Skip to Content

Our Privacy Policy

We protect and carefully manage our customers' data; find out how.

Introduction

This Privacy Policy (Privacy Policy) describes how Ab11y Software Ltd, registered UK #12452718, (Ab11y, We, Us, or Our) may collect, use, store, disclose, process, and transfer your personal information (Personal Data) through your access to or use of Our products and services, including those at https://www.ab11y.com as well as any subdomains, and related websites offering Our products and services that link to this Privacy Policy, including mobile applications, and other related offerings (collectively, the Service).

This Privacy Policy applies when you use or access the Service or otherwise share any information with Us.

By using the Service or, if required by laws applicable to you, opting into this Privacy Policy, you signify your acceptance of this Privacy Policy. If you do not agree to this Privacy Policy, you must not use the Service.

We reserve the right to modify this Privacy Policy from time to time by posting the changes at https://www.ab11y.com/privacy and may send notification emails regarding such changes. Your continued use of the Service following the posting of such changes will be deemed your acceptance of those changes, unless additional consent is required.

Our appointed Data Protection Officer (DPO) is Mike Southgate. If you have read the following and have any questions, you can contact us via email at support@ab11y.com to request support.

Information we collect from users

In general, we have access to and may collect any information you provide via the Service, including through web form input fields, advertisements, phone calls, email, forums, or other similar means. This could include personal information that can identify or relate to you, including, but not limited to:

You have the choice regarding what information you share and the Service you engage with. You can choose not to provide any information to us; however, some information about you may be required to access the basic functionalities of the Service, for example log in details.

By choosing to contact or correspond with us in ways that include your personal or private data, you agree to our access to your data, storing it as necessary for its intended purpose, and for a reasonable period of time, following applicable laws and in accordance with standard business practices. If you do not agree to our handling of your data as described in this document, do not use the Services and do not submit or send any data to us.

In addition, we may obtain information about you from our partners and other independent third-party sources and add it to our database of information, including any information that you provide to third parties associated with or whose products or services are integrated with the Service.

Sensitive personal information and special category personal data

Under the EU/UK GDPR, “special categories of personal data” include information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data used for identification, health information, and data concerning a person’s sex life or sexual orientation.

Under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), “sensitive personal information” includes many of the same items as above, and also includes government-issued identifiers (such as Social Security or passport numbers), account login credentials, precise geolocation, and the contents of private communications (mail, email, or text messages).

We do not intentionally collect any special category or sensitive personal information and will never ask you to provide it. If you believe that any information you possess falls within these categories, do not submit, send, share or otherwise communicate it with us.

Purposes for using your data

We may use data we hold about you as required to comply with legal obligations, operate our business, protect the vital interests of you, our customers, or the public, or for other legitimate interests described in this Privacy Policy.

More specifically, we may use your personal information to:

Sharing your information with third parties

We share your information with our partners, service providers, contractors, agents, and third-party vendors as needed to fulfil the Service you request or to maintain the operation of our business.

In addition, we may share your information as required by subpoenas, court orders, or other legal process; to establish or exercise our legal rights; to defend against legal claims; or as otherwise required by law. In such cases, we reserve the right to raise or waive any legal objection or right that may be available to us.

When we believe it is appropriate to investigate, prevent, or take action regarding illegal or suspected illegal activities; to protect and defend the rights, interests, or safety of Our company or the Service, Our customers, or others; or in connection with Our Terms of Service and other agreements with customers of which you may be affiliated.

In connection with a corporate transaction, such as a divestiture, merger, consolidation, or asset sale, or in the unlikely event of bankruptcy.

We will only process your Data as explained in this Privacy Policy and if we have a lawful basis for doing so. The lawful bases include obtaining your consent, fulfilling contractual obligations, and furthering our legitimate interests or the legitimate interests of others. The following sections provide a more detailed description of these.

Security measures for protecting your data

Personal information collected by us may be stored and processed in your region and in any other region where we or our affiliates, subsidiaries, or service providers operate facilities. These countries may have data protection laws that differ from the laws of your country (and, in some cases, may not be as protective). However, we have taken appropriate safeguards to ensure that your personal information remains protected following this Privacy Policy.

We take technological and organisational measures designed to protect your personal information against loss, theft, and unauthorised access, use, disclosure, or modification. For example:

We rely on third-party services that may, as part of their service to us, hold data we collect about you. Each service provider is reviewed to ensure they meet our high security standards, protecting any information about you while it is stored in their respective controlled facilities. For more information on our third-party service security policies, practices, and processes, please visit Netlify’s Trust Center, Clerk’s Security Overview, and Neon’s Trust Center.

We comply with all applicable data protection laws, including those related to security breach notification requirements.

Retention policy for your personal information

We may retain your information as long as necessary for the purposes outlined in this Privacy Policy, in a manner consistent with our data retention policy, which is discussed in this section, and for a commercially reasonable time thereafter for backup, archival, fraud prevention or detection, or audit purposes, or as permitted by applicable law. We may retain your personal information in accordance with the original intent of collection or as long as necessary to comply with our legal obligations, maintain accurate accounting, financial, and other operational records, resolve disputes, and enforce our agreements. We will never retain your information for a period longer than permitted by law.

We will determine the appropriate retention period for personal information based on the amount, nature, and sensitivity of the personal data being processed; the purpose for which it was collected; the potential risk of harm from unauthorised use or disclosure of the personal information; whether we can achieve the purposes of the processing through other means; and applicable legal requirements.

After expiration of the applicable retention periods, your personal information will be deleted. As discussed below, you may have the right to request that we delete this information earlier.

Your rights to access and modify personal data

To the extent provided by the law of your jurisdiction, you may:

You may make these requests and any other inquiries about this Privacy Policy by emailing our Data Protection Officer. Any such requests are subject to the protection of the rights of other individuals and applicable law. Additionally, to help protect your privacy and maintain security, we may take steps to verify your identity before granting you access to the requested information.

Location and transfer of your data

Our company is based in the United Kingdom (UK), and our databases are currently located within the European Union (EU). We do not claim that the data we store is appropriate or lawful for use or access outside the UK or EU. If you access the Service from outside the UK or the EU, you consent to the transfer of your personal information from your location to the UK and the EU. You are solely responsible for complying with all local laws, rules and regulations regarding online conduct and access to the Service. By providing us with your information, you further consent to its use and storage within the UK and the EU.

Anonymised data

For the purposes of this Privacy Policy, we rely upon the UK Information Commissioner’s Office (ICO) guidance on the definition and standard of anonymisation.

“In data protection law, anonymous information is data that does not relate to an identified or identifiable person (ie data that is not personal data). Data protection law does not apply to anonymous information.”

We may collect and store statistical data that includes data about you, aggregated at the point of collection with data from other users, and so anonymised in accordance with UK Information Commissioner’s Office (ICO) guidance. We take steps to ensure this data is fully anonymised so that it does not allow us, or any third parties, including our partners, customers, and vendors, to de-anonymise and identify any specific data as relating back to any individual.

We may use, publish, share, sell, distribute, or otherwise disclose such aggregated and anonymised data for any legitimate business-related purpose, such as analysing trends, operational reporting, marketing, commercial, advertising, or research-related reasons.

We regularly review our anonymisation techniques and risk assessments to ensure compliance with current ICO standards.

Age restrictions for data collection

The Service is not intended to be used by children, and you may not use the Service or provide any personal information to Us if you are under the age of 16 (or the lowest age permitted by applicable law) or if you are not old enough to consent to the processing of your personal information in your country. We do not collect or process personal information of individuals under the age of 16 or the lowest permitted age by applicable law, unless we receive all necessary consents from the individual’s parent or guardian.

Data subject rights in the EU, UK, and Switzerland

If you are a resident of the EU, UK, Switzerland, Liechtenstein, Norway, or Iceland, you may have additional rights under the EU or UK General Data Protection Regulation (GDPR) or the Swiss Federal Act on Data Protection (FADP), as applicable, concerning your Personal Data. The following discusses these rights.

For this section, the GDPR definition of ‘Personal Data’ and ‘processing’ is used. Generally, ‘Personal Data’ means information that can be used to identify a person individually, and ‘processing’ relates to actions that can be performed in connection with collecting, using, storing, and disclosing such data. We are the controller of your Personal Data processed in connection with the Service.

If a conflict exists between this section and any other provision of this Privacy Policy, the more protective policy or portion shall govern to resolve such dispute. If you have any questions about this section or whether any of the following applies to you, please get in touch with us.

We may also process Personal Data of our customers’ end users in connection with our provision of services to our customers. In this case, we are the processor of Personal Data. If you have any questions regarding Personal Data when we are the data processor, please contact the controller party in the first instance to address your rights concerning such data.

California resident notice at collection

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act of 2020 (CCPA), requires us to provide some additional information to you. However, please note that this information applies equally to all users of the Services, as detailed in our Privacy Policy.

The following informs you about the categories, purposes, and our use of personal information we collect:

Contact information

Customer service interaction information

Product interaction information

Internet network and device information

Login information

Professional or employment information

Other information

Your choices regarding “sharing” and “selling”: You have the right to opt out of our sale/sharing of your personal information for purposes of online analytics and advertising. Currently, we do not sell or share your data as defined by the CCPA for advertising/analytics purposes, and we have not done so over the past 12 months from the effective date of this Privacy Policy.

Other CCPA rights

Refer to the published California Consumer Privacy Act (CCPA) guidance for more information about your online privacy rights as a California resident.

Right to erasure

We support and comply with Article 17 of the UK GDPR’s ‘right to erasure’ (also called the ‘right to be forgotten’). This allows individuals to request the deletion of their personal data under specific circumstances.

If you would like us to delete any identifiable personal data we hold about you, please contact us using the details in this Privacy Policy. To help protect your privacy and maintain our data security, we will need to verify your identity before granting your request to delete your data. We are committed to provide a response to all such requests within one month.

Please note that we may be required to retain some data, for example to comply with legal obligations. In addition we are unable to delete anonymised data, such as aggregated statistical information that cannot be related to you, and so is not considered ‘personal data’ under GDPR.

This document was last updated and published on 9th of August 2025. Previous versions of this document can be made available upon request.