Privacy Policy

Definitions:

• We use any of the terms “Feedoptimise”, “we”, “us”, and “our” to refer to Feedoptimise ®™, a trading name of 33Concept Ltd.
• We use the term “platform” to refer to our website and services.
• We use the term “User” to refer to the person or legal entity that registers for, accesses, or uses the Feedoptimise services.
• We use any of the terms “you”, “your” and “yours” to refer to the User who is reading this Privacy Policy and accessing our services.
• We use the term “Content” as defined in the Terms of Use. The types of Content you provide to us are described in section 3.
• We use the term “Reporting Data” to refer to the item-level and campaign-level reporting data described in section 3.2.
• We use the term “browser” to refer to the software you are using to access the platform.
• We use the term “application” to refer to the part of the platform identified by app. subdomain and connected services in most part available only to the registered User. Its cookies are listed in section 7.2.
• We use the term “homepage” to refer to the part of the platform identified by www. subdomain - the public homepage. Its cookies are listed in section 7.2.
• Any other capitalised terms not defined in this Privacy Policy have the meaning given in the Terms of Use.

This Privacy Policy sets out how Feedoptimise ®™, trading name of 33Concept Ltd, uses and protects any information that a User provides when they access our website or related services we provide.

Feedoptimise takes the privacy rights of User information we may gather very seriously. We are committed to ensuring that your privacy is protected. Should we ask a User to provide certain information by which the User can be identified when using this website or related services, then the User can be assured that it will only be used in accordance with this Privacy Policy.

1. Intended users

   The Feedoptimise platform is a data management tool intended for use by businesses and organisations. It is not intended for consumer purposes. The platform is not directed to, and we do not knowingly collect personal data from, individuals under the age of 16. Users must be of legal working age and, where acting on behalf of an organisation, authorised to bind that organisation to our Terms of Use.

   If you believe that an individual under the age of 16 has provided personal data to us, please contact privacy@feedoptimise.com and we will take appropriate steps to remove the relevant data.

2. Collected data

   In order to provide you with access to our platform as well as various services, we have to collect certain types of data. We have grouped it into four categories below:

   1. User settings

      This includes information such as your email address, name, and password as well as any settings created by a User while using our platform. We need it so that we can enable login functionality, show your name in the change history, know which accounts you have access to, and provide the requested service. To maintain the functionality of our systems, we store this data for as long as you have access to an active Feedoptimise account. When an account is closed, the logins used to access it are not removed, so that they can still be used to view billing history, to view mapping settings and change history for as long as these are retained, and to contact our support team. If a login is not used for a continuous period of three (3) years after closure, and it does not give access to any other active account, we delete or anonymise it. You can ask us to delete your login sooner by contacting privacy@feedoptimise.com. Mapping settings are retained after your account is closed, as described under Changes history below.

   2. Billing profile

      This includes information about your company that is needed to raise valid tax bills for the platform use, historical charges, and receipts. This data is required by law in order to raise a valid invoice for the services provided should you create your own account and set up a billing profile with Feedoptimise. This data can't be removed as it's required by the tax authorities and needed for bookkeeping.

   3. Changes history

      This includes your profile name, as well as information such as the actions you have taken with assets in your account, e.g., changing a feed name, setting up a new source, updating mapping, etc. We need this data to provide you with the ability to view and revert your changes, and to keep an accurate record of who made each change and when. We store each change history entry for two years from the date of the change, so that you have restore points available for that period. After your account is closed, and after you remove any sources or feeds, we retain your mapping settings and the related change history for twelve (12) months, and in any event no change history entry is kept for longer than two years from the date of the change. We keep them for this period so that, if you return, your configuration can be restored automatically when you reconnect your sources, so that changes made within your account can be audited, and so that we can establish, exercise or defend legal claims relating to the Services, for example to show whether a change was made within your account or by us. During this period you can still view your mapping settings and change history by logging in, as described under User settings above. Within Feedoptimise, access to this data is restricted to authorised personnel and it is used only for these purposes. At the end of the retention period it is deleted or anonymised. You can ask us to delete it sooner by contacting privacy@feedoptimise.com, except where we need to keep it to establish, exercise or defend legal claims.

   4. Access logs

      This includes data required for auditing access to our services as well as potential bugs and issues, information about your connection such as IP, user agent, requests to our platform, and its responses both of which are stripped out from confidential data before storing. This data allows us to keep improving our system and to be able to fix potential bugs or other issues. We may store this data for up to six months.

3. Data you provide to us

   The information you furnish us is utilised primarily to enhance your integration channels and marketing initiatives. You retain complete control and ownership of this data. The Content submitted through the platform consists of product and catalogue data and is not intended to include personal data. Where any Content does contain personal data, you remain the controller of that data and are responsible for ensuring you have a lawful basis for providing it to us. In that case, we act as your processor, and we process that personal data in accordance with our Data Processing Agreement. We have categorised this information into three groups as outlined below:

   1. Sources and Overrides

      This encompasses the information you supply, primarily concerning your products, to facilitate integration with diverse marketing channels or to satisfy your internal requirements. This includes data analysis or conducting additional modifications. The scope of this data is not restricted solely to product attributes and may extend to other catalogue, inventory or campaign data necessary for these purposes. It is not intended to include personal data.

   2. Reporting Data

      This category encompasses a range of reporting services available for connection, designed to augment your feed optimisation initiatives. It does so by enabling the application of additional rules or filters, which are informed by the metrics available through these integrations.

      The data retrieved through these connections is item-level and campaign-level, for example product performance metrics, impressions, clicks, conversions, spend and similar aggregated measures, together with the product or campaign identifiers those metrics relate to. We do not retrieve user-level identifiers, cookie or client identifiers, device identifiers, IP addresses, or any other data relating to identifiable individuals. Reporting Data is used solely to inform the rules and filters you have configured within your account.

   3. Google APIs

      Where you choose to connect your Feedoptimise account to Google services (for example, Google Merchant Center, Google Ads, or Google Analytics), Feedoptimise retrieves data from those services on your behalf to support the features and integrations you have configured. The connection is initiated and authorised by you, and the data retrieved is limited to what is required to deliver the requested functionality.

      The data retrieved through these connections is item-level and campaign-level, for example product performance metrics, disapprovals, impressions, clicks and cost data. We do not retrieve user-level identifiers, cookie or client identifiers, or any data relating to identifiable individuals.

      Feedoptimise's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

      • We use data received from Google APIs only to provide and improve user-facing features you have configured or requested.
      • We do not use data received from Google APIs to train, fine-tune, or otherwise improve AI models, whether our own or those of third parties.
      • Where you configure a feature that involves transmitting data received from Google APIs to a third party (for example, including a Google metric as an attribute in a feed exported to a marketing channel, or using an AI modifier or the AI Feed Agent to process Google API data), the relevant data is transmitted only to the destination you have configured and only to deliver the feature you have requested. Such transfers are permitted under the Limited Use requirements as part of providing user-facing functionality, and are handled in accordance with the applicable sub-clauses in the Third-party sharing section of this Privacy Policy.

4. Lawful basis for processing

   Where UK or EU GDPR applies, we rely on the following lawful bases under Article 6 to process personal data:

   1. Performance of a contract (Article 6(1)(b)). The majority of our processing is carried out to provide the Feedoptimise services you have signed up for, including creating and administering your account, providing platform access, delivering the features and integrations you have configured, and providing related support.
   2. Compliance with a legal obligation (Article 6(1)(c)). Certain processing is required to comply with statutory obligations to which we are subject, in particular the retention of billing, invoicing, and accounting records for tax purposes.
   3. Legitimate interests (Article 6(1)(f)). We process limited data, such as access logs and diagnostic information, where necessary for the legitimate interests of operating, securing, monitoring, and improving the platform and our public website, as well as for fraud prevention and protecting our infrastructure. We carry out a balancing assessment to ensure these interests are not overridden by your rights and freedoms. We also rely on our legitimate interests to retain mapping settings and change history after an account is closed, for the period described under Changes history in section 2, so that a returning User's configuration can be restored when they reconnect their sources, changes made within the account can be audited, and legal claims relating to the Services can be established, exercised or defended. We also rely on our legitimate interests to keep logins active after an account is closed, for the period described under User settings in section 2, so that you can view your billing history, mapping settings and change history, contact our support team and return to the platform.

   Feedoptimise services are provided on a business-to-business basis. We do not rely on consent as the primary lawful basis for processing personal data, except in respect of optional features or non-essential cookies, where consent is obtained separately and can be withdrawn at any time.

5. Data security

   We follow industry-standard practices and maintain technical and organisational security measures covering the collection, storage, and disclosure of personal data, in order to protect it against unauthorised access, alteration, disclosure, or destruction, and to comply with relevant UK and EU data protection laws.

   Personal data you provide to us is stored on infrastructure we operate on Google Cloud Platform. Connections between your browser and our platform are encrypted in transit using TLS, from your browser to our network provider Cloudflare and again from Cloudflare to our servers, and data is encrypted at rest using AES-256 encryption applied at the infrastructure layer by our cloud provider. Access to systems containing personal data is restricted to authorised personnel on a need-to-know basis and is logged for audit purposes.

   Sensitive credentials that you provide to us to enable connections to your systems or third-party services (for example, FTP and SFTP passwords, API keys, and similar access tokens) are additionally encrypted at the application layer using AES-256-CBC before being written to our database. This means that, in addition to the infrastructure-level encryption described above, your credentials are stored in an encrypted form that requires application-managed keys to decrypt.

   Where we have issued you a password (or you have chosen one) that enables access to certain parts of our platform, you are responsible for keeping that password confidential and must not share it with anyone. Passwords are not stored in plain form. They are hashed using current industry-standard algorithms before being stored.

   To strengthen account security, we offer two-factor authentication (2FA) using a time-based one-time password (TOTP) authenticator app. 2FA is available to all Users and can be enabled at any time from your account settings. We strongly recommend enabling 2FA, particularly for accounts with administrative permissions or access to sensitive integrations.

   No method of transmission or storage is completely secure. While we use commercially reasonable measures to protect your data, we cannot guarantee absolute security. In the event of a personal data breach affecting your information, we will notify you and any relevant supervisory authority where required by applicable law and within the timeframes prescribed by UK and EU GDPR.

   We also process certain data for the purposes of operating the platform securely and protecting it from abuse. This includes monitoring access logs and authentication events to detect and respond to unauthorised access attempts, brute-force login attempts, and other suspicious activity; applying rate limits and automated controls to prevent misuse of the platform and its APIs; and recording changes made within accounts in our standard change history for audit and forensic purposes. As part of this, all traffic to the platform is filtered by Cloudflare to block denial-of-service attacks, malicious requests and automated abuse, and the contact and demo request forms on our homepage use Cloudflare Turnstile, which runs a short check in your browser, using information such as your IP address and browser characteristics, to confirm that the form is being sent by a person rather than an automated script. We receive only the result of that check. This processing is carried out on the basis of our legitimate interests in maintaining the security, integrity, and availability of the service, as described in the Lawful basis for processing section.

6. Third-party sharing

   We do not sell, rent, or trade your personal data. We share data with third parties only in the limited circumstances described below, and only to the extent necessary for the relevant purpose.

   1. User-initiated integrations

      When you choose to connect your account with a third-party marketing channel or external service (for example, publishing a product feed to Google Shopping, Meta, or a comparable channel), we transmit the relevant Content to that destination on your behalf. The data sent is limited to what is required to fulfil the integration you have configured and consists of product and catalogue data. You control which integrations are enabled and what Content is included.

   2. AI modifiers using your own API key

      Feedoptimise offers AI modifiers that you can choose to add to your feeds to enhance your feed optimisation work, for example by generating or refining product attributes. AI modifiers work in the same way whichever model powers them. This sub-clause covers AI modifiers that use a third-party AI provider through your own API key, and the next sub-clause covers Feedoptimise-AI modifiers that run on models we host. You retain full control over whether and how AI modifiers are used:

      • You choose the AI provider and model (for example, OpenAI, Anthropic, Google Gemini, xAI Grok, or another supported provider).
      • You supply your own API key for the chosen provider, which means the contractual relationship for that AI processing is between you and the provider directly. The provider's terms of service, privacy policy, and data-use policies apply to data sent through your key.
      • You decide which Content is sent for processing, and when. AI processing is not enabled by default.
      • AI outputs are stored as part of your Content so that unchanged data does not need to be processed again, and are retained and deleted in the same way as your other Content.

      When an AI modifier using your own API key runs, Feedoptimise transmits only the Content required to perform the requested operation to the provider you have configured, using your API key. We do not pass your Content to AI providers other than the one you have selected, and we do not use your Content to train AI models.

   3. AI modifiers using Feedoptimise-AI

      Feedoptimise-AI modifiers, such as the Feedoptimise-AI Prompt and the Feedoptimise-AI Image Prompt, work in the same way as the AI modifiers described above but run on open-weight models hosted on infrastructure we operate directly. They do not require your own API key, and your Content is not transmitted to any third-party AI provider.

      To protect your Content when using these features:

      • AI processing is not enabled by default. Content is processed only when you add a Feedoptimise-AI modifier to a feed, and only the Content referenced in your configured prompt, including any image URLs you supply, is processed.
      • Images supplied to the Feedoptimise-AI Image Prompt are downloaded from the URLs you provide solely to perform the requested operation. Where images depict individuals, we do not use them to identify any individual or to perform facial recognition.
      • AI outputs are stored as part of your Content so that unchanged data does not need to be processed again, and are retained and deleted in the same way as your other Content.
      • We do not use your Content, including prompts, images and outputs, to train, fine-tune, or otherwise improve AI models, whether our own or those of third parties.

   4. AI Feed Agent

      The AI Feed Agent is an in-platform AI assistant that helps with audits, diagnostics, rule drafting, and routine feed operations. The AI Feed Agent is an opt-in feature that you must activate separately for your account before it can be used. It is not enabled by default. Unlike AI modifiers that use your own API key, the AI Feed Agent runs on infrastructure that Feedoptimise contracts for directly. The AI providers supporting the AI Feed Agent act as our sub-processors and are listed in the Infrastructure and sub-processors section below.

      To protect your Content when using this feature:

      • We engage AI providers under enterprise API terms that prohibit the use of your Content to train, fine-tune, or otherwise improve the providers' models.
      • Only the Content required to perform the requested operation is transmitted to the provider, and only when you invoke the AI Feed Agent.
      • Destructive actions (such as forcing imports, syncing feeds, or blocking items) require explicit confirmation before they are executed. All changes initiated by the Agent are recorded in the standard change history.
      • We do not use your Content to train AI models, whether our own or those of third parties.

   5. Internal use of AI for customer support

      We use AI tools internally to assist our team in operating our customer support function. This includes proofreading and drafting replies to support tickets, summarising conversations, and analysing aggregated patterns in support interactions to help us identify trends and improve our service. AI does not autonomously communicate with you, and any reply you receive from our team has been reviewed and sent by a member of our staff.

      To protect your information when we use AI in this way:

      • We engage AI providers for this purpose under enterprise API terms that prohibit the use of your data to train, fine-tune, or otherwise improve the providers' models.
      • We do not use AI to make decisions about you that have legal or similarly significant effects.
      • The AI providers we engage for support operations are listed in the Infrastructure and sub-processors section.

      This processing is carried out on the basis of our legitimate interests in operating an efficient and high-quality support function, as described in the Lawful basis for processing section.

   6. MCP Server

      Feedoptimise provides a Model Context Protocol (MCP) server that allows you to connect your Feedoptimise account to MCP-compatible AI assistants, such as Anthropic Claude or OpenAI ChatGPT, in order to manage your account through conversation. The connection is initiated and authorised by you. The AI assistant you connect is operated by the third-party provider you have chosen, and data exchanged between Feedoptimise and that assistant is therefore subject to the provider's own terms of service and privacy policy.

      Where you choose to use this feature:

      • Authentication uses OAuth2 with scoped access tokens. Access is limited to the Feedoptimise accounts the Authorised User has permission to access, and each session operates against one selected account at a time.
      • Your existing role and permissions in the platform apply to all actions taken through MCP. If your role on an account is read-only, the connection is read-only on that account.
      • Destructive actions (such as forcing imports, syncing feeds, blocking items, or changing schedules) require explicit confirmation before they are executed. All changes made through MCP are recorded in the standard change history with an MCP tag and attributed to the authenticated Authorised User.
      • You can revoke the connection at any time from within the platform (Account, Credentials Hub) or from the connector settings of your AI assistant.

   7. Infrastructure and sub-processors

      The Feedoptimise platform is hosted on Google Cloud Platform (GCP), which acts as our primary infrastructure sub-processor. The GCP infrastructure on which the platform runs is located in the United States. We also engage additional service providers to deliver specific elements of the service, including:

      • A network and security provider, Cloudflare, Inc., through which all traffic to and from the application and the homepage passes before it reaches our servers. Cloudflare routes that traffic to us and protects the platform against denial-of-service attacks, malicious requests and automated abuse. To do this, it decrypts each connection at a Cloudflare data centre near you, inspects it, and encrypts it again before passing it to our servers. Cloudflare therefore processes connection data such as your IP address and browser details, and briefly handles the content of your requests, including any personal data they contain.
      • Payment processors, to facilitate billing and accept payments in supported currencies.
      • AI providers, to power the AI Feed Agent feature for Users who have opted in, and to support our internal customer support operations as described in the Internal use of AI for customer support sub-clause. We currently engage OpenAI (ChatGPT), Anthropic (Claude) and Google (Gemini API) under enterprise API terms that prohibit the providers from using your Content or other personal data to train their models. We may add further AI providers over time and will update this list accordingly.

      All sub-processors are contractually required to maintain security and confidentiality obligations consistent with this Privacy Policy and applicable data protection laws, and to process data only on our documented instructions. We do not authorise sub-processors to use your Content for their own purposes, including AI model training.

      Our self-hosted AI models run on hardware operated by Feedoptimise and located on our own premises in the United Kingdom. Data transmitted between our platform and this infrastructure is encrypted in transit.

      The sub-processors that may process personal data contained in your Content are also listed in Annex 3 of our Data Processing Agreement, together with the notice we give before engaging a new one.

   8. Legal and regulatory disclosure

      We may disclose data where required to do so by applicable law, court order, or other legal process, or where necessary to establish, exercise or defend legal claims, or to protect the rights, property, or safety of Feedoptimise, our Users, or others.

   9. International transfers

      Because our infrastructure provider Google Cloud Platform operates from the United States, our network provider Cloudflare handles traffic at data centres across its global network and is based in the United States, and certain AI sub-processors also process data outside the United Kingdom and the European Economic Area, personal data processed through the platform may be transferred outside the UK and EEA. Where this occurs, we rely on the safeguards required under UK and EU GDPR, including:

      • The provider's certification under the EU-U.S. Data Privacy Framework (DPF) and the UK Extension to the EU-U.S. DPF, where available;
      • Standard Contractual Clauses (SCCs) and the UK International Data Transfer Agreement, where applicable.

      These mechanisms ensure that data processed on US-based infrastructure or by US-based sub-processors remains subject to protections equivalent to those required under UK and EU data protection law. Further details on Google's compliance framework are available at policies.google.com/privacy/frameworks.

      Content processed by our self-hosted AI models is processed in the United Kingdom and is not transferred to any third-party AI provider.

7. Cookies

   Also known as browser cookies or tracking cookies, cookies are small, often encrypted text files, located in browser directories. They are used by us to help our Users navigate this website efficiently and perform certain functions. Please note that cookies can't harm your computer.

   1. How we use cookies

      We use cookies to remember that you are logged in to our platform. This includes session cookies used during active sessions, as well as persistent cookies when you choose to stay logged in beyond a single session or to provide additional functionality.

   2. Cookies we use

      Below is a list of all the cookies we use or may use, along with an explanation of their purposes. All of them are first-party cookies, set on feedoptimise.com domains.

      1. Cookies used by the app.feedoptimise.com

         Name	Purpose	Length
         _sess*	This is a session cookie, it is being removed when you close your browser and is required for the core platform functionality.	Session
         _at	This cookie works in tandem with the _sess* cookie and allows us to keep you logged in and is required for the core platform functionality. It is stored for up to 1h unless you are actively using our system at which point it's auto-renewed.	1 hour (auto-renewed with session)
         _rm*	This cookie is set when you choose to remember that you are logged in for up to 14 days.	14 days
         _2f*	This cookie is set when you enable 2-factor authentication and choose not to be asked about the 2-factor authentication code with each login but every 30 days.	30 days

         * matches any text, those cookie names contain a fixed prefix and are followed by a random set of characters.

      2. Cookies used by the www.feedoptimise.com

         Name	Purpose	Length
         fo_cc	A strictly necessary cookie that enables the homepage to remember your cookie consent choices, ensuring compliance with privacy regulations and maintaining your selected preferences across browsing sessions.	365 days
         _ga _ga_* _gcl_*	These cookies are used by Google Analytics to help us understand how visitors use our homepage, for example which pages are viewed, how many visitors are new and how sessions develop. We use this information in aggregate to improve the website. The cookies store a randomly generated identifier for your browser, and while they are active Google receives information such as your IP address and device details, which may be considered personal data under UK and EU GDPR. We do not use this data to identify you or to build individual profiles. Google may process this data outside the UK and EEA, relying on its certification under the EU-U.S. Data Privacy Framework. These cookies are disabled by default and are set only if you allow analytics cookies when visiting our homepage, www.feedoptimise.com. You can change your choice at any time through the cookie settings.	more info
         _gcl_ls	localStorage key used by Google's Conversion Linker to store ad click IDs (gclid) for Google Ads conversion tracking. Set only if Advertisement cookies are allowed.	Persistent
         fo_mc	Feedoptimise localStorage key tracking page views from Google Ads visitors. Set only if Advertisement cookies are allowed.	30 days

         * matches any text, those cookie names contain a fixed prefix and are followed by a random set of characters.
         The contact and demo request forms on the homepage also load Cloudflare Turnstile in a frame served from challenges.cloudflare.com, as described in section 5. Turnstile is used only to protect those forms from automated submissions, and we do not use it for analytics or advertising.

      3. Cookies set by Cloudflare on both subdomains

         Name	Purpose	Length
         __cf_bm	Set by Cloudflare, our network and security provider, to tell people apart from automated traffic and protect the platform from bots.	30 minutes
         cf_clearance	Set by Cloudflare when you pass a security challenge, so that you are not asked to complete it again on every request.	30 minutes
         _cfuvid	Set by Cloudflare to apply rate limits fairly to visitors who share the same IP address.	Session

         These cookies are set only when the relevant Cloudflare protection applies to your visit. They are strictly necessary to keep the platform secure, so they do not require consent.

8. How to contact us

   Feedoptimise ®™ is a trading name of 33Concept Ltd, a Private Limited Company registered in the United Kingdom under company number 07286718. 33Concept Ltd is the data controller responsible for the personal data it processes in its own right, including the account, billing and platform usage data described in section 2, and the cookie data described in section 7. Where Content submitted through the platform contains personal data, you remain the controller of that data, as set out in section 3.

   If you have questions about this Privacy Policy, wish to exercise any of your data protection rights, or have any other privacy-related concerns, you can reach us through any of the channels below:

   • By email: privacy@feedoptimise.com
   • By web form: www.feedoptimise.com/contact

9. Your rights under UK and EU GDPR

   Where UK or EU General Data Protection Regulation (GDPR) law applies to the processing of your personal data, you have the following rights:

   1. Right of access (Article 15). You have the right to obtain confirmation of whether we process your personal data and, if so, to receive a copy of that data along with information about how it is processed.
   2. Right to rectification (Article 16). You have the right to ask us to correct personal data that is inaccurate or to complete personal data that is incomplete.
   3. Right to erasure (Article 17). You have the right to ask us to delete your personal data in certain circumstances, for example where the data is no longer necessary for the purpose for which it was originally collected. This right is not absolute and may not apply where we are required to retain the data to comply with a legal obligation, such as the retention of billing and accounting records for tax purposes.
   4. Right to restriction of processing (Article 18). You have the right to ask us to restrict the processing of your personal data in certain circumstances, for example where you contest the accuracy of the data or have objected to its processing.
   5. Right to data portability (Article 20). You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to transmit that data to another controller, where the processing is based on contract or consent and is carried out by automated means.
   6. Right to object (Article 21). You have the right to object to the processing of your personal data where the processing is based on our legitimate interests. Where we cannot demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, we will stop processing your data on that basis.
   7. Right to withdraw consent (Article 7). Where the processing of your personal data is based on consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of any processing carried out before consent was withdrawn.

   To exercise any of these rights, please contact us by email at privacy@feedoptimise.com or through our web form. We will respond to your request within the timeframes required under applicable law, normally within one month of receipt. We may need to verify your identity before acting on a request, and we may extend the response period in line with applicable law where a request is complex or where we have received a number of requests from you.

   You also have the right to lodge a complaint with a data protection supervisory authority. In the United Kingdom, this is the Information Commissioner's Office (ico.org.uk). If you are based in the European Economic Area, you may contact your local supervisory authority.

10. Privacy policy updates

    Please note that this Privacy Policy may change from time to time. We will not reduce your rights under this Privacy Policy without your explicit consent. We will post any Privacy Policy changes on this page and if the changes are significant, we will provide a more prominent notice (including, for certain services, email notification of Privacy Policy changes).