1. Roles & Responsibilities

When you use our Service, the organisation using the Service (“Customer”) determines what personal data is collected and why. The Customer is therefore the Data Controller for that personal data. MARKTEQ IT SOLUTIONS LLP acts as a Data Processor on behalf of the Customer except where we explicitly process data for our own purposes (e.g., billing, account administration) — in which case we act as Controller for that limited processing.

Important: The Customer remains responsible for obtaining necessary consents, for lawful collection, and for compliance with all data protection obligations applicable to Controllers.

2. Types of Personal Data We Process

On behalf of our Customers we may process categories of personal data including (but not limited to):

We do not collect special category (sensitive) data unless a Customer explicitly instructs us and appropriate safeguards are in place.

3. Purposes & Lawful Basis

We process personal data only on documented instructions from the Customer and for purposes including:

• Providing, operating and maintaining the Service.
• Authentication, security, fraud prevention and system administration.
• Billing and account management where applicable.
• Assisting Customers to meet their legal obligations.

We do not sell personal data or use Customer data for advertising unrelated to the agreed Service.

4. Data Location & Transfers

All Customer personal data is hosted and processed exclusively in the United Kingdom/Europian Union using AWS/Contabo/Hetzner. We will not transfer personal data outside the UK/EU.

5. Security Measures

We implement appropriate technical and organisational measures to protect personal data, which include:

• Encryption in transit (TLS) and encryption at rest where feasible
• Role-based access control and least privilege principles
• Multi-factor authentication for administrative access
• Logging, monitoring and regular vulnerability management
• Secure backup and restoration procedures

Customers are responsible for access management within their account (e.g., password strength, user permissions, device security).

6. Subprocessors

We engage subprocessors to provide hosting, email delivery, analytics, support and other operational services. Subprocessors are contractually required to implement appropriate safeguards. A non-exhaustive list of current subprocessors is available on request and may include:

• AWS
• Contabo
• Hetzner

We will notify Customers of any new subprocessors and, where required, obtain Customer authorisation when a change materially affects data protection.

7. Data Retention

Retention is controlled by the Customer via account settings. If no instruction is provided, we retain data for a reasonable period after account termination (typically up to 12 months) for backup, legal or contractual reasons and then securely delete or anonymise it. Temporary upload files are deleted within 180 days after processing.

8. Data Subject Rights

We will assist Customers in responding to data subject requests (access, rectification, erasure, restriction, portability, objection and withdrawal of consent) to the extent required by contract and law. Where we act as Processor, we will forward direct requests to the Customer unless otherwise authorised in writing.

To exercise rights, individuals should contact the Customer (Controller) directly. For requests relating to personal data we control as Controller (e.g., account payments), contact: [email protected].

9. Personal Data Breaches

We maintain an incident response plan. In the event of a personal data breach affecting Customer data we will notify the Customer without undue delay and provide available details to help the Customer meet its regulatory obligations. The Customer remains responsible for assessing whether notifications to regulators or data subjects are required.

10. Intellectual Property & Usage Rights

All intellectual property rights in the Service, software, source code, architecture, user interface, and related materials remain the exclusive property of MARKTEQ IT SOLUTIONS LLP. Customers receive a limited licence to use the Service as set out in the relevant commercial agreement. No transfer of ownership of our IP is granted by use of the Service.

11. Limitation of Liability

Subject to applicable law, our liability for claims relating to personal data processed on behalf of the Customer is limited to the fees paid by that Customer to us in the 12 months preceding the claim. We shall not be liable for losses resulting from the Customer's failure to comply with its Controller obligations, including improper data collection or insufficient consent mechanisms.

12. Suspension & Termination

We reserve the right to suspend or restrict access to the Service where required by law, or where continued processing would expose us or the Customer to legal or security risk. On termination, we will return or delete Customer personal data in accordance with the Data Processing Agreement and Customer instructions.

13. Changes to this Policy

We may update this policy from time to time. Material changes will be communicated to Customers. The “Last updated” date at the top indicates the latest revision.

14. Contact

If you have questions about this policy, data processing, or to request the subprocessors list, contact us:

MARKTEQ IT SOLUTIONS LLP
Email: [email protected]