Who we are
TopERM is operated by [LEGAL ENTITY NAME], a company registered in [JURISDICTION] under number [COMPANY NUMBER], with its registered office at [REGISTERED ADDRESS].
For data you hold in the platform about your own customers, suppliers and staff, you are the controller and we are the processor. For data we hold about you as our customer — your account, your billing, your support history — we are the controller. Questions about either go to [PRIVACY EMAIL].
What we collect
We collect three separate things, and we keep them separate.
- Account data — the name, work email, phone number and role of the people you invite to your tenant, so they can sign in and be held accountable for what they post.
- Usage data — which screens are opened and which actions are taken, tied to a user id, so support can reconstruct what happened when something goes wrong.
- Customer data — everything you enter into the platform: ledger entries, invoices, vehicle records, stock, payroll references. We process this on your instruction and for no other purpose.
What we never do
- We do not sell personal data, and we do not share it with advertisers or data brokers.
- We do not use your customer data to train machine-learning models, ours or anyone else's.
- We do not send your records to a third-party model provider for inference unless you switch that feature on, and the setting is per tenant.
Why we are allowed to hold it
Account and billing data is processed to perform our contract with you. Usage data is processed on the basis of our legitimate interest in keeping the service working and secure, balanced against your interests — you can object at [PRIVACY EMAIL].
Customer data is processed under the data processing agreement that forms part of your subscription. Where you need one, we will sign a separate DPA including the UK International Data Transfer Addendum.
Where it lives
Production data is stored in [PRIMARY DATA REGION]. Backups are held in [BACKUP REGION] and retained for [RETENTION PERIOD]. Enterprise customers may choose a different residency; where that puts data outside the UK or EEA, transfers are covered by the appropriate safeguards under Article 46 UK GDPR.
Sub-processors — the hosting, email and payment providers we rely on — are listed at [SUB-PROCESSOR LIST URL]. We give [NOTICE PERIOD] notice before adding one, so you can object.
How long we keep it
Customer data stays for as long as your tenant is active. When you close an account we keep it for [POST-TERMINATION WINDOW] so you can export it, then delete it from live systems; backups age out within [BACKUP RETENTION].
Some records must be kept longer than you might like — accounting and tax records have statutory retention periods that override a deletion request.
Your rights
Under UK GDPR you can ask for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, object to processing, or ask us to restrict it. Write to [PRIVACY EMAIL] and we will respond within one month.
If we get it wrong you can complain to the Information Commissioner's Office at ico.org.uk. We would rather you told us first.
If the request concerns data held inside a customer's tenant, we will pass it to that customer — they are the controller and the decision is theirs.
Security
Data is encrypted in transit and at rest. Access to production is restricted to named staff, requires multi-factor authentication, and is logged. We will notify you without undue delay, and within 72 hours where the law requires it, if a breach affects your data.
Cookies
The application sets a session cookie so you stay signed in, and a preference cookie so it remembers your settings. Both are strictly necessary and cannot be turned off without breaking sign-in.
This marketing site sets [ANALYTICS PROVIDER OR 'no analytics cookies']. Anything beyond strictly necessary cookies is asked for before it is set.
Changes
If we change this policy materially we will email account owners before it takes effect. The date at the top is the date of the current version.