Privacy Policy

Safeguarding your privacy and upholding your rights as a user is a focal commitment at PolicyCON. This Privacy Policy explains how PolicyCON collects, uses, and shares your personal data when you interact with our services.

You'll learn about:

• The types of personal data we collect, such as your account details, activity information, and data collected through cookies.
• How we use your data to provide and improve our services, communicate with you, and ensure security.
• When and with whom we may share your data, including third-party service providers and legal authorities.
• Your rights regarding your personal data, including how to access, correct, or delete it.
• How we protect your data and manage cross-border transfers.

For more detailed information, please read the full Privacy Policy.

It is crucial to note that your involvement with PolicyCON is governed by our Terms of Use, which should be read alongside this Privacy Policy. Any terminology not clearly defined in this Privacy Policy can be referenced in the Terms of Use.

This Privacy Policy is effective as of Tuesday, the 15th of Ocober 2024.

PolicyCON, referred to as ‘PolicyCON’, ‘we’ or ‘us’, is committed to detailing the use, collection and disclosure of information about you. This Privacy Policy applies when you engage with our mobile applications, online products, website and services linked to this Privacy Policy (collectively, our ‘Services’), contact our customer support team, interact with us through social media or otherwise establish a network.

Acknowledging the dynamic nature of data safeguarding regulations, we may periodically alter this Privacy Policy. Such modifications will be displayed at the top of this policy. In particular situations, additional notifications might be given to emphasise awareness and transparency such as email notifications. We advocate that you review this Privacy Policy occasionally to remain informed about our data practices. If you have any questions about this Privacy Policy, including any requests to exercise your legal rights, please contact us using the information set out in the contact details at the end of this Privacy Policy.

Consumer Protection and Collection of Personal Data

Collection of Personal Data

We collect the information that you provide directly to us. This includes situations where you establish an account, submit content through our Services, complete a form, communicate via third-party platforms, buy a membership, request customer assistance, or otherwise engage with us. The personal data we gather includes your first name, last name, username, bio, display name, business details, email address, user-generated content such as photos, posts, avatar images, responses and series you authored, and any additional data you choose to share.

In certain situations, we may also obtain personal data concerning others from you. For example, when you buy a PolicyCON membership as a gift, we use this data exclusively for fulfilling requests and do not initiate interactions with your contacts unrelated to your request unless their clear consent is given.

PolicyCON does not typically collect sensitive personal data unless it is necessary for providing our services. Sensitive personal data includes information such as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health information, or sexual orientation. If we do collect any sensitive personal data, we ensure it is handled with the highest level of security and only used for the specific purposes for which it was collected. This may include:

• Obtaining explicit consent from you before collecting or processing such data.
• Limiting the use of sensitive data to the purpose for which it was collected.
• Implementing additional security measures to protect this data from unauthorized access or disclosure.

In any situation where we collect sensitive personal data, we will provide clear information about the data being collected, its purpose, and your rights regarding this information. It is pivotal to note that we do not request payment information directly through our Services. We depend on third-party payment processors to assist with transactions. Any data given for payment processing is subject to the privacy policy of these third-party processors. For detailed information on how Stripe handles your payment data, please review Stripe’s Privacy Policy directly on their website. This policy outlines Stripe’s practices regarding data collection, usage, and protection.

Information We Automatically Collect When You Engage With Us

At times, we automatically collect specific information, which includes:

• Transactional Information
  When you choose a subscription, we record transaction details such as purchase amount, subscription specifications and transaction data. We collect this data because of the contract that you have entered into with us to provide the subscription services to you. If we did not collect this information, then we would be unable to accurately provide these services to you.
• Activity Information
  We gather data about your interaction with our Services, including your reading history and actions such as following users, sharing links, highlighting posts, posting comments and reacting to content. This information is collected to personalise your experience, recommend content, and improve our services based on user engagement patterns.
• Device and Usage Information
  We compose information pertaining to your engagement with our Services, such as details about the network and device you utilise. This includes hardware model, mobile network, operating system version, IP address, unique device identifiers, app version and browser type. Additionally, we monitor access times; links clicked, pages viewed, and the webpage you visited before navigating to our Services. Collecting this data helps us ensure the compatibility of our services with various devices, diagnose technical issues, and enhance overall user experience by understanding usage patterns.
• Information Collected by Cookies and Similar Tracking Technologies
  
  Involving tracking methods such as cookies and web beacons allows us to gain insights into your preferences and enhance your experience. These technologies offer the ability to determine popular areas and the performance of our Services and keep counts of visits. Moreover, we collaborate with third-party analytics providers who use similar technologies to evaluate usage patterns, customise content to suit your interests and determine content popularity. We collect this data based on your consent to understand how our services are used, improve functionality, and provide personalised content. For more information regarding how we use cookies, please refer to our Cookies Policy.

Legal Basis

The law requires us to have a legal basis for collecting and using your personal data. We rely on one or more of the following legal bases:

• Performance of a contract with you: Where we need to perform the contract we are about to enter into or have entered into with you.
• Legitimate interest: We may use your personal data where it is necessary to conduct our business and pursue our legitimate interests. We make sure we consider and balance any potential impact on you and your rights (both positive and negative) before we process your personal data for our legitimate interests. 
• Legal obligation: We may use your personal data where it is necessary for compliance with a legal obligation that we are subject to. We will identify the relevant legal obligation when we rely on this legal basis.
• Consent: We rely on consent only where we have obtained your active agreement to use your personal data for a specified purpose, for example if you subscribe to an email newsletter.

Consumer Law and Use of Personal Data

Use of Personal Data

The personal data we collect is vital in providing, maintaining and improving our services. This encompasses actions such as distributing user-generated content, customising the content you encounter and operating our metered paywall. We also apply the data for:

• Processing transactions and transmitting related information such as receipts, confirmation and user experience surveys;
• Establishing and assisting your PolicyCON account;
• Conveying security alerts, technical notes, and administrative and support messages;
• Replying to comments, inquiries and questions while providing customer service;
• Keeping you informed about novel content, services, features, and products, in addition to sharing relevant information and news likely to interest you;
• Analysing and monitoring trends, utilisation patterns, and activities in connection to our Services;
• Identifying, investigating and preventing security incidents as well as deceptive, fraudulent, malicious or illegal activities that could endanger PolicyCON and its users;
• Amending errors in our Services and correlating with financial and legal responsibilities;
• Accomplishing any other purpose represented during the time the information was gathered.

Direct Marketing

You will receive marketing communications from us if you have requested information from us or purchased goods or services from us and you have not opted out of receiving the marketing.

You can ask us to stop sending you marketing communications at any time by updating your marketing preferences on your account settings on the website. If you opt out of receiving marketing communications, you will still receive service-related communications that are essential for administrative or customer service purposes, for example updates to our Terms of Use and checking that your contact details are correct.

Empowerment through Sharing

Sharing of Personal Data

We may share your personal data, where necessary, with third parties for the purposes as outlined below:

• Sharing with Other Users
  When users post comments, publish content, post comments or send private messages, and select information about them, they become visible to others. This can include name, bio, photo and activity on our Services, such as followers, highlights, responses and recent posts. We collect this data to provide and enhance the interactive features of our Services. Example: If an analyst named Jane Doe posts a policy review, her profile information including her bio, photo, and recent activity such as highlights and responses will be visible to other users. As a user of our Services, you are responsible for the personal data that you choose to make public.
• Third-Party Service Providers
  We cooperate with service providers, vendors and consultants who require access to personal data to perform services such as analytics, payment processing, security, web hosting, communication, marketing and customer service. Examples include Stripe for payment processing, Google Analytics for usage analysis, SendPulse for email marketing, Azure for web hosting, MS teams for internal communications among team members etc. We collect this data to ensure our services are provided effectively and securely, complying with the contracts we have with these providers. We will ask for your express consent before we share your personal data with any third party for their own direct marketing purposes.
• Legal and Regulatory Compliance
  
  Personal data may be shared when necessary to comply with relevant laws, public authorities’ lawful requests or legal processes. Prior notice will be provided to affected parties in case of a legal request for disclosure whenever possible. This ensures we meet our legal obligations and protect our interests. The legal obligations may include:
  Examples of entities that your data may be shared with for compliance purpose include but not limited to: UK Information Commissioner’s Office (ICO), HM Revenue and Customs (HMRC), Police and other law enforcement agencies.
• Compliance with Laws: Processing data to comply with legal requirements, such as tax regulations or law enforcement requests
• Regulatory Requirements: Meeting obligations under data protection laws like GDPR and CCPA.
• User Rights: Facilitating user rights requests, such as access or deletion of data.
• Protection of Interests
  
  Personal data may be shared when we believe enforcing our agreements, legal rights or policies is necessary. This includes situations where actions are inconsistent with agreements or legal, policy violations are suspected, or protection of property, rights and safety is needed. We collect and process this data to safeguard our operations and enforce our policies. Examples of organsiations in this context that data would be shared with include but not limited to Legal advisors such as our retained law firms, Security consultants to investigate breaches or threats, etc.
• Professional Advisors and Business Transactions
  Sharing personal data with legal representatives and professional advisors is undertaken where required for gaining advice or protecting safeguarding business interests. Additionally, personal data may be revealed during negotiations regarding mergers, financing, acquisitions or sales of assets. This ensures we can effectively manage and protect our business operations. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this Privacy Policy. Examples of organisation with whom data may be shared include but not limited to Law firms, Accounting firms, Investment banks as part of our operating procedure and or during mergers and acquisitions processes
• Affiliates and Subsidiaries
  We share personal information within the PolicyCON network, including current and future parents, subsidiaries and affiliates, and other entities under common ownership.
• With your consent
  Sharing of personal data happens with user consent or with your clear direction.
• Aggregated or De-Identified
  
  Personal data is shared in a way that cannot adequately lead to identification. In these circumstances, once the personal data can no longer be associated with you and is anonymised, then it can no longer be called your personal data. We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
  We may share your personal data with the following third parties:
  The types of data collected and why include:
• [Insert details about the third-party service providers that currently receive any personal data from PolicyCON and the purpose why the personal data is shared with them];
• Third-Party Analytics Providers: For example, Google Analytics helps us evaluate usage patterns, customise content to suit your interests, and determine content popularity. This aids in optimising our services and delivering relevant content to you.
• Payment Processors: Stripe handles our payment transactions securely. Stripe processes payment information and ensures that transactions are completed smoothly while maintaining compliance with regulatory requirements.
• Cloud Service Providers: We use Azure to host our platform and store data securely. Azure ensures the availability and integrity of our data while providing scalable solutions to meet our operational needs.
• Customer Support Services: For instance, Zendesk enables us to provide efficient customer service and support. Zendesk helps us manage customer queries, track issues, and improve our customer service experience.
• Marketing and Communication Services: We use SendPulse to manage and deliver email marketing campaigns. SendPulse helps us communicate with our users effectively and personalise marketing messages.
• Legal and Regulatory Authorities: Personal information may be revealed to comply with legal obligations and respond to lawful requests from public authorities or legal processes. This ensures we meet our legal obligations and protect our interests.
• Professional Advisors: Our legal representatives, gain access to personal data when required for legal advice or to protect business interests. Our legal advisors assist us in navigating legal challenges and ensuring compliance with relevant laws.
• Business Transaction Partners: During business transactions such as mergers, acquisitions, or sales of assets, we may share data with partners like investment banks to manage and execute these transactions efficiently.
• Affiliates and Subsidiaries: Within the PolicyCON network, including current and future parents, subsidiaries, and affiliates such as PolicyCON Europe Ltd., we share personal information to streamline operations and provide a unified service.
• With Your Consent: Sharing personal information happens with user consent or at their clear direction, ensuring transparency and user control over their data. For instance, data may be shared with external research partners or academic institutions for collaborative studies with explicit user consent.
• Aggregated or De-Identified Data:Data is used for analysis and service improvement without compromising user privacy, such as sharing usage trends with public policy research bodies or industry analysts without revealing personal identifiers.
• Transactional Information: When you choose a subscription, we record transaction details such as purchase amount, subscription specifications, and transaction data. We collect this data because of the contract that you have entered into with us to provide the subscription services to you. If we did not record this information, then we would be unable to accurately provide these services.
• Activity Information: We gather data about your interaction with our Services, including your reading history and actions such as following users, sharing links, highlighting posts, posting comments, and reacting to content. This information helps us improve our services and personalise your experience.
• Device and Usage Information: We compose information pertaining to your engagement with our Services, such as details about the network and device you utilise. This includes hardware model, mobile network, operating system version, IP address, unique device identifiers, app version, and browser type. Additionally, we monitor access times; links clicked, pages viewed, and the webpage you visited before navigating to our Services. This data is essential for security, troubleshooting, and improving our services.
• Information Collected by Cookies and Similar Tracking Technologies: Involving tracking methods such as cookies and web beacons allows us to gain insights into your preferences and enhance your experience. These technologies offer the ability to determine popular areas and the performance of our Services and keep counts of visits. Moreover, we collaborate with third-party analytics providers who use similar technologies to evaluate usage patterns, customise content to suit your interests, and determine content popularity. This information helps us optimise our services and deliver relevant content to you.

Upholding Privacy in Third–Party Embeds

Third-party Embeds

Cross – Border Data Transfers and Your Rights

Transfer of Personal Data to the UK and Other Countries

User Choices and Enhanced Control

Your Choices

• Account Information
  You can access, export, delete and edit your account information by logging into our Services and navigating to the Settings page. Please note that deleting your account does not erase data retained for legal or legitimate business purposes.
• Cookies
  Most web browser default to accepting cookies. However, you may adjust browser settings to decline or delete cookies. Note that this might affect the availability and functionality of our Services. Please refer to our Cookies Policy for further information on how we use cookies on our website.
• Mobile Push Notifications
  With your consent, we send push notifications to your mobile device. You will be able to manage these notifications by changing your mobile device’s notification settings, or by contacting us directly to opt-out of these notifications, or by amending your notification settings on the Settings page of our website.

Consumer Protection and UK, European Users

Additional Disclosures for Individuals in the UK and the EEA

For users located in the United Kingdom or the EEA, this section states specific protection and rights applicable to your personal data processing under the, respective, UK GDPR or the GDPR.

You have the right to:

• Access - Request access to your personal data (commonly known as a "subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
• Correction – Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected.
• Erasure – Request erasure of your personal data in certain circumstances. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Object – Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) as the legal basis for the particular use of your data. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your right to object.
• Direct Marketing – You also have the absolute right to object any time to the processing of your personal data for direct marketing purposes.
• Transfer – Request the transfer of your personal data to you or to a third party.
• Rectification – Request rectification of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in one of the following scenarios:
• If you want us to establish the data's accuracy;
• Where our use of the data is unlawful but you do not want us to erase it;
• Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
• You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
• Data portability – You can request to receive your personal data in a structured, commonly used, and machine-readable format. Additionally, you have the right to request the transfer of this data to another data controller, where technically feasible.
• In relation to Automated Decision-Making and Profiling – You have the right not to be subject to decisions based solely on automated processing, including profiling, if such decisions have legal effects or similarly significant impacts on you. You can request human intervention, express your point of view, and contest the decision.
• Withdraw consent – Where processing is based on your consent, you have the right to withdraw it at any time. This can be managed through your account settings or by contacting us directly. Withdrawal of consent does not affect the lawfulness of processing before its withdrawal.

If you wish to exercise any of the rights set out above, please contact us using the contact details provided at the end of this Privacy Policy.

Data Retention

• Retention Criteria
  
  
• Purpose Limitation: Data is retained only for as long as necessary to fulfil the purposes for which it was collected. For example, if data is collected to process a transaction, it will be retained for as long as necessary to complete the transaction and handle any related inquiries.
• Legal Requirements: Data may be retained to comply with legal obligations, such as tax or accounting requirements. For instance, transaction records are kept for a minimum of 7 years to comply with financial regulations.
• Contractual Obligations: Data related to contractual agreements will be retained for the duration of the contract and a reasonable period thereafter to address any potential disputes or fulfil warranty obligations. For example, account information may be retained as long as the account is active and for a period of 1 year after account closure.
• User Preferences: Users can request data deletion or modification at any time. In such cases, data will be retained only as long as necessary to honour the request and as required by applicable laws or regulations.
• Data Minimization: We regularly review our data retention practices to ensure that data is not kept longer than necessary. Data that is no longer required for its original purpose is securely deleted or anonymized.
• Specific Examples
  
  
• Account Information: Retained for as long as the account is active. After account closure, data is kept for up to 1 year for administrative purposes.
• Transaction Records: Retained for a minimum of 7 years to comply with tax and accounting regulations.
• Marketing Data: Retained for 2 years after the last interaction with our marketing communications, unless you opt out earlier.
• Customer Support Data: Retained for 3 years after the resolution of the support request to address any follow-up issues or disputes.
• User Preferences and Opt-Outs: Retained for 1 year to ensure compliance with user preferences and to manage opt-out requests.

Data Security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Inquiries, Concerns and Contact

Questions or Complaints

If concerns about our data processing remain unsolved, you have a right to lodge a complaint at any time to your respective Data Protection Authority. Upon receiving your complaint, we will respond as soon as we can. The relevant Data Protection Authority for users based in the UK is the Information Commissioner's Office (ICO). You can contact them directly at www.ico.org.uk or you can phone them at 0303 123 1113.

Contact Us

For any inquiries regarding this Privacy Policy, please contact us at [insert contact details]. If you are a user from the EEA, UK or California, and you seek clarification about this Privacy Policy, please contact us at [insert contact details]. PolicyCON aims to create an enriching and secure online environment for all its users by fostering transparency, committing to responsible data management, and respecting your rights.

Changes to our Privacy Policy

We keep our Privacy Policy under regular review. This version was last updated on the 15th of October 2024.

Informing Users About Changes:

• Document Updates: We will update the Privacy Policy document to reflect any changes. The updated policy will be posted on our website, with the date of the most recent revision clearly displayed at the top of the document.
• Email Notifications: For significant changes that impact your rights or our practices, we will notify you via email. This email will be sent to the address associated with your account and will include a summary of the changes and their implications.
• In-App Notifications: If you use our mobile or web applications, we may provide in-app notifications or pop-ups to inform you about major updates to the Privacy Policy when you log in or access certain features.
• Notice on Homepage: We may place a prominent notice or banner on our website’s homepage or other key pages to alert you to significant updates or changes to the Privacy Policy.
• User Agreement Review: In some cases, you may be required to review and accept the updated Privacy Policy as part of your continued use of our Services. This ensures that you have read and agreed to the revised terms.
• Policy Review Reminders: We encourage you to review the Privacy Policy periodically to stay informed about how your personal data is managed. Regular updates may include notices through various communication channels to ensure you are aware of significant changes.

It is important that the personal data we hold about your is accurate and current. Please keep us informed if your personal data changes during your relationship with us, for example a new address or email address.