RegBeat — Privacy Policy

Effective date: [DATE]
Last updated: [DATE]

1. Introduction

This Privacy Policy explains how [FULL LEGAL COMPANY NAME], trading as Boroscope (“Boroscope”, “we”, “our” or “us”), collects, uses, shares, stores and protects personal information in connection with the RegBeat platform and related services.

This Policy applies to:

• Visitors to https://www.boroscope.com and related websites.

• Individuals enquiring about RegBeat.

• Prospective customers and demonstration participants.

• Registered users and organisation administrators.

• Employees, contractors and other authorised users of customer organisations.

• Individuals communicating with our sales, billing, support or security teams.

• Other individuals whose personal information we process for our own business purposes.

RegBeat is primarily a business-to-business regulatory technology platform.

When RegBeat processes information uploaded or submitted by a customer organisation, that organisation may be the data controller and Boroscope may act as its data processor. Those processing activities are governed by the customer’s instructions and the applicable Data Processing Agreement.

2. Who We Are

The organisation responsible for processing personal information for its own business purposes is:

[FULL LEGAL COMPANY NAME]
Trading as Boroscope
Company registration number: [NUMBER]
Registered office: [ADDRESS]
Website: https://www.boroscope.com
Privacy enquiries: [PRIVACY EMAIL]
Data Protection Officer, if appointed: [DPO CONTACT OR NOT APPLICABLE]

For applicable UK data protection law, Boroscope acts as a controller for personal data collected and processed for its own purposes.

Where we process personal information solely on behalf of a customer organisation under its instructions, we act as a processor.

3. Information We Collect

Depending on how you interact with us, we may collect the following categories of personal information.

3.1 Account and identity information

• Name.

• Business email address.

• Employer or organisation.

• Job title.

• User identifier.

• Organisation membership.

• Account status.

• Role and assigned permissions.

• Authentication and login information.

• Account creation and modification timestamps.

Passwords and other credentials are handled through the applicable authentication and security mechanisms.

3.2 Organisational information

Customers may supply information concerning their organisation, including:

• Legal entity details.

• Operating jurisdictions.

• Regulatory authorisations and permissions.

• Business activities.

• Products and services.

• Internal departments.

• Regulatory responsibilities.

• Employee and accountable-owner information.

Some organisational information may identify individual employees, managers, directors or other representatives.

3.3 Billing and subscription information

Where subscriptions or other paid services are offered, we may process:

• Billing contact name and email address.

• Billing address.

• Customer organisation details.

• Subscription plan and status.

• Invoice and payment history.

• Transaction identifiers.

• Applicable tax information.

• Payment status.

• Relevant payment method metadata.

Payment card details may be handled by an authorised payment processor.

We will identify the applicable payment provider and processing arrangement before introducing paid checkout functionality.

3.4 Customer-uploaded content

Depending on the enabled Services, customer organisations may upload or submit:

• Policies and procedures.

• Controls and risk registers.

• Regulatory documents.

• Compliance assessments.

• Implementation records.

• Evidence and supporting documentation.

• Internal governance records.

• Spreadsheets and structured data.

• Notes, comments and reviewer decisions.

• Other authorised business information.

Such documents may contain personal information about employees, customers, suppliers, contractors or other individuals.

The customer organisation is generally responsible for determining whether it has a lawful basis to supply and process that information.

3.5 Usage and technical information

We may collect technical and operational information required to provide and secure the Services, including:

• IP address.

• Device and browser information.

• Login and access timestamps.

• Session and authentication events.

• User activity and administrative actions.

• Service requests and API activity.

• Error and diagnostic information.

• Security events.

• Feature usage records.

• Operational performance information.

We limit collection of technical information to what is reasonably necessary for the relevant purposes.

3.6 Communications

We may process information provided when individuals:

• Contact our support team.

• Request a demonstration.

• Submit an enquiry.

• Report a defect or security concern.

• Request an invoice.

• Discuss a subscription.

• Participate in customer research.

• Provide feedback.

This may include contact details, correspondence, support attachments and relevant case history.

3.7 Cookies and similar technologies

Our websites and applications may use cookies or similar technologies for authentication, security, session management, user preferences and, where deployed, analytics.

Details of non-essential cookies and choices available to website users will be disclosed through the applicable cookie notice or consent interface.

We will obtain consent where required before placing or accessing non-essential cookies.

4. Sources of Personal Information

We may receive personal information:

• Directly from individuals.

• From customer organisations and their administrators.

• From authorised users.

• Through registration or subscription processes.

• From communications and support requests.

• From connected systems authorised by customers.

• From identity and authentication providers.

• From authorised payment processors.

• From public business records and professional contact sources where lawfully used.

• From technical interactions with our websites and applications.

Customer-uploaded information is processed according to the applicable contractual and data protection arrangements.

5. How We Use Personal Information

We use personal information for the following purposes.

5.1 Providing the Services

To create accounts, authenticate users, manage permissions, process authorised customer instructions, deliver subscribed functionality and support platform operation.

5.2 Managing customer relationships

To communicate with customers, manage contracts, provide support, respond to enquiries and administer business relationships.

5.3 Processing subscriptions and payments

To establish subscriptions, manage billing, issue invoices, process payments, handle refunds where applicable and maintain appropriate financial records.

5.4 Security and fraud prevention

To protect accounts, detect unauthorised activity, investigate security events, prevent abuse and maintain the integrity of our systems.

5.5 Improving reliability and functionality

To diagnose failures, understand technical performance, address defects, maintain compatibility and improve authorised functionality.

Where possible, we use aggregated, minimised or de-identified operational data for these purposes.

5.6 Legal and regulatory compliance

To meet applicable legal duties, maintain necessary records, respond to lawful requests and establish, exercise or defend legal claims.

5.7 Business communications

To send necessary service communications, security notices, subscription information and administrative messages.

We may send optional marketing communications where permitted by applicable law and subject to any required consent or objection rights.

Recipients may opt out of marketing communications using the provided unsubscribe mechanism or by contacting us.

6. Lawful Bases for Processing

Where UK GDPR applies and Boroscope acts as a controller, we rely on the lawful basis appropriate to the relevant processing activity.

Our legitimate interests include maintaining secure services, supporting business customers, responding to enquiries, improving platform reliability and protecting our business against misuse.

Where we rely on legitimate interests, we consider the interests, rights and freedoms of affected individuals.

Where we rely on consent, individuals may withdraw that consent at any time, without affecting processing lawfully carried out before withdrawal.

Where Boroscope acts as a processor, the customer organisation is responsible for establishing the lawful basis for the relevant controller-directed processing.

7. Customer Data and Controller–Processor Responsibilities

RegBeat may process personal information contained in Customer Data on behalf of customer organisations.

In those circumstances:

• The customer organisation generally determines the purpose and lawful basis of the processing.

• The customer organisation determines which information is submitted.

• Boroscope processes the information according to documented contractual instructions, subject to applicable law.

• Boroscope applies the technical and organisational safeguards required by the applicable processing agreement.

• Boroscope assists the customer with applicable data protection obligations as required by the Data Processing Agreement.

Customers are responsible for ensuring that their users and other affected individuals receive appropriate privacy information where required.

Where Boroscope receives a privacy rights request relating to information it processes solely on behalf of a customer, Boroscope may direct the requester to that customer or assist the customer in responding.

8. AI-Assisted Processing

8.1 Use of artificial intelligence

RegBeat may use artificial intelligence and machine learning to support certain features, including:

• Regulatory text analysis.

• Document classification.

• Identification of candidate regulatory requirements.

• Regulatory summarisation.

• Applicability and contextual interpretation.

• Mapping recommendations.

• Implementation analysis.

• Other enabled intelligence features.

8.2 Information processed by AI services

Depending on the relevant feature and customer configuration, AI processing may involve selected regulatory text, authorised customer content, contextual information and instructions necessary to perform the requested task.

We seek to limit AI processing to the information reasonably required for the relevant operation.

8.3 Human review

AI-generated information may be incomplete, incorrect or uncertain.

RegBeat is designed as a decision-support service, and significant legal, regulatory and compliance decisions remain the responsibility of appropriately authorised customer personnel.

The platform’s use of AI does not itself mean that an automated decision with legal or similarly significant effects is being made about an individual.

Any processing that constitutes automated individual decision-making within the meaning of applicable data protection law requires an appropriate lawful basis, safeguards and additional transparency where required.

8.4 Model training

Boroscope does not use non-public Customer Data to train or fine-tune general-purpose AI models for Boroscope or third-party use without separate, explicit contractual authorisation.

Where an external AI provider is used, its data-handling terms, retention arrangements and any permitted processing must be assessed against the applicable customer agreement and data protection requirements.

8.5 AI providers and deployment arrangements

AI features may use customer-selected, Boroscope-managed or other authorised processing arrangements where supported.

The relevant provider, processing location, data retention practices and technical configuration may vary.

Material arrangements applicable to customer personal data will be disclosed through the appropriate contractual documentation, sub-processor information or service-specific notices.

No universal data residency, zero-retention or locally hosted AI guarantee is made by this Policy.

9. Sharing Personal Information

We may share personal information with third parties where necessary and lawful.

Categories of recipients may include:

9.1 Infrastructure and hosting providers

Providers supporting application hosting, infrastructure, storage, networking, backup, monitoring and platform delivery.

9.2 Payment service providers

Authorised providers responsible for processing payments, preventing payment fraud and supporting billing transactions.

9.3 Authentication and identity providers

Providers supporting secure authentication or customer-configured identity services.

9.4 AI and technology providers

Providers supporting authorised document-processing, AI analysis or other enabled technical functionality.

9.5 Customer-authorised integrations

Third-party services connected at the direction of a customer organisation, subject to the relevant integration and contractual arrangements.

9.6 Professional advisers

Legal advisers, accountants, auditors and professional advisers where reasonably necessary.

9.7 Authorities and legal proceedings

Public authorities, regulators, courts or law enforcement agencies where disclosure is required or otherwise permitted by applicable law.

9.8 Corporate transactions

A potential buyer, investor, successor or professional adviser in connection with a genuine business transaction, subject to applicable confidentiality and data protection safeguards.

We do not sell personal information to data brokers or advertisers.

We do not authorise third parties to use non-public Customer Data for unrelated advertising or general-purpose AI training without an applicable lawful basis and contractual authorisation.

10. Sub-processors

Where Boroscope acts as a data processor, it may engage authorised sub-processors to support delivery of the Services.

Applicable sub-processors may provide cloud hosting, storage, security, authentication, messaging, support, billing or AI-processing services.

The current sub-processor arrangements, applicable processing locations and customer notification or objection procedures will be governed by the Data Processing Agreement and available sub-processor documentation.

Sub-processor information: [INSERT VERIFIED PUBLIC URL OR CONTACT PROCESS]

We will not describe a third-party provider as an active sub-processor unless it is actually used for relevant customer data processing.

11. International Data Transfers

Personal information may be processed outside the United Kingdom where necessary for an authorised service, support activity or third-party processing arrangement.

Where international transfers are subject to UK data protection restrictions, we will implement an appropriate transfer mechanism and supplementary safeguards where required.

These may include:

• Transfers to destinations covered by applicable adequacy regulations.

• The UK International Data Transfer Agreement.

• The UK Addendum to approved Standard Contractual Clauses.

• Other lawful transfer mechanisms applicable to the relevant circumstances.

We will assess transfer risks and applicable safeguards as required by law.

Customers with specific data residency requirements should refer to their executed agreement and applicable service configuration.

12. Data Security

We implement appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, disclosure, alteration and unlawful processing.

Depending on the system, information type and applicable configuration, measures may include:

• Access controls.

• Authentication safeguards.

• Role-based permissions.

• Encryption.

• Network and infrastructure protections.

• Security monitoring.

• Audit logging.

• Vulnerability management.

• Secure development practices.

• Backup and recovery measures.

• Incident response procedures.

• Personnel confidentiality obligations.

No internet-connected system can be guaranteed completely secure.

Where Boroscope acts as a processor, the applicable Data Processing Agreement and security commitments govern its obligations to the customer.

13. Data Retention

We retain personal information only for as long as reasonably necessary for its relevant purpose, taking account of applicable legal, contractual, security and operational obligations.

Retention periods may vary according to the category of information.

13.1 Account information

Account and user information is generally retained while the relevant account remains active and for an appropriate period thereafter where required for contractual, security, legal or dispute-resolution purposes.

13.2 Customer Data

Customer Data is retained according to the subscribed service, applicable agreement, customer instructions and Data Processing Agreement.

After termination, eligible Customer Data will be returned, made available for export or deleted in accordance with the governing agreement, subject to lawful retention requirements.

13.3 Billing and financial records

Relevant billing and financial records are retained for the period required under applicable tax, accounting and legal requirements.

13.4 Security and audit information

Security logs and audit records are retained according to applicable security policies, legal obligations, risk assessments and contractual requirements.

Audit records may have different retention requirements from ordinary application data.

13.5 Support correspondence

Support communications are retained for as long as reasonably required to resolve issues, maintain appropriate records and address potential disputes.

13.6 Backups

Residual information may remain in protected backups for a limited period after deletion from active systems, subject to established backup rotation, access restrictions and applicable legal obligations.

Where a specific retention period is required by law or contract, that requirement will take precedence over general retention practices described here.

14. Individual Data Protection Rights

Depending on the applicable law and circumstances, individuals may have rights to:

• Request access to their personal information.

• Request correction of inaccurate or incomplete information.

• Request erasure of personal information.

• Request restriction of processing.

• Object to processing based on legitimate interests.

• Receive personal information in a portable format where applicable.

• Withdraw consent where processing is based on consent.

• Exercise applicable rights concerning solely automated decision-making with legal or similarly significant effects.

These rights are subject to applicable conditions and exemptions.

Requests may be submitted to:

[PRIVACY EMAIL]

We may request information reasonably necessary to verify identity and process the request securely.

Where the requested information is controlled by a customer organisation, we may refer the individual to that organisation or assist it in responding under the relevant processing agreement.

15. Automated Decision-Making and Profiling

RegBeat may perform automated analysis of regulatory publications, organisational data and compliance-related information.

Such analysis is generally directed at organisational regulatory intelligence and workflow support, rather than making decisions about the legal rights of identifiable individuals.

We do not intend to use Boroscope-controlled personal information for solely automated decisions producing legal or similarly significant effects on individuals without establishing the necessary lawful basis, transparency and safeguards.

Where a particular customer-directed workflow involves automated processing with such effects, the customer must assess its obligations as controller, and Boroscope will fulfil its applicable processor obligations.

16. Cookies and Website Analytics

Cookies and comparable technologies may support:

• Authentication and secure sessions.

• Fraud prevention and application security.

• Remembering user preferences.

• Essential application functionality.

• Optional website analytics.

• Optional communications measurement.

Strictly necessary technologies may be used where permitted without consent.

Non-essential technologies requiring consent will not be activated before the relevant consent has been obtained.

Where available, users may adjust optional cookie preferences through:

[COOKIE SETTINGS LINK]

Users may also control certain cookies through their browser settings, although disabling essential cookies may prevent some functionality from operating.

Any separate Cookie Notice will identify the actual cookie categories, providers and relevant retention periods.

17. Marketing Communications

We may send product information, event invitations or other business communications where permitted by applicable law.

Where consent is required, we will obtain it before sending the relevant communications.

Marketing messages will provide an appropriate method to unsubscribe or object.

Unsubscribing from marketing does not prevent necessary contractual, billing, administrative or security communications.

18. Third-Party Websites and External Regulatory Sources

The Services may contain links to third-party websites, regulators, publications, documentation providers and other services.

Those third parties may have independent privacy practices.

This Privacy Policy does not govern personal information independently collected by those third parties.

Users should review the applicable third-party privacy information before submitting personal information to external services.

19. Children’s Privacy

RegBeat is intended primarily for professional and organisational use.

The Services are not directed at children.

We do not knowingly solicit children to register for RegBeat accounts.

If we become aware that personal information has been collected from a child in circumstances requiring parental consent or another lawful basis that is absent, we will take appropriate steps in accordance with applicable law.

20. Security Incidents and Personal Data Breaches

We maintain procedures intended to identify, investigate, contain and respond to security incidents.

Where a personal data breach occurs, we will assess applicable notification and cooperation obligations.

When Boroscope acts as a processor, it will notify and assist the relevant customer controller in accordance with the applicable Data Processing Agreement and data protection law.

When Boroscope acts as a controller, we will assess whether notification to the relevant supervisory authority or affected individuals is required.

21. Regulatory and Legal Disclosure

We may disclose personal information where necessary to comply with applicable law, enforceable legal process or a lawful request from a competent authority.

We will assess such requests and disclose only information that is legally required or otherwise lawfully permitted.

Where legally permitted and appropriate, we may notify the affected customer or individual.

22. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in legislation, operational practices, technology, third-party processing arrangements or the Services.

The current version will be published on our website with an updated effective date.

Where a change materially affects how we process personal information, we will provide additional notice or obtain consent where required by law.

Changes will not retrospectively authorise processing that previously required consent or another lawful basis.

23. Complaints

If you have a concern about our handling of personal information, please contact:

[PRIVACY EMAIL]

We will review your concern and respond as appropriate.

Where the UK GDPR applies, individuals may also raise concerns with the UK Information Commissioner’s Office.

Information Commissioner’s Office:
https://ico.org.uk

Individuals in other jurisdictions may have the right to contact their relevant data protection supervisory authority.

24. Contact Details

For enquiries about this Privacy Policy or our processing of personal information:

[FULL LEGAL COMPANY NAME]
Trading as Boroscope
Registered office: [ADDRESS]
Website: https://www.boroscope.com
Email: [PRIVACY EMAIL]
Data Protection Officer or privacy contact: [CONTACT DETAILS]

End of RegBeat Privacy Policy