Privacy Policy

01Controller or processor — which one we are

Plenix plays two different roles depending on whose data is in question, and the distinction decides who you should go to about it. Getting this right matters more than anything else in this document.

02Who we are

Plenix Cloud Ltd (trading as Plenix) provides a multi-tenant business management platform. Where this policy says “we”, “us” or “Plenix”, it means that company.

03What we collect

Data you give us

• —Account data — name, work email address, telephone number, job title, employer, and the credentials used to sign in.
• —Billing data — billing contact, billing address, VAT number, purchase order references, and the subscription and invoice history. Card numbers are collected and stored by our payment processor, not by us.
• —Enquiry data — anything you send in a demo request, sales chat, support ticket or email to us.
• —Customer Data — everything you and your users put into the platform. See section 5; we handle this as a processor.

Data we generate or observe

• —Usage and audit records — which features are used, by which account and when. The platform writes an audit entry for every change made to a record, because customers need that trail as much as we do.
• —Technical data — IP address, browser and device type, operating system, timestamps, and error diagnostics captured in server logs.
• —Security data — sign-in attempts, multi-factor authentication events, API key use, and rate-limit and abuse signals.

04Why we use it, and on what lawful basis

Every use of personal data needs a lawful basis under Article 6. Ours are set out in full below rather than summarised, so you can check them.

Where we rely on legitimate interests we have carried out a balancing assessment and concluded our interest does not override your rights. You can ask us for the reasoning behind any of them, and you can object — see section 10.

We do not sell personal data, we do not share it with data brokers, and we do not use it for automated decision-making that produces legal or similarly significant effects about you.

05Data inside your Plenix tenant

Plenix covers CRM, service desk, HR, payroll, accounting, device monitoring and more, so the data our customers put into it can be extensive and some of it can be sensitive — employee records, payroll figures, health and absence information, disciplinary records and identity documents among them.

We handle all of it as a processor, on the customer’s documented instructions, under the terms of our Data Processing Agreement. In practical terms that means:

• —Each customer’s data lives in a separate database, not a shared table with a tenant column. Requests are bound to a tenant at the point of authentication.
• —Personal data fields identified as sensitive are encrypted at the field level before they reach the database, in addition to encryption of the storage itself.
• —We do not use Customer Data to train machine-learning models, and we do not mine it for our own commercial purposes.
• —Our staff do not browse customer tenants. Access for support is on a least-privilege, need-to-know basis, is logged, and is normally only exercised at the customer’s request.

If you are a Plenix customer, you are the controller for this data. That makes you responsible for having your own lawful basis to hold it, for telling your own people about it, and for keeping it accurate and no longer than you need it.

06Who we share it with

We share personal data with the service providers listed on our Sub-processors page, and with nobody else except as set out below. Each one is bound by a written contract that meets Article 28 and may only act on our instructions.

• —Infrastructure and platform providers — hosting, email delivery, payment processing. 3 of these are engaged for every customer; the rest only if you enable the relevant feature.
• —Professional advisers — accountants, auditors, insurers and lawyers, where they need it and under a duty of confidence.
• —Authorities — where we are legally required to disclose. We will tell the affected customer unless we are legally prohibited from doing so.
• —A buyer or successor — if the business is sold or reorganised, under confidentiality, and with this policy continuing to apply to the data transferred.

07International transfers

Customer Data is stored in the United Kingdom. Some of the providers we use process limited personal data in the European Economic Area and the United States.

Where a transfer leaves the UK or the EEA and the destination is not covered by adequacy regulations, we rely on the UK International Data Transfer Agreement (or the UK Addendum to the EU Standard Contractual Clauses) and the EU Standard Contractual Clauses, together with a transfer risk assessment and supplementary technical measures — principally encryption in transit and at rest, and minimising what crosses the border in the first place. The specific mechanism for each provider is named on the Sub-processors page.

08How long we keep it

We keep personal data only as long as we need it for the purpose it was collected, then delete it or irreversibly anonymise it.

09How we protect it

We apply technical and organisational measures appropriate to the risk, as Article 32 requires. The full control set — and how it maps to ISO/IEC 27001 and ISO/IEC 27701 — is on the Security page. In summary:

• —Encryption in transit (TLS 1.2+) and at rest, plus field-level encryption of sensitive personal data.
• —Per-tenant database isolation, with every request bound to a single tenant.
• —Role-based access control, multi-factor authentication, and single sign-on for customers who want it.
• —An immutable audit trail of changes, and retained security logging.
• —Encrypted, tested backups with a documented restoration process.
• —A documented incident response procedure, including the 72-hour breach notification duty under Article 33.

No system is perfectly secure, and we do not claim otherwise. If you believe you have found a vulnerability, please report it to security@plenix.cloud — see our disclosure policy.

10Your rights

Where we are the controller of your data, you have the right to:

• —Be informed — which is what this document is for.
• —Access a copy of the personal data we hold about you.
• —Rectification of anything inaccurate or incomplete.
• —Erasure, where we have no overriding reason to keep it.
• —Restriction of processing while a dispute about it is resolved.
• —Portability — a machine-readable copy of data you gave us.
• —Object to processing based on legitimate interests, and to direct marketing at any time, absolutely.
• —Withdraw consent where consent was the basis, without affecting what was lawful before you withdrew it.

Write to privacy@plenix.cloud. We will respond within one month, extendable by two further months for complex requests — we will tell you if that applies and why. There is no charge unless a request is manifestly unfounded or excessive. We may need to verify your identity before we act, and we will ask for no more information than that requires.

11AI features

Some parts of Plenix — the assistant, semantic search, ticket triage and generated summaries — send content to a third-party AI provider to produce a result. These features are off unless enabled, and can be disabled by an administrator at any time.

• —Only the content needed for the specific request is sent, and only when the feature is invoked.
• —Our AI provider is contractually prohibited from using that content to train its models.
• —Output is a suggestion. It is not used to make any decision about a person automatically, and it should be reviewed before it is relied on.
• —The provider and its processing location are named on the Sub-processors page.

12Children

Plenix is a business platform. It is not directed at children and we do not knowingly collect data from anyone under 16 through this website or the sign-up process. If a customer records data about a child within their own tenant — a student, an apprentice, a service user — they do so as controller and are responsible for the additional protections that requires.

13Changes to this policy

We update this policy when what we do changes. The revision date is shown at the top. For changes that materially affect how we handle your personal data we will give existing customers reasonable notice by email or in-app before they take effect — and where the law requires consent for a change, we will ask for it rather than assume it.

14Contact and complaints

For anything in this policy, or to exercise a right, contact privacy@plenix.cloud. We would rather hear from you first and put something right.

You also have the right to complain to a supervisory authority. In the UK that is the Information Commissioner’s Office — ico.org.uk/make-a-complaint, helpline 0303 123 1113. If you are in the EEA, you may complain to the supervisory authority in the country where you live, work, or where the issue occurred.