Privacy Policy
This policy explains how we handle personal data when you use PlanIt Flooring. In short: we are the controller of your own subscriber data (covered here), and your processor for the customer data you enter into the CRM (covered by our Data Processing Agreement, available on request).
1. About this policy and who we are
1.1 This Privacy Policy explains how we collect, use, share and protect personal data when you use the PlanIt Flooring software platform and related websites, applications and services (the "Service").
1.2 The Service is provided by PlanIt Flooring Limited, a company registered in England and Wales under company number 17301169, whose registered office is at Incuhive Space, Hursley Park Road, Hursley, Winchester, Hampshire, England, SO21 2JN ("we", "us", "our"). For the purposes of UK data protection law, we are the data controller of the personal data described in clause 3 of this policy.
1.3 We comply with the UK General Data Protection Regulation ("UK GDPR") and the Data Protection Act 2018.
1.4 Our data protection contact is reachable at info@planitflooring.com.
2. Two different relationships — please read
2.1 The Service is used by flooring trade businesses (retailers, fitters and contractors). This creates two distinct data relationships, and it is important to understand which one applies.
2.2 Your own personal data (we are the controller). When you register and use the Service as a subscriber — your name, contact details, login, billing and how you use the platform — we decide how that data is used, so we are the controller and this Privacy Policy governs it.
2.3 Your customers' personal data (we are the processor). When you enter information about your own customers and contacts into the CRM, you are the controller of that data and we act as your processor. Our handling of that data is governed by our Data Processing Agreement (available on request via info@planitflooring.com), not by this policy. You are responsible for having a lawful basis to enter it and for your own privacy notices to those individuals.
3. The personal data we collect
3.1 We collect and process the following categories of personal data about you as a subscriber:
- Account data — name, business name, job role, email address, telephone number, and login credentials.
- Billing data — billing name and address, subscription plan, and payment records. Card details are handled by our payment provider; we do not store full card numbers.
- Usage data — how you interact with the Service: features used, quotes and estimates generated (as activity, not your customers' identities), volumes, frequency, session and device information.
- Technical data — IP address, browser type, device identifiers, and cookies or similar technologies (see clause 5).
- Communications data — messages, support tickets, and feedback you send us.
3.2 We do not seek to collect special category data about you, and you should not enter it into fields that are not designed for it.
4. How we use your data, and our lawful bases
4.1 We use your personal data for the purposes below. Under UK GDPR we must have a lawful basis for each purpose, which we set out alongside it:
| Purpose | Lawful basis |
|---|---|
| Creating and administering your account; providing the Service | Performance of our contract with you |
| Taking payment and managing your subscription | Performance of our contract; legal obligation (tax/accounting records) |
| Providing support and responding to your enquiries | Performance of our contract; our legitimate interests in supporting users |
| Securing the Service and preventing misuse or fraud | Our legitimate interests in keeping the Service safe |
| Improving and developing the Service, and producing analytics, benchmarking and market intelligence | Our legitimate interests (see clause 6) — and, once data is anonymised, it is outside UK GDPR |
| Sending service messages (e.g. changes, outages, renewals) | Performance of our contract; legal obligation |
| Sending marketing about our products | Consent, or our legitimate interests for existing customers (you can opt out at any time) |
4.2 Where we rely on legitimate interests, we have considered the impact on you and do not use your data in ways that override your rights. You can ask us about that assessment using the contact details in clause 12.
5. Cookies and similar technologies
5.1 We use cookies and similar technologies to run the Service, remember your preferences, keep you signed in, and understand usage. Non-essential cookies (such as analytics) are only set where you have agreed via our cookie banner. You can manage non-essential cookies at any time through our cookie banner; a full Cookie Policy will be published here in due course.
6. Aggregated and anonymised data
6.1 We continuously develop the Service and produce market-level insight and benchmarking from how the Service is used. To do this, we create datasets derived from your data and your use of the Service which have been aggregated and irreversibly anonymised so that no individual person, no customer or contact of yours, and no identifiable business can be identified or re-identified from them ("Aggregated and Anonymised Data").
6.2 We anonymise this data using recognised techniques — including aggregation, removal of direct and indirect identifiers, and a suitable minimum-aggregation threshold — so that the result is no longer personal data under the UK GDPR. Once data has been properly anonymised in this way, data protection law no longer applies to it.
6.3 We may retain, use, reuse, combine, analyse, publish, commercialise and license Aggregated and Anonymised Data for any lawful purpose, including improving the Service, producing analytics and benchmarking, generating flooring market and demand intelligence, and creating products or reports for third parties such as suppliers, manufacturers and distributors. We may continue to do this after your account closes.
6.4 To be clear: we only use data in this way after it has been aggregated and anonymised so that it cannot identify you, your business, or your customers. We do not sell or license your identifiable personal data, or your customers' identifiable personal data, to third parties for their own marketing.
7. Who we share your data with
7.1 We share personal data only as necessary, with:
- Service providers (processors) who help us run the Service — for example cloud hosting, payment processing, email delivery, analytics and customer support tools. They act on our instructions and under contract.
- Professional advisers such as lawyers, accountants and auditors, where needed.
- Authorities or third parties where we are required to by law, or to establish, exercise or defend legal claims.
- A buyer or successor if we sell or reorganise our business, subject to this policy.
7.2 We share Aggregated and Anonymised Data with partners as described in clause 6. Because that data is not personal data, it is not a sharing of your personal information.
8. International transfers
8.1 We aim to keep personal data within the UK or European Economic Area. Where a provider processes data outside the UK, we ensure an appropriate safeguard is in place — such as a UK adequacy regulation, the UK International Data Transfer Agreement, or the UK Addendum to the EU Standard Contractual Clauses.
9. How long we keep your data
9.1 We keep your personal data for as long as your account is active and for as long afterwards as we need it to meet legal, accounting or reporting requirements, or to resolve disputes. Typical periods: account data for the life of the account plus 6 years; billing records for 6 years for tax purposes; support communications for 24 months.
9.2 Aggregated and Anonymised Data is not personal data and is not subject to these retention periods (see clause 6).
10. How we protect your data
10.1 We use appropriate technical and organisational measures to protect personal data, including access controls, encryption in transit, and restricting access to those who need it. No system is completely secure, but we take reasonable steps to keep your data safe and to notify you and the ICO of a breach where the law requires.
11. Your rights
11.1 Under UK data protection law you have the right to: be informed about how we use your data; access a copy of it; have inaccurate data corrected; have data erased in certain circumstances; restrict or object to processing; data portability; and to withdraw consent where we rely on it. Exercising these rights is free in most cases.
11.2 To make a request, contact us using the details in clause 12. We will respond within one month, as required by law.
11.3 If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ICO) at ico.org.uk, or by calling 0303 123 1113. We'd appreciate the chance to address your concern first.
12. Contact us
12.1 Questions about this policy or your data? Contact info@planitflooring.com or write to us at our registered office above.
13. Changes to this policy
13.1 We may update this policy from time to time. If we make a material change, we will tell you by email or in-app notice and update the "Last updated" date above. Your continued use of the Service after the change takes effect means you accept the updated policy.