SERODIN Privacy & Cookies Policy

This Privacy & Cookies Policy explains how LEDUSTRA LTD, trading through SERODIN, collects and processes personal data in connection with the SERODIN service and website.

LEDUSTRA LTD is the controller of the personal data described in this policy, except where it processes personal data contained in documents submitted by a customer solely on that customer's behalf. In those circumstances the customer is the controller and a separate Data Processing Agreement applies.

LEDUSTRA LTD, company number 16783014, of 49 New Road, Eastleigh, England, SO50 8EN. LEDUSTRA LTD forms part of Legistra® Group Limited.

ICO registration number: ZC114830.

Privacy enquiries: privacy@serodin.com.

The personal data we collect relates principally to the individual who creates an account or contacts us, and only where that individual provides it. Depending on the circumstances, this may include:

• name, if provided
• email address
• organisation or business name, where provided
• job title or role, where provided
• account login information
• correspondence with SERODIN
• billing and contact details where required for the customer relationship
• IP address and essential technical and security data generated in connection with use of the service

Where a user chooses to add an organisation logo to their profile or to a public Member profile, we also store that logo.

We do not require users to provide more personal data than is needed to create and operate an account, to provide the service and to communicate with the customer. Information that relates to a subscription or product configuration is treated as personal data only where it actually identifies an individual.

Documents submitted by a customer for anonymisation may contain personal data. That personal data is not collected by LEDUSTRA LTD for its own purposes.

The customer decides which document is submitted, what information the document contains and the purpose for which it is processed. In respect of that data the customer remains the controller, and LEDUSTRA LTD acts as processor only to the extent necessary to perform the anonymisation service.

We process personal data only to the extent necessary to create and operate an account, to provide SERODIN, to authenticate users and to manage the customer relationship.

We also process personal data to issue and administer payments, to respond to enquiries and provide support, to maintain the security of the system, to prevent misuse, and to comply with our legal and accounting obligations.

Marketing and newsletter communications are sent only where the individual has given consent.

Contract. Where processing is necessary to enter into or perform a contract with a customer, we rely on Article 6(1)(b) UK GDPR. This includes creating and operating an account, providing access to SERODIN, supporting the customer and administering a paid service.

Legitimate interests. Where processing is necessary for our legitimate interests, we rely on Article 6(1)(f) UK GDPR. Those interests include the security of the system, the prevention of misuse, the protection of the rights of LEDUSTRA LTD, business administration and customer care. We rely on this basis only where those interests are not overridden by the rights and freedoms of the individual.

Legal obligation. Where we must process personal data to comply with legal, tax, accounting or regulatory obligations, we rely on Article 6(1)(c) UK GDPR.

Consent. We rely on consent under Article 6(1)(a) UK GDPR only for marketing and newsletter communications and, where applicable and required by law, for non-essential cookies. Where we rely on consent for marketing communications, you may withdraw that consent at any time, by using the unsubscribe link in any newsletter email or by contacting privacy@serodin.com.

SERODIN uses Stripe to process payments. Stripe may receive the personal data necessary to process a payment, authenticate the transaction, prevent fraud and administer recurring billing.

SERODIN does not store full payment card details.

We use the following providers in connection with SERODIN:

• Lovable — application and platform infrastructure.
• Railway — backend and document-processing infrastructure.
• Stripe — payment processing.
• Brevo — newsletter and marketing communications where the user has subscribed.
• GitHub — source-code hosting and development infrastructure.

Each provider receives only the data necessary to perform its specific function. Providers do not all receive the same categories of data, and not every provider is involved in the processing of customer documents.

LEDUSTRA LTD does not sell personal data.

Where a provider or its sub-processor processes personal data outside the United Kingdom, LEDUSTRA LTD applies an appropriate transfer mechanism required by UK data protection law, where such a mechanism is required.

Personal data relating to a customer, account holder and the contractual relationship is retained for the duration of the customer relationship and for up to six years after the end of that relationship, where required or appropriate for legal, contractual, accounting, tax or claims purposes.

For newsletter and marketing purposes we retain the email address and marketing preference until consent is withdrawn or the individual unsubscribes, subject only to retaining the minimal information necessary to demonstrate and respect the opt-out.

Document content submitted for anonymisation is processed only for the technical purpose of providing the anonymisation service and is not retained as part of the customer account unless this is technically required by the service.

We send marketing and newsletter communications only where you have given consent.

You may withdraw your consent at any time by using the unsubscribe link in the email or by contacting privacy@serodin.com. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Essential cookies may be used where required for authentication, session management, security and the operation of the website or application.

Non-essential cookies may only be used where applicable and, where required by law, after consent has been obtained.

LEDUSTRA LTD implements appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration, disclosure and misuse.

No online service can be guaranteed to be entirely secure, and we do not claim that security is absolute. Users remain responsible for protecting their own credentials and devices.

Under UK data protection law you have the following rights:

• Right of access — to request confirmation whether personal data is being processed and to obtain a copy of that data.
• Right to rectification — to request correction of inaccurate personal data and completion of incomplete data.
• Right to erasure — to request deletion of personal data where the legal requirements for erasure are met.
• Right to restriction of processing — to request restriction of processing in the circumstances provided by law.
• Right to object — to object to processing based on legitimate interests, and an absolute right to object to direct marketing.
• Right to data portability — where applicable, to receive personal data you provided to us in a structured, commonly used and machine-readable format and to request its transmission to another controller.
• Right to withdraw consent — where processing is based on consent, to withdraw that consent at any time.

Some of these rights are subject to legal conditions and exemptions, and we may need to verify your identity before responding. Requests should be sent to privacy@serodin.com.

SERODIN does not use personal data for profiling and does not make decisions about individuals based solely on automated processing that produce legal or similarly significant effects.

SERODIN is a business and professional service and is not directed at children.

If you have a concern about how we process your personal data, we ask that you contact us first so that we have an opportunity to investigate and resolve the matter. Please write to privacy@serodin.com.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK supervisory authority for data protection, at ico.org.uk. Contacting us first does not limit that right in any way.

We may update this policy to reflect changes in law, changes to SERODIN or changes in the way personal data is processed. The current version is always published on the SERODIN website with its last-updated date.

LEDUSTRA LTD, 49 New Road, Eastleigh, England, SO50 8EN. Company number: 16783014. ICO registration number: ZC114830.

General enquiries: hello@serodin.com. Support: support@serodin.com. Privacy: privacy@serodin.com.