Culverdocs Privacy Policy
Last Updated: 27/12/2025
1. Who we are and what we do
Who we are
We are Culvertech Ltd (trading as Culverdocs), a service that helps businesses capture and manage data (“Culverdocs”, “us”, “we”, “our”). We are a limited company registered in England and Wales under registration number 10564100 and we have our registered office at Suite A2, Gemini House, Hargreaves Road, Swindon, Wiltshire, SN25 5AZ. We are registered with the Information Commissioner’s Office (“ICO”), in relation to our processing of Personal Data under registration number ZA232547.
What we do
Culverdocs is designed to capture and distribute business data through simple yet powerful mobile and web forms. We are committed to protecting the privacy and security of the Personal Data we process on your behalf.
2. Purpose of this Privacy Policy
The purpose of this Privacy Policy is to explain what Personal Data we collect about you and how we process it. It also explains your rights regarding your Personal Data. Please read this policy carefully. If you have any questions, you can contact us using the information provided below in the ‘How to Contact Us’ section.
Distinction of Controller vs Processor
- Data Controller: We are the controller of the Personal Data we collect about you and your business for the purpose of providing our services. This means that we determine what Personal Data to collect and how to process it.
- Data Processor: We are the processor for all of the data (including Personal Data) we store and process on your behalf, as determined by the configured data collection requirements of your forms, and the services you opt-in to use for us to process the data on your behalf. This includes the sub-processors required to perform the actions configured within your account. As a Data Processor, we act strictly under your instructions, and your data remains under your control at all times.
For example, when you provide us with your business account information, we act as a Data Controller. However, when you use Culverdocs to process your own business data through our platform, we act as a Data Processor on your behalf.
3. Who this Privacy Policy applies to
This Privacy Policy applies to individuals who interact with us through our website and services, including customers, employees of our customers, prospects, partners, and customers and their employees of our partners. This privacy notice applies to you if:
- You visit our website.
- You purchase services from us.
- You enquire about our products and/or services.
- You use any part of our services.
- You sign up to receive newsletters and/or other promotional communications from us.
- You engage with us on telephone or remote calls.
- You engage with a Culverdocs Partner reselling our services.
4. Scope of This Privacy Policy
This policy applies to the personal information that we collect as a data controller. It does not apply to personal information which is subject to separate agreements, such as data processing agreements (DPAs), concerning the processing of personal data.
We are the data controller for personal information related to your personal account, and to the delivery of services related to Culverdocs.
This policy complements, but does not replace, any Data Processing Agreements (DPAs) or other contractual agreements we may have in place.
5. What is Personal Data?
‘Personal Data’ means any information from which someone can be identified either directly or indirectly, whether collected online or offline. For example, you can be identified by your name, email address, or an online identifier.
6. Personal Data We Collect
The type of Personal Data we collect about you will depend on our relationship with you. The data we collect includes the following:
- Account Details: Name, email address, phone number, job title, company, and other information you provide when signing up for our services.
- Usage Data: Data about how you use our website, app, and services, including device information, browser type, IP address, and other technical data. This data may be collected automatically through cookies and analytics tools as described in our Cookie Policy.
- Relationship Data: Any information regarding your specific use cases within Culverdocs, including telephone conversations, calls made via remote tools (Microsoft Teams/Zoom), or Jobs pertaining to individual business requirements.
- Support Data: Information related to support and onboarding interactions, including chat logs, call recordings, and support tickets, to improve our service and support experience.
- Transaction Data: Information related to payments, invoices, and order history when purchasing our services.
- Marketing Data: Information you provide when signing up for newsletters or promotional communications.
- Miscellaneous Data: Additional information you may provide when engaging with us directly, such as feedback, survey responses, or information provided through customer support channels. We may also collect Personal Data necessary to comply with legal and regulatory requirements, including but not limited to anti-fraud and anti-money laundering obligations.
Some types of analytics data, such as usage and tracking data, are handled through cookies. Further information can be found in our Cookie Policy on the website.
7. How We Collect Your Personal Data
We collect most of your Personal Data directly from you, such as:
- When you visit our website.
- When you interact with us via email, phone, or in person.
- When you sign up for our services via a demo request or contact us.
We may also collect your Personal Data from third parties, including:
- Others to whom you have provided consent to share your details with us, such as referrals or introductions.
- Publicly available sources such as social media platforms.
8. How We Use Your Data
When you contact us through our website or other channels, we process your personal data to respond to your enquiry and to carry out reasonable follow-up related to that enquiry, including sales-related communication where relevant. This processing is carried out based on our legitimate interests in operating and growing our business.
9. Marketing Communications
Where you contact us in a business capacity, we may send limited and relevant sales or marketing communications where we believe there is a legitimate interest to do so, based on your role, your organisation, and your prior interactions with us.
We will only send such communications where they are relevant to your business and where you would reasonably expect to hear from us. You can object to or opt out of receiving these communications at any time, and every marketing email we send includes an unsubscribe option.
10. Purposes, Lawful Bases, and Retention Periods
We retain Personal Data in accordance with applicable legal, regulatory, and contractual requirements. Legitimate Interests may include enhancing our services, improving user experience, and supporting our business operations, provided that these interests are not overridden by your privacy rights. We store your Personal Data for the Retention Period that is consistent with our business purposes and will retain the data for the length of time needed to fulfil the purposes outlined in this Privacy Policy unless a longer retention period is required or permitted by law.
Most commonly, we will use your Personal Data in the following circumstances:
| Categories of Individuals | Categories of Personal Data | Purpose of Processing | Lawful Basis | Retention Period |
|---|---|---|---|---|
| Prospective Customer | Name, Company Details, Address, Email Address, Telephone Numbers | To contact you regarding the use of the Culverdocs platform | Legitimate Interests | For a limited period following the last meaningful engagement, unless you object earlier |
| Customer | Name, Company Details, Address, Email Address, Invoice Details | To fulfil your order and ongoing billing-related communication | Contract | 6 years following the transaction |
| Customer | Name, Company Name, Email Address | To send essential service communications such as security notices and service updates. | Contract | Duration of an active User/Administrator account in Culverdocs |
| Customer | Name, Company Name, Email Address | To send limited emails related to product updates, new releases, and upgrades where relevant. | Legitimate Interests | While an active customer relationship exists, unless you object earlier |
| Customer | Name, Contact Details, Transaction History | To manage our relationship with you (e.g. to notify you of changes) | Contract | 6 years following the transaction |
10.1. Legitimate Interests
We rely on legitimate interests to process personal data where it is necessary for responding to enquiries, managing sales relationships, and sending limited B2B marketing communications that are relevant to your role and prior interactions with us. We have considered and balanced these interests against your rights and freedoms.
We do not retain or use contact details for ongoing marketing where there has been no relevant engagement for a sustained period, and where there is no active customer or sales relationship. We regularly review and cleanse our contact data using a combination of automated tools and manual review to ensure it remains relevant and appropriate.
11. Sharing your Personal Data
Your Personal Data will not be sold to or shared with third parties without your explicit consent, except with trusted sub-processors to support our business operations or where legally required. In cases where we utilise sub-processors for the purposes of processing your data for our business use, we may share your Personal Data with trusted third-party services (sub-processors) who help us operate and provide our services.
All sub-processors are subject to strict contractual obligations, including Data Processing Agreements (DPAs) or Standard Contractual Clauses (SCCs) ensuring compliance with applicable data protection laws. These third-party services are subject to their own privacy policies and are only permitted to process your Personal Data on our behalf.
These third-party services are contracted to provide specific services, and they are obligated not to use or disclose your data for any other purpose. You can find a full list of sub-processors here: https://www.culverdocs.co.uk/sub-processors.
In addition to our processing, you may optionally provide us with additional personal information relating to your users to enable us to process data provided to us as part of the Culverdocs service and data processing activities. Further information can be found in our Terms and Conditions, but privacy-related information on each service has been detailed below:
11.1. Google Drive Integration
If you choose to use Google Drive as part of our service via Integrations, we will only access your data within Google Drive with your explicit consent and as required for the service, such as tasks for storing files in the pre-determined locations. The data processed through Google Drive will be subject to Google’s privacy policies and terms.
The data we collect about you is what you have provided to us, including your name, email address and access details for your account in order to complete the integration tasks provided. Culverdocs will not store any personal information regarding your Google Drive contents, other than the information you provide us from the integration containing your account details, or folder/path names (if applicable) to store files in the required location.
We will use your data to provide you with the services you requested, such as uploading files produced through the configured Workflows which have access to write to your Google Drive folder determined by you, and based on the relevant access permissions provided.
You can manage or revoke the Google Drive integration permissions at any time through your Culverdocs account settings or within your Google account permissions.
You can find more details about how Google handles personal data in the Google Privacy Policy and Google Cloud Privacy Notice.
12. International Transfers
The Personal Data we hold as a Data Controller may be processed outside of the UK or EEA. This is because the organisations we use to provide our service to you may be based outside the UK. We have taken appropriate steps to ensure that the Personal Data processed outside the UK has an equivalent level of protection to that guaranteed in the UK.
This includes:
- Ensuring that your Personal Data is only processed within the UK or EEA with adequate protection, and/or;
- Ensuring that Data Processing Agreements (DPAs) and relevant Standard Contractual Clauses (SCCs) are in place where international processing is required, in line with the ICO IDTA requirements.
13. Your Data Protection Rights
You have the following rights regarding your Personal Data:
- Access: You have the right to request a copy of your Personal Data.
- Correction: You have the right to correct any Personal Data we hold about you that is inaccurate or incomplete.
- Deletion: You have the right to request that we delete your Personal Data, subject to certain conditions.
- Objection: You have the right to object to us processing your Personal Data for certain purposes.
- Restriction: You have the right to restrict the processing of your Personal Data in certain circumstances.
- Portability: You have the right to request a transfer of your Personal Data to another service provider where technically feasible.
To exercise these rights, please contact us using the contact details provided below. To protect your Personal Data, we may require additional information to verify your identity before processing your request.
We will handle all requests in accordance with ICO guidelines and ensure compliance with the latest legal requirements. In the event of any changes to the ICO’s guidance, those updates may supersede the information provided in this policy to maintain compliance with applicable data protection laws.
If you believe we have not complied with your data protection rights, you also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at www.ico.org.uk.
You have the right to object at any time to the processing of your Personal Data for direct marketing purposes.
14. How We Protect Your Data
We implement industry-standard technical and organisational measures to protect your Personal Data and the confidentiality of your Personal Data, including encryption, access controls, and regular security assessments to safeguard against unauthorised access, alteration, disclosure, or destruction.
In addition to technical measures, we maintain robust organisational policies, including staff training on data protection and strict access controls to safeguard your Personal Data.
Further information on our technical measures and organisational measures through compliance activities can be shared on request by contacting us.
15. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new Privacy Policy on our website and updating the “Last Updated” date. Please review this policy regularly for updates to how we process your Personal Data.
16. How to Contact Us
If you have any questions about this Privacy Policy or our data processing practices, or to exercise your rights, please contact us at:
- Email: [email protected]
- Phone: +44 (0)1793 200 664
- Address: Suite A2, Gemini House, Hargreaves Road, Swindon, Wiltshire, SN25 5AZ, United Kingdom.