Encodian presents this Privacy Notice in a layered format to support transparency and ease of navigation. Headings are structured to allow you to locate the information most relevant to you, and you may move between sections as needed to understand how your personal data is processed.
Contents
4. Important information and who we are
6. What types of personal data do we collect?
7. Sensitive or Special Category Data
9. How do we collect your Personal Data?
10. How and on what basis do we use your Personal Data?
11. With whom do we share your Personal Data?
13. Cookies and Tracking Technologies
15. How do we protect your Personal Data?
18. How long do we keep your Personal Data?
21. Changes to this Privacy Notice
22. Table 1: Lawful Basis of Processing
23. Table 2: Special Category Data
Your privacy is important to us. Please read this Privacy Notice carefully. It explains how Encodian collects, uses, shares, retains and protects personal data when you interact with us, use our website, communicate with us, enquire about or use our services, attend events, engage with our sales and marketing teams, submit complaints, or apply for a role with us.
This Privacy Notice applies to external personal data processing activities carried out by Encodian as a controller under the UK General Data Protection Regulation and the Data Protection Act 2018. It is intended to be read alongside any additional or more specific privacy notice that we may provide to you in particular circumstances.
This Privacy Notice does not apply to employees in their capacity as employees. A separate employee privacy notice is provided for employment related processing.
This Privacy Notice applies to personal data processed in relation to website visitors, users of our services, customer users and administrators, prospective customers, business contacts, supplier contacts, event attendees, complainants, professional advisers, third parties involved in claims or disputes, and individuals who apply for employment with us.
This Privacy Notice also covers limited recruitment processing before an employment relationship begins, including recruitment applications, CV handling, references and pre-employment checks where appropriate.
We process personal data in accordance with the UK GDPR, the Data Protection Act 2018 and, where relevant, the Privacy and Electronic Communications Regulations 2003.
We process personal data lawfully, fairly and transparently; collect it for specified, explicit and legitimate purposes; ensure that it is adequate, relevant and limited to what is necessary; keep it accurate and up to date where required; retain it only for as long as necessary; and apply appropriate technical and organisational measures to protect it.
Encodian Solutions Limited (“Encodian”, “we”, “us” and “our”) is the controller of the personal data described in this Privacy Notice. Encodian operates the website available at https://www.encodian.com/ (the “Service”).
Where Encodian processes personal data strictly on behalf of a customer and in accordance with that customer’s instructions, Encodian acts as a processor, and the customer remains the controller of that personal data. This Privacy Notice does not replace any privacy notice that may be provided by such customers in relation to their processing activities.
Questions, comments, requests or complaints regarding this Privacy Notice or our use of personal data should be addressed to:
Email: privacy@encodian.com
Registered Address: C/O Shop Circle Ltd, 25 Eccleston Place, London, SW1W 9NF
The personal data we collect depends on the nature of your interaction with Encodian. In line with our business activities and internal records of processing, we may process the following categories of personal data:
Identity Data: may include your name, title and other identifiers used to identify you in a professional or business context.
Contact Data: may include your email address, telephone number, business address and other contact details used to communicate with you.
Professional Data: may include your job title, employer, company name and other information relating to your professional role or business relationship with Encodian.
Business Relationship and Transaction Data: may include records of enquiries, correspondence, customer relationship management (CRM) records, sales opportunity data, engagement history, internal notes, account information, subscription status, service history, purchase or usage history and other records relating to the provision or receipt of services.
Communication Data: may include emails, attachments, correspondence, contact form submissions, support requests, complaint details, meeting content, project notes, transcripts, recordings and other communications with Encodian.
Technical Data: may include internet protocol (IP) address, device information, browser type and version, system configuration data and other technical identifiers, including unique system identifiers where used to support service functionality.
Log and Usage Information: may include information automatically collected when you access our website or services, such as your IP address, browser type and version, pages visited, date and time of access, time spent on pages, system logs, access logs, authentication data, request metadata, timestamps, API usage data, activity logs, performance logs, diagnostic data and security monitoring data.
This may include unique identifiers such as API keys or system-generated identifiers where required for service operation and security.
Customer and Service Data: may include data relating to users of our services, including authorised user details, account identifiers, service usage data, support records, configuration data and other operational data processed in connection with the delivery, maintenance and support of our services.
Recruitment Data: where you apply for a role with Encodian, this may include CV data, application information, employment history, qualifications, interview records, references, right to work information, identity verification data and recruitment-related correspondence.
Complaint, Legal and Claims Data: may include complaint details, investigation records, correspondence, evidence, claim information, incident data and legal records where a complaint, dispute, insurance matter or legal claim arises.
In limited circumstances, personal data may be processed within controlled testing, development or staging environments where necessary to support system functionality, troubleshooting or service improvement. Where this occurs, Encodian applies data minimisation and appropriate technical and organisational safeguards.
Encodian does not intentionally collect more personal data than is necessary for the purposes described in this Privacy Notice.
Encodian does not generally seek to collect special category data through its website, sales, marketing, or ordinary business contact activities (see Table 2: Special Category Data at the end of this document).
Encodian’s services and website are not directed at children, and we do not knowingly collect personal data from individuals under the age of 13.
If we become aware that personal data relating to a child has been collected without appropriate authorisation, we will take steps to delete such information.
From you: we collect personal data directly from you when you contact us, submit an enquiry, use our website, use our services, attend an event, communicate with our teams, submit a complaint, participate in a meeting, or apply for a role.
Automatically: We may collect personal data automatically when you use our website, applications, systems or services, including through logs, cookies, analytics tools, security monitoring tools and service diagnostic tools.
Third Parties: Encodian may obtain personal data from third parties where permitted by applicable law. This may include publicly available sources, such as professional networking platforms and company websites, as well as third-party providers, including event platforms, customer relationship management tools, data enrichment providers and recruitment partners.
Where personal data is obtained from third-party sources, Encodian will ensure that such collection and use is lawful, proportionate and limited to what is necessary for the relevant purpose.
Encodian processes personal data on the basis of contractual necessity, legitimate interests, legal obligations and, where required, consent (see Table 1: Lawful Basis of Processing at the end of this document).
Encodian may share personal data where necessary for the purposes described in this Privacy Notice and in accordance with applicable data protection law.
Internally: we may share personal data internally with authorised personnel across relevant business functions, including sales, marketing, pre-sales, customer support, engineering, IT, security, finance, compliance, legal and management, where access is required for legitimate business purposes.
Third-party service providers: we may also share personal data with third-party service providers who support our business operations. These may include providers of cloud infrastructure, hosting services, customer relationship management systems, marketing and communications platforms, analytics tools, customer support systems, IT support services, security and monitoring tools, finance and accounting systems, and professional advisory services.
Where personal data is shared with service providers acting as processors, Encodian ensures that appropriate contractual arrangements are in place to require such providers to process personal data only on our instructions, maintain confidentiality, and implement appropriate technical and organisational security measures.
In certain circumstances, personal data may be shared with third parties acting as independent controllers. This may include professional advisers, auditors, insurers, brokers, banks, legal representatives, courts, tribunals, regulators, law enforcement bodies, and other parties involved in claims, disputes, complaints or corporate transactions. In such cases, those parties will be responsible for their own compliance with applicable data protection law.
Where relevant, personal data may also be shared with recruitment providers, reference providers or other third parties involved in the recruitment process, strictly to the extent necessary to assess candidate suitability and manage recruitment activities.
Encodian does not sell personal data.
In the event that Encodian is involved in a merger, acquisition, restructuring or sale of assets, personal data may be transferred as part of that transaction.
Where this occurs, personal data will continue to be protected in accordance with applicable data protection law, and individuals will be informed where required.
Encodian uses cookies and similar technologies to operate and improve its website and services, analyse usage and support marketing activities.
Cookies are small text files placed on your device when you visit a website. These may include identifiers that enable us to recognise your device and understand how you interact with our website.
We use both essential cookies, which are necessary for the operation of the website, and non-essential cookies, such as analytics and marketing cookies. Where required by law, we will obtain your consent before placing non-essential cookies on your device.
You can manage your cookie preferences through your browser settings or via the cookie management tools available on our website. Please note that disabling certain cookies may affect the functionality of the website.
Our Cookie Notice can be found here.
Encodian operates using a range of cloud-based systems and service providers that may process personal data outside the United Kingdom, including in the United States and other jurisdictions.
Where personal data is transferred outside the United Kingdom, Encodian ensures that appropriate safeguards are in place in accordance with applicable data protection law. These safeguards may include the use of the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, adequacy regulations, and appropriate transfer risk assessments and due diligence processes.
Encodian does not rely on the EU–US Data Privacy Framework or the UK Extension to the EU–US Data Privacy Framework for the purposes of these transfers.
Further information about the safeguards applied to international transfers may be obtained by contacting us using the details set out in this Privacy Notice.
We apply technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. These measures include access controls, role-based permissions, authentication controls, multi-factor authentication, encryption, logging, monitoring, restricted folder permissions, secure cloud storage, vendor due diligence, contractual controls, least-privilege access, audit trails and ISO27001 aligned security controls where applicable.
Access to personal data is limited to personnel and service providers who have a legitimate need to access it for the purposes described in this Privacy Notice.
Our website may contain links to third-party websites or services that are not operated by Encodian. If you follow a link to a third-party site, you should review their privacy notice as we do not control and are not responsible for the content, privacy practices or policies of those third parties.
Encodian does not carry out automated decision-making, including profiling, that produces legal or similarly significant effects on individuals.
Encodian retains personal data only for as long as necessary to fulfil the purposes for which it was collected, including to meet legal, regulatory, contractual, accounting, security and operational requirements.
Retention periods are determined based on the nature of the personal data, the purpose of processing, applicable legal obligations and relevant limitation periods.
In general:
Business contact, customer and supplier data: is retained for the duration of the relationship and for a reasonable period thereafter, typically up to twenty-four (24) months of inactivity, to enable continued engagement and record-keeping.
Marketing and analytics data: is retained for a limited period, generally between twelve (12) and twenty-four (24) months, depending on the nature of the activity and system configuration.
Technical, security and diagnostic logs: are retained for a short duration, typically between thirty (30) and ninety (90) days, unless a longer period is required for investigation, security, or legal purposes.
Customer service, complaint, contract and legal records, including correspondence and supporting documentation: are retained for the duration of the relevant matter and generally for up to six (6) to seven (7) years thereafter, to reflect applicable legal limitation periods and regulatory requirements.
Recruitment-related personal data: is retained for a period of six (6) months following the conclusion of the recruitment process, unless a longer retention period is required to manage legal risk or where the individual has provided consent for their data to be retained for future opportunities.
Where personal data is retained within backup systems, retention may be subject to defined backup cycles and deletion schedules.
Where no specific retention period is stated, personal data will be retained in accordance with Encodian’s internal retention policies, taking into account the nature of the data, the purpose for which it was collected, applicable legal requirements, and operational necessity. Personal data will be securely deleted or anonymised when it is no longer required.
Under UK data protection law, you have a number of rights in relation to your personal data:
Requests to exercise your rights will be handled in accordance with applicable data protection law. We will respond within the timeframes required by law (typically within one month, subject to any permitted extensions), and we may need to verify your identity before processing your request to ensure that personal data is protected and only disclosed to the correct individual.
You may opt out of receiving marketing communications at any time by using the unsubscribe link included in communications or by contacting us directly.
If you have concerns about how we process your personal data, please contact us.
Encodian takes the protection of personal data seriously and aims to address any concerns promptly and effectively. If you have any questions, concerns or complaints about how your personal data is handled, you should contact us using the details provided in this Privacy Notice.
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner’s Office, which is the supervisory authority responsible for data protection in the United Kingdom.
Encodian may update this Privacy Notice from time to time to reflect changes in legal requirements, business practices or services.
Any updates will be published on this page, and where appropriate, we will take reasonable steps to notify individuals of material changes.
We recommend that you review this Privacy Notice periodically.
| Lawful Basis | Purpose | Legitimate Interests | Categories of Personal Data | Examples of Personal Data |
| Contract / steps prior to contract | To respond to sales enquiries, manage pre-contract discussions, prepare proposals, provide quotes and onboard customers. | N/A | Identity Data; Contact Data; Professional Data; Business Relationship and Transaction Data; Communication Data | Name, email address, telephone number, company, job title, correspondence, enquiry details and deal records. |
| Contract | To provide, administer and support Encodian services, including SaaS delivery, account management, API usage, service monitoring and customer communications. | N/A | Identity Data; Contact Data; Customer and Service Data; Usage and Log Data; Technical Data; Communication Data | Customer contact details, authorised user data, account identifiers, service usage data, API metadata, system identifiers, API keys where applicable, support records and operational data. |
| Contract | To deliver professional services, including meetings, project delivery, documentation, recordings, transcripts and project communications. | N/A | Identity Data; Contact Data; Professional Data; Communication Data; Business Relationship and Transaction Data | Name, email address, meeting content, recordings, transcripts, project notes, correspondence and engagement records. |
| Contract | To manage supplier, vendor and professional service relationships, including onboarding, contract performance, communications and payment administration. | N/A | Identity Data; Contact Data; Professional Data; Business Relationship and Transaction Data; Communication Data | Supplier contact data, company details, job title, role, contract records, correspondence and payment-related data. |
| Contract / steps prior to contract | To manage recruitment processes prior to employment, including applications, interviews, candidate assessment and communications. | N/A | Identity Data; Contact Data; Professional Data; Recruitment Data; Communication Data | Name, contact details, CV data, employment history, qualifications, interview notes, references, right to work data, identity verification data and recruitment correspondence. |
| Legitimate interests | To manage customer and prospect relationships, including CRM management, lead tracking, internal contact records and account development. | Managing and developing proportionate B2B relationships, maintaining accurate business contact records and supporting commercial growth in a professional context. | Identity Data; Contact Data; Professional Data; Business Relationship and Transaction Data; Communication Data | Name, email, company, job title, professional role, telephone number, CRM records, internal notes, interaction history and engagement data. |
| Legitimate interests | To manage enquiries, contact form submissions, business correspondence and sales communications. | Responding to enquiries, maintaining business continuity and ensuring effective and proportionate communication. | Identity Data; Contact Data; Professional Data; Communication Data; Business Relationship and Transaction Data | Name, email, company, job title, correspondence history, enquiry details and attachments. |
| Legitimate interests | To conduct marketing, event follow-up, lead nurturing and business development activities, including use of publicly available and third-party enrichment data. | Developing business opportunities, maintaining engagement with relevant professional contacts and ensuring communications are relevant and proportionate. | Identity Data; Contact Data; Professional Data; Marketing and Analytics Data; Business Relationship and Transaction Data | Name, email, company, job title, engagement data, event attendance, publicly available profile data and enrichment data. |
| Legitimate interests / PECR soft opt-in where applicable | To send marketing communications to existing customers about similar services. | Promoting relevant services to existing customers and maintaining commercial relationships, with clear opt-out mechanisms. | Identity Data; Contact Data; Professional Data; Marketing and Analytics Data | Name, email, company, job title, service history, engagement data and marketing preferences. |
| Consent (where required) | To send marketing communications where consent is required and to use cookies and analytics tools. | N/A | Identity Data; Contact Data; Marketing and Analytics Data; Technical Data; Usage and Log Data | Contact details, marketing preferences, cookie identifiers, technical data, analytics and usage data. |
| Legitimate interests | To analyse marketing effectiveness and improve campaigns. | Understanding engagement, improving marketing effectiveness and ensuring communications remain relevant and proportionate. | Marketing and Analytics Data; Technical Data; Usage and Log Data | Engagement data, usage data, analytics data, tracking data and performance metrics. |
| Legitimate interests | To operate website functionality, live chat and user support channels. | Providing efficient support, responding to user queries and improving service delivery and user experience. | Identity Data; Contact Data; Communication Data; Technical Data; Usage and Log Data | Name, email, chat transcripts, IP address, session data and enquiry content. |
| Legitimate interests | To monitor and secure systems, including security logging, access monitoring, authentication controls and threat detection. | Protecting systems, preventing unauthorised access, detecting misuse and ensuring the confidentiality, integrity and availability of services. | Technical Data; Usage and Log Data; Customer and Service Data | IP address, device data, authentication data, access logs, security logs, identifiers and timestamps. |
| Legitimate interests | To monitor system performance, diagnostics and service reliability, including usage tracking and error monitoring. | Ensuring systems function effectively, identifying and resolving issues and maintaining performance and availability. | Technical Data; Usage and Log Data; Customer and Service Data | Usage data, performance data, error logs, diagnostics, identifiers and timestamps. |
| Legitimate interests | To monitor SaaS services and API usage, including diagnostics, billing and service optimisation. | Ensuring service efficiency, maintaining accurate billing, improving system performance and supporting operational effectiveness. | Customer and Service Data; Usage and Log Data; Technical Data | User identifiers, account identifiers, usage data, API metadata, request data, logs, timestamps and system identifiers. |
| Legitimate interests | To administer production systems and provide controlled support access. | Maintaining secure and reliable operation of services and resolving customer issues efficiently. | Customer and Service Data; Technical Data; Usage and Log Data; Communication Data | Customer contact data, system data, identifiers, API keys, support records and operational data. |
| Legitimate interests | To manage complaints, disputes and investigations. | Resolving issues, improving services and protecting Encodian’s legal and business position. | Identity Data; Contact Data; Communication Data; Complaint, Legal and Claims Data | Name, contact details, complaint data, correspondence, investigation records and evidence. |
| Legitimate interests | To manage legal claims, contracts, disputes, insurance matters and corporate risk. | Protecting legal rights, managing risk, ensuring business continuity and complying with contractual and legal obligations. | Identity Data; Contact Data; Business Relationship and Transaction Data; Complaint, Legal and Claims Data | Contact data, contract records, claim data, correspondence, evidence and legal records. |
| Legitimate interests | To carry out supplier due diligence, onboarding and risk assessment. | Ensuring suppliers meet legal, operational and security requirements and managing third-party risk. | Identity Data; Contact Data; Professional Data; Business Relationship and Transaction Data | Suppliers contact data, company details, due diligence records and compliance data. |
| Legal obligation | To comply with legal and regulatory requirements, including responding to lawful requests and maintaining required records. | N/A | All relevant categories of personal data depending on the legal requirement | Any personal data required to comply with legal obligations, including records, correspondence and compliance documentation. |
| Purpose | Legal Basis | Data Used |
| To make reasonable adjustments when individuals engage with Encodian, including during recruitment, meetings, events or service interactions | Necessary for carrying out obligations and exercising rights in the field of employment or equality of opportunity, in accordance with Schedule 1 of the Data Protection Act 2018 | Health or accessibility information voluntarily provided |
| To manage complaints, disputes, insurance matters or legal claims where sensitive data is included | Necessary for the establishment, exercise or defence of legal claims (Schedule 1 Data Protection Act 2018) | Health data or other sensitive information contained within complaints, claims or dispute records |
