interests of marketing and improving our Services. (d): entering or performing Spaze Service Agreements. How long we keep it For as long as we are dealing with your enquiries or providing Services to you, and for 7 years thereafter. More information You may be required to provide us with certain information in order for us to respond to your enquiries.	Sources We collect this personal data from you. Recipients We may store this information with Amazon Web Services, Google Cloud Platform and DigitalOcean.
Analytics data We process the following information relating to Service Users, if the Community Service Organisation decides to record this information from Service Users: Name, Government ID, Date of Birth Country, City, Address Mobile Number, Email, Preferred language Household composition: Name, Government Id, Date of Birth of the Service User’s family members (if applicable). Any other data the Community Service Organisation needs to collect in order to deliver their Service to Service Users. This data can be logged using customisable forms featuring open text fields, single/multiple select fields and checkbox fields.	We process this information for analytics and impact reporting purposes. Legal basis for this processing Consent How long we keep it Until 6 years after the Service User stops attending the relevant Community Service Organisation.	Sources We allow Community Service Organisations to collect data from Service Users, which can include personal data. Recipients Community Service Organisation
Where explicit retention periods are not described above, we hold personal data for as long as necessary bearing in mind the purpose for which it was collected. At the end of the retention period, we assess whether it is necessary to continue to retain information to achieve the purposes for which it was collected. To determine appropriate retention periods, we consider the amount, nature, and sensitivity of the personal data, the potential risk of unauthorised access, and legal requirements.

2.YOUR PERSONAL DATA AND HOW WE USE IT

Your personal data

How we use it

Sources and recipients

Community Service Organisation data

Information relating to Community Service Organisations and their personnel (including employees, contractors and volunteers of Community Service Organisations) (“CSO Personnel”), including:

Name
Job title and name of Community Service Organisation (if applicable)
Contact details (address, phone number, email)
Billing/invoicing information

We process this information to provide Community Service Organisations with the Services in accordance with the agreement between the applicable Community Service Organisation and Spaze (“Spaze Service Agreement”).

Legal basis for this processing

For the purposes of our legitimate interests (in providing our Services and promoting the success of our business), entering Spaze Service Agreements with you or performing our obligations under Spaze Service Agreements.

How long we keep it

Until 6 years after our business relationship with you (or the applicable Community Service Organisation) ends.

Sources

We collect this information from you

Recipients

We may store this information with Amazon Web Services, Google Cloud Platform and DigitalOcean.

Email update data

Contact information including:

Name
Email address

We process this information to allow you to subscribe to receive information and updates from us by email about the Services, where you have given your consent.

Legal basis for this processing

Consent.

How long we keep it

Until you withdraw your consent.

More information

You may be required to provide us with certain information in order to subscribe to receive information and updates on our Services.

Sources

We generally collect this information from you.

Recipients

We may store this information with Amazon Web Services, Google Cloud Platform and DigitalOcean.

We use Amazon Web Services, Google Cloud Platform and DigitalOcean to send you information and updates on our Services

Website analytics, advertising and retargeting data

This includes the following information (which may be associated with a unique identifier):

Browser type and settings, IP address, approximate location, access logs, device type and settings, operating system, and other information provided by your browser
The use you make of our Website, including which pages you visit, which links you click, the Websites you have come from, how long you spend on our Website and how you interact with it
Details of which adverts you have seen (for example, to avoid showing you them again)

Where we have your consent, we: (a) use a third party service (Google Analytics) to collect information about visitors to our Website, to understand how many people visit the Website, where they come from, and how they interact with it, and to help us improve the Website; and (b) use Facebook and Google advertising services to measure, optimise and build audiences for advertising campaigns served via Google and on Facebook (as described in more detail at section 3 of this policy, relating to cookies).

Legal basis for this processing

Consent

How long we keep it

After 26 months underlying personal data is deleted, but we may retain some anonymous, aggregated statistics generated from that personal data.

More information

You can find out more about how Google uses personal data by clicking here.

You can find out more about how Facebook uses personal data by clicking here.

You can withdraw your consent at any time by contacting us, or opting-out using the following links:

You can opt-out here: Google Ads.
You can opt-out here: Facebook Pixel.
You can opt-out here: Google Analytics.

Sources

We use Google’s services to collect this personal data from you when you visit our Website.

Recipients

Google in the USA, and Facebook collect and process this information on our behalf.

Service and enquiry data

This includes:

Name
Contact details (address, phone number, email)
Information you send us as part of enquiries
Any personal data you provide to us in order for us to provide our Services

We process this information: (a) to respond to your enquiries; (b) to promote our Services; and (c) to understand how Community Service Organisations use our Services in order to improve them; and (d) to provide our Services.

Legal basis for this processing

(a), (b) and (c): Our legitimate interests of marketing and improving our Services.
(d): entering or performing Spaze Service Agreements.

How long we keep it

For as long as we are dealing with your enquiries or providing Services to you, and for 7 years thereafter.

More information

You may be required to provide us with certain information in order for us to respond to your enquiries.

Sources

We collect this personal data from you.

Recipients

We may store this information with Amazon Web Services, Google Cloud Platform and DigitalOcean.

Analytics data

We process the following information relating to Service Users, if the Community Service Organisation decides to record this information from Service Users:

Name, Government ID, Date of Birth
Country, City, Address
Mobile Number, Email, Preferred language
Household composition: Name, Government Id, Date of Birth of the Service User’s family members (if applicable).
Any other data the Community Service Organisation needs to collect in order to deliver their Service to Service Users. This data can be logged using customisable forms featuring open text fields, single/multiple select fields and checkbox fields.

We process this information for analytics and impact reporting purposes.

Legal basis for this processing

Consent

How long we keep it

Until 6 years after the Service User stops attending the relevant Community Service Organisation.

Sources

We allow Community Service Organisations to collect data from Service Users, which can include personal data.

Recipients

Community Service Organisation

Where explicit retention periods are not described above, we hold personal data for as long as necessary bearing in mind the purpose for which it was collected. At the end of the retention period, we assess whether it is necessary to continue to retain information to achieve the purposes for which it was collected. To determine appropriate retention periods, we consider the amount, nature, and sensitivity of the personal data, the potential risk of unauthorised access, and legal requirements.

3.COOKIES, ANALYTICS AND SIMILAR TECHNOLOGIES
Cookies, pixels and other technologies store and access personal data on your device to help websites and apps work. This table explains their purpose, how long they last, and who else can access their personal data. We get your consent to use them unless they’re essential for our sites, apps or services. Most browsers allow control over cookies, for more information: Google Chrome \| Microsoft Edge \| Mozilla Firefox \| Microsoft Internet Explorer \| Opera \| Apple Safari.
Cookie/data	Duration	Purpose	Access
_ga _gat _gid	Up to 24 months	To collect information about how visitors interact with our Website and generate reports based to identify problems, understand how visitors use our Website, and improve it.	We use Google Analytics to set these cookies. You can find out more about how Google uses personal data by clicking here. You can opt-out here: Google Analytics.
NID, SID	Up to 180 days	To select advertising based on what’s relevant to a user, to improve reporting on campaign performance, and to avoid showing ads a user has already seen.	We use Google Ads to set these cookies. You can find out more about how Google uses personal data by clicking here. You can opt-out here: Google Ads.
fbevents.js	Up to 180 days	To measure, optimise and build audiences for advertising campaigns served on Facebook. In particular it enables us to see how visitors move between devices when accessing our Website and Facebook, to ensure that our Facebook advertising is seen by visitors most likely to be interested in such advertising by analysing which content a visitor has viewed and interacted with on our Website.	We use Facebook Pixel to set this cookie. You can find out more about how Facebook uses personal data by clicking here. You can opt-out here: Facebook Pixel

4.STORAGE, TRANSFERS AND DISCLOSURE
Storage & Transfers	Save where indicated otherwise in this policy, your personal data is securely stored in the UK and/or the European Economic Area. Where we use data processors outside the UK and European Economic Area, and transfer personal data to a country which does not provide an adequate level of protection, we use contracts which give personal data the same protection it has in Europe and the UK. For more information drop us a line using the contact details at the start of this policy. Your personal data can be removed on request.
Disclosure	Other than as set out above, we may disclose your personal data: Where required by law, government, competent authorities or the courts or to establish, exercise or defend our legal rights, and for the purposes of preventing crime and fraud (for example, we may share personal data with our professional advisors, investigators, or credit reference agencies). With members of our corporate group, suppliers and subcontractors, as necessary for the purposes set out in this policy. If involved in an investment, merger, acquisition, or sale of our organisation or assets, personal data we hold may be shared on the basis of the legitimate interests of us, our shareholders, customers and other parties to a transaction, unless those interests are outweighed by prejudicial impacts upon you.

4.STORAGE, TRANSFERS AND DISCLOSURE

Storage & Transfers

Save where indicated otherwise in this policy, your personal data is securely stored in the UK and/or the European Economic Area. Where we use data processors outside the UK and European Economic Area, and transfer personal data to a country which does not provide an adequate level of protection, we use contracts which give personal data the same protection it has in Europe and the UK. For more information drop us a line using the contact details at the start of this policy. Your personal data can be removed on request.

Disclosure

Other than as set out above, we may disclose your personal data:

Where required by law, government, competent authorities or the courts or to establish, exercise or defend our legal rights, and for the purposes of preventing crime and fraud (for example, we may share personal data with our professional advisors, investigators, or credit reference agencies).
With members of our corporate group, suppliers and subcontractors, as necessary for the purposes set out in this policy.
If involved in an investment, merger, acquisition, or sale of our organisation or assets, personal data we hold may be shared on the basis of the legitimate interests of us, our shareholders, customers and other parties to a transaction, unless those interests are outweighed by prejudicial impacts upon you.