Last Updated: 23/02/25
We are Culvertech Ltd (trading as Culverdocs), a service that helps businesses capture and manage data (“Culverdocs”, “us”, “we”, “our”). We are a limited company registered in England and Wales under registration number 10564100 and we have our registered office at Suite A2, Gemini House, Hargreaves Road Swindon, SN25 5AZ. We are registered with the Information Commissioner’s Office (“ICO”), in relation to our processing of Personal Data under registration number ZA232547.
Culverdocs is designed to capture and distribute business data through simple yet powerful mobile and web forms. We are committed to protecting the privacy and security of the Personal Data we process on your behalf.
The purpose of this privacy notice is to explain what Personal Data we collect about you and how we process it. It also explains your rights regarding your Personal Data. Please read this notice carefully. If you have any questions, you can contact us using the information provided below in the ‘How to Contact Us’ section.
Due to the nature of the service, we act as both a Data Controller and Data Processor depending on the type of data held and supplied.
For example, when you provide us with your business account information, we act as a Data Controller. However, when you use Culverdocs to process your own business data through our platform, we act as a Data Processor on your behalf.
This privacy notice applies to individuals who interact with us through our website and services, including customers, employees of our customers, prospects, partners, and customers and their employees of our partners. This privacy notice applies to you if:
This policy applies to the personal information that we collect as a data controller. It does not apply to personal information which is subject to separate agreements, such as data processing agreements (DPAs), concerning the processing of personal data.
We are the data controller for personal information related to your personal account, and to the delivery of services related to Culverdocs.
This policy complements, but does not replace, any Data Processing Agreements (DPAs) or other contractual agreements we may have in place.
‘Personal Data’ means any information from which someone can be identified either directly or indirectly, whether collected online or offline. For example, you can be identified by your name, email address, or an online identifier.
WThe type of Personal Data we collect about you will depend on our relationship with you. The data we collect includes the following:
Some types of data related to analytics such as usage and tracking data is handled through the use of cookies can be found in our Cookie Policy on the website.
We collect most of your Personal Data directly from you, such as:
We may also collect your Personal Data from third parties, including:
We retain Personal Data in accordance with applicable legal, regulatory, and contractual requirements. Legitimate Interests may include enhancing our services, improving user experience, and supporting our business operations, provided that these interests are not overridden by your privacy rights. We store your Personal Data for the Retention Period that is consistent with our business purposes and will retain the data for the length of time needed to fulfil the purposes outlined in this privacy policy unless a longer retention period is required or permitted by law.
Most commonly, we will use your Personal Data in the following circumstances:
| Categories of Individuals | Categories of Personal Data | Purpose of Processing | Lawful Basis | Retention Period |
|---|---|---|---|---|
| Customer | Name, address, email address | To fulfil your order | Contract | 6 years following the transaction |
| Customer | Name, job title, work email, work phone number, company name | To send newsletters and promotional material | Contract & Legitimate Interests | Duration of the Administrator account setup. Determined by you. |
| Customer | Name, contact details, transaction history | To manage our relationship with you (e.g. to notify you of changes) | Contract | 6 years following the transaction |
| Prospective Customers | Name, company details, address, email address, telephone numbers | To contact you regarding the use of the Culverdocs platform | Legitimate Interests | 6 years following last meaningful contact |
Your Personal Data will not be sold to or shared with third parties without your explicit consent, except with trusted sub-processors to support our business operations or where legally required. In cases where we utilise sub-processors for the purposes of processing your data for our business use, we may share your Personal Data with trusted third-party services (sub-processors) who help us operate and provide our services.
All sub-processors are subject to strict contractual obligations, including Data Processing Agreements (DPAs) or Standard Contractual Clauses (SCCs) ensuring compliance with applicable data protection laws. These third-party services are subject to their own privacy policies and are only permitted to process your Personal Data on our behalf.
These third-party services are contracted to provide specific services, and they are obligated not to use or disclose your data for any other purpose. You can find a full list of sub-processors here: https://www.culverdocs.co.uk/sub-processors.
In addition to our processing, you may optionally provide us with additional personal information relating to your users to enable us to process data provided to us as part of the Culverdocs service and data processing activities. Further information can be found in our Terms and Conditions, but privacy-related information on each service has been detailed below:
If you choose to use Google Drive as part of our service via Integrations, we will only access your data within Google Drive with your explicit consent and as required for the service, such as tasks for storing files in the pre-determined locations. The data processed through Google Drive will be subject to Google's privacy policies and terms.
The data we collect about you is what you have provided to us, including your name, email address and access details for your account in order to complete the integration tasks provided. Culverdocs will not store any personal information regarding your Google Drive contents, other than the information you provide us from the integration containing your account details, or folder/path names (if applicable) to store files in the required location.
We will use your data to provide you with the services you requested, such as uploading files produced through the configured Workflows which have access to write to your Google Drive folder determined by you, and based on the relevant access permissions provided.
You can manage or revoke the Google Drive integration permissions at any time through your Culverdocs account settings or within your Google account permissions.
You can find more details about how Google handles personal data in its Privacy Policy and Google Cloud Privacy Notice.
The Personal Data we hold as a Data Controller may be processed outside of the UK or EEA. This is because the organisations we use to provide our service to you may be based outside the UK. We have taken appropriate steps to ensure that the Personal Data processed outside the UK has an equivalent level of protection to that guaranteed in the UK. This includes:
You have the following rights regarding your Personal Data:
To exercise these rights, please contact us using the contact details provided below. To protect your Personal Data, we may require additional information to verify your identity before processing your request.
We will handle all requests in accordance with ICO guidelines and ensure compliance with the latest legal requirements. In the event of any changes to the ICO's guidance, those updates may supersede the information provided in this policy to maintain compliance with applicable data protection laws.
If you believe we have not complied with your data protection rights, you also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at www.ico.org.uk.
We implement industry-standard technical and organisational measures to protect your Personal Data and the confidentiality of your Personal Data, including encryption, access controls, and regular security assessments to safeguard against unauthorised access, alteration, disclosure, or destruction.
In addition to technical measures, we maintain robust organisational policies, including staff training on data protection and strict access controls to safeguard your Personal Data.
Further information on our technical measures and organisational measures through compliance activities can be shared on request by contacting us.
We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new Privacy Policy on our website and updating the "Last Updated" date. Please review this policy regularly for updates to how we process your Personal Data.
If you have any questions about this privacy policy or our data processing practices, or to exercise your rights, please contact us at: