Arctic Parade LTD / BUSINESS DOCUMENTS

Privacy notice

Account data, customer inventory and your controls. Version 2026-09-20-v2.

These are early-access drafts awaiting final fact checks and legal review before public contracting. Outstanding details: Final legal review of processing and commercial terms.

Who is responsible

Arctic Parade LTD. Contact address: 9 Haigh Road, Huddersfield, England, HD3 2AE. Email: arran@arcticparade.com. Company registration: 17033806; England and Wales. Registered office: 9 Haigh Road, Huddersfield, England, HD3 2AE. We act as controller for account administration, business contacts, billing administration, support and service security. For personal data in customer inventories and lifecycle records, we act on the workspace customer’s instructions under the data-processing agreement. An MSP may itself be a processor for its clients.

Account data and purposes

We collect email, display name, workspace membership, password hash, verification/recovery token hashes, invitation records, agreement acceptance and account activity. We use these to operate accounts, grant authorised access and deliver support. Required company/account fields are needed to create a workspace. Display name and acquisition-source answers are optional; choosing not to provide them does not prevent evaluation.

Processing bases

For individuals contracting directly, necessary account/subscription administration relies on contract. For employees and representatives of business customers, our legitimate interests are administering the business relationship, protecting accounts and supporting users. Essential security and proportionate aggregate service measurement also support those interests. Statutory accounting obligations use legal obligation. Workspace personal data is processed on the customer’s documented instructions, rather than on a separate basis chosen by us. We do not treat agreement acceptance as consent to marketing.

Customer workspace data

Customer labels, resource identifiers, technologies, versions, environments, owners, notes, dates and evidence may contain personal data. We collect inventory through member uploads or authorised connectors and use it for notice matching, review, reporting and operational summaries. Generic cloud properties and tags are not stored wholesale. Only include information needed for the review and avoid sensitive personal information, passwords or tokens in notes. Your workspace administrator controls membership and can access all customer records in that workspace.

Recipients and service providers

Application/database records are currently held on infrastructure operated by Arctic Parade LTD. The host is located in United Kingdom. Postmark receives email recipients and account/operational message content when enabled. An opted-in weekly review can contain customer labels and action summaries. Stripe handles checkout/payment information when enabled; we retain subscription references but not card numbers. An authorised cloud connector sends requests and credentials only to the selected provider to retrieve the customer’s chosen estate. No workspace inventory is sent to an AI service by the lifecycle workflow. See the supplier register for roles and current status.

Sources of personal data

We obtain account information from you, your workspace administrator and invited members. Workspace data comes from member uploads, authorised cloud connectors and changes recorded by members. Stripe supplies subscription status and identifiers; Postmark supplies delivery results where available. We may receive a business contact’s details from their employer, an MSP responsible for their estate or a direct business enquiry.

International processing

Postmark’s published documentation describes US processing. Its applicable DPA and published UK transfer routes are recorded in our supplier evidence. Stripe and connected cloud providers may operate internationally under their applicable terms and safeguards. No UK-only data residency is promised. Request the recorded safeguards from arran@arcticparade.com. The customer remains responsible for authorising a connector to its own provider account; signing our processing agreement does not by itself authorise that provider access.

Cookies, storage and analytics

Session and CSRF cookies support authentication and protected forms. A masking preference cookie and a browser-local theme preference support presentation. Public metrics store daily request totals by allowlisted page without analytics visitor IDs, query strings or IP addresses. Bots and refreshes count as requests. Account activity records distinguish signup, built-in sample reports, imports, other reports, planned actions and checkout. We do not use advertising trackers in this release. Operational access logs can contain IP addresses and paths; token-bearing links use fragments that are not sent in HTTP requests.

Retention

Active account, inventory, action, evidence and agreement records remain while the workspace exists. Daily maintenance clears expired verification/recovery tokens; verification expires after 24 hours and recovery after 30 minutes. Invitations expire after 48 hours; consumed/expired invitation and workspace audit records are cleared after 90 days. Aggregate request counters retain 90 days. Workspace deletion removes active app records and connector secrets; protected backup copies expire after 14 days. Operational web logs rotate under the documented host policy and are used for security and fault investigation. Separate company accounting records may be retained for statutory obligations; deletion does not erase payment/email provider records or files saved by members.

Business communications

Service and security messages are necessary to operate an account. We may send relevant business marketing to corporate contacts where permitted by PECR and UK GDPR, identify Arctic Parade LTD and provide a working opt-out. We record and honour objections. We do not rely on the business-contact rule for sole traders or other individual subscribers unless consent or another PECR route applies.

Your rights and objections

Where applicable, ask for access, correction, erasure, restriction or portability. You can object to processing based on legitimate interests, including our account/service measurement purposes. Email arran@arcticparade.com; we verify identity proportionately and respond within the applicable legal deadline, normally one month. If an MSP controls your workspace data, we pass the request to the appropriate customer and assist them. Administrators can export/delete through the workspace. Subscription cancellation is an application prerequisite for self-service deletion, not a condition on your statutory rights; contact us for a separate erasure request.

Complaints, children and automated decisions

The service is for authorised business users aged 18 or over and is not directed at children. Contact arran@arcticparade.com first with a data-handling concern. You can also complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint/. Notice matching produces review candidates and does not make solely automated decisions with legal or similarly significant effects about individuals. We do not sell personal data.

Current product and data scopes

See current review coverage and collection limits and access, evidence and hosting boundaries. These pages describe the product scope. The early-access draft and legal-review status above still apply.