Who we are
This policy explains how TraceID Ltd handles personal data on this website, traceid.io, and in the TraceID Hub, the service through which we provide TraceID Verified and TraceID Traced.
TraceID Ltd is registered in England and Wales with company number 16802403. Our registered office is Abacus House, Pennine Business Park, Longbow Close, Huddersfield HD2 1GQ. You can contact us about anything in this policy at [email protected].
Our role
For this website and for enquiries you send us, we are the controller of your personal data.
For the data our customers put into the Hub, the customer is the controller and we are their processor. We handle that data on the customer's instructions, under our agreement with them. If you are a user of a customer's Hub account, or your details appear in their records, please contact that customer first about your data.
What we collect
- Contact form. Your name, email address, company and message, and which page you sent the form from.
- Hub accounts. The name, email address and role of each user, which the customer provides when their account is set up or a user is invited, and the details of how each user signs in.
- Server logs. Technical records of requests to the website and the Hub, such as IP address, browser user agent and the time of the request.
- Audit log. A record of each action taken in the Hub, with the user, the time, the IP address, the browser user agent and a request ID.
- Scan pages. When someone scans a Traced QR code, the scan page records the time, an approximate location (country, region and city), the device, browser, operating system and referring page. It records a precise location only if the person allows it in their browser. We hold scan records for the customer whose product it is.
- Website visits. Aggregated visit figures from Umami, described below.
How we use it
- To reply to your enquiry and arrange a demo if you ask for one.
- To provide the Hub to our customers, including signing users in and sending the emails the Hub sends.
- To keep the website and the Hub secure, and to investigate misuse.
- To understand which pages of this website are useful, in aggregate.
- To meet our legal obligations.
Lawful bases
- Legitimate interests for replying to enquiries, keeping our systems secure, and aggregated website analytics.
- Contract for providing the Hub to the customer we have an agreement with.
- Legal obligation where the law requires us to keep or disclose information.
Contact form
The contact form is protected by Cloudflare Turnstile, which checks that the form is being sent by a person rather than a bot. To do this, Cloudflare processes technical information about your browser and connection. Your message is then sent to our inbox by Resend, an email delivery service.
Analytics and cookies
We use Umami Cloud to count visits to this website. Umami is cookieless: it does not set cookies or build a profile of you, and it reports only aggregated figures such as page views and referring sites. Because no tracking cookies are used, this website does not show a consent banner.
The Hub sets a session cookie when you sign in, which is needed to keep you signed in. It is not used for tracking.
Who we share it with
We do not sell personal data. We share it only with the sub-processors that help us run the website and the Hub:
- Amazon Web Services, which hosts the Hub in London and sends the Hub's emails.
- Cloudflare, which carries traffic to the Hub, hosts this website and runs Cloudflare Turnstile.
- Resend, which delivers contact form messages to us.
- Umami, which provides cookieless website analytics.
The current list is also on our security page. We may also disclose data where the law requires it.
Where it is stored
Hub data is stored in AWS in London. Some sub-processors may process data outside the UK. Where they do, we rely on the safeguards that UK GDPR and EU GDPR require for international transfers.
How long we keep it
We keep personal data for as long as needed to provide the service and meet legal obligations, and then delete it. Data in a customer's Hub account is kept or deleted on the customer's instructions.
Your rights
Under UK GDPR, and EU GDPR where it applies to you, you have the right to:
- ask for a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted, or its use restricted, in some circumstances;
- object to our use of your data where we rely on legitimate interests;
- receive data you gave us in a portable format, in some circumstances.
To use any of these rights, email [email protected]. We will reply within one month.
Complaints
If you are unhappy with how we have handled your data, please tell us first so we can put it right. You can also complain to the Information Commissioner's Office at ico.org.uk. If you are in the EU, you can complain to the data protection authority in your country.
Changes to this policy
We will update this policy when how we handle personal data changes. The date at the top shows when it last changed.